The rapid evolution of technology in educational settings has opened new avenues for enhancing learning experiences, particularly in specialized fields like network management. This paper explores the novel integration of a GenAI-based virtual assistant in a university-level network management course, focusing on its impact on developing students' soft skills, notably critical thinking and problem-solving abilities. Recognizing the increasing importance of these skills in the digital age, our study aims to assess the empirical effectiveness of this artificial intelligence-driven educational tool in fostering these competencies among students.

In this paper we present key pedagogical aspects and implementation details of a large-scale Continuous Professional Development (CPD) program. Its aim is to enable secondary education teachers in adopting Next Generation Digital Learning Environment (NGDLE) toolkits to prepare high school students towards tertiary education. The CPD program was implemented as part of pilot activities conducted by the Up2University, an European Commission innovation project, in eight countries: Germany, Greece, Hungary, Italy, Lithuania, Poland, Portugal, and Spain. The scope of this effort is to bridge the gaps between secondary schools and higher education within a comprehensive e-learning ecosystem. Thus, high school students are assisted in their quest to evolve into independent, self-directed learners.

In this paper we utilize XDP for DNS Deep Packet Inspection (DPI) in order to mitigate Water Torture attacks at the NIC driver level of Authoritative DNS Servers. Our approach may benefit DNS Administrators who wish to filter attack traffic within their DNS infrastructure and avoid the latency overhead and additional costs imposed by external cloud scrubbing services. Our schema does not depend on specialized hardware and does not blacklist entire domain name suffices, hence does not block legitimate requests. Packets are intercepted by XDP that identifies messages of DNS requests for further processing. Requested names are extracted from the message payload and categorized based on their validity. Valid names are forwarded to the user space to be resolved, whilst invalid ones are dropped within the Linux kernel at an early stage without downgrading the DNS service. Names are classified using Bloom Filters that map DNS zone contents in a memory efficient manner. These probabilistic data structures are free of false negatives and therefore valid DNS requests are never dropped. We provide a proof of concept setup to test our schema under a DDoS attack scenario and assess how mitigation performance is affected by DPI on DNS requests. Our experiments verify that using XDP significantly increases the throughput of valid DNS responses compared to user space alternatives. In conclusion, XDP emerges as a promising solution for the mitigation of Water Torture attacks against DNS servers.

Abstract In this paper, we investigate the applicability of inserting an OpenFlow middlebox to enhance the remotely triggered black hole routing mechanism, to mitigate distributed denial of service (DDoS) attacks in legacy networks. Specifically, we propose a modular architecture that exploits the network programmability of software‐defined networking within the context of network functions virtualization, deploying on‐demand virtualized network functions (VNFs) capable to manipulate and filter malicious traffic. Leveraging on the OpenFlow control functionality, we match and handle traffic on a per‐flow level, preserving connectivity to/from the victim while pushing the mitigation process upstream, towards the edge of the affected network. To that end, a multilevel anomaly detection and identification mechanism was developed, pinpointing the victim in case an attack is detected. Subsequently, a virtualized network function instructs the edge router to forward all traffic destined to the victim to an OpenFlow switch, acting as a middlebox capable to filter malicious traffic identified by an OpenFlow controller, while preserving benign flows. The proposed architecture was implemented and evaluated based on the combination of datasets containing traces of real DDoS attacks and normal background traffic from our university campus network. Our analysis illustrated a clear clustering of Internet protocol prefixes used by malicious sources; thus, we implemented a longest common prefix aggregation algorithm to enable scaling of the proposed mitigation process, overcoming constraints due to hardware limitations of OpenFlow devices. Our analysis verifies that the proposed modular and scalable schema can efficiently identify DDoS attack victims and filter malicious traffic, without exhausting system and network resources. Copyright © 2015 John Wiley & Sons, Ltd.

Experimentation is an invaluable part of learning in all sciences. However, building and maintaining laboratories is expensive, time and space consuming. Moreover, in computer science advances in technology can quickly make the infrastructure obsolete. In this paper we advocate the use of recently deployed public testbeds as remote labs for computer science education. As an example we describe the successful use of the GENI testbed in graduate and undergraduate courses and present a specific case study of GENI being used in an undergraduate class on Network Management and Intelligent Networks.

In this paper, we focused on two prevailing architectural approaches for control-plane virtualization in multi-tenant OpenFlow-ready SDN domains: The first permits the delegation of a specific, non-overlapping part of the overall flowspace to each tenant OpenFlow controller, exposing him/her the entire substrate topology; the second conceals the substrate topology to tenants by abstracting resources and exposing user-controlled (tenant) Virtual Networks (VNs). For both cases, we propose and analyze three control-plane slicing methods (domain, switch and port-wide), enforced by the management plane, that safeguard control-plane isolation among tenant VNs. Their effectiveness is assessed in terms of control-plane resources (number of flowspace policy rule entries, table lookup times and memory consumption) via measurements on a prototype implementation. To that end, we introduced and prototyped the Flowspace Slicing Policy (FSP) rule engine, an automated mechanism translating substrate management-plane policies into VN mapping control-plane rules. Our experiments, involving thousands of tenants VN requests over a variety of WAN-scale network topologies (e.g. Internet2/OSE3 and GÉANT), demonstrate that the port-wide slicing method is the most efficient in terms of tenant request acceptance ratio, within acceptable control-plane delays and memory consumption.

In this paper we investigate synergies between Network Functions Virtualization (NFV) architectures and Software-Defined Networks (SDN). We identify value adding capabilities such technologies may offer to telecom providers regarding agile management and deployment of network functions across their infrastructures. Specifically, we propose a modular NFV architecture that permits policy-based management of Virtualized Network Functions (VNFs). Hence we can handle the lifecycle of VNFs and dynamically instantiate business applications as Service Chains of diverse VNFs delivered to large scale customers. To describe network resources, network control functions and VNFs capabilities we introduced an Information Model that abstracts these elements. In order to verify the proposed architecture we considered the case of multiple Content Delivery Network (CDN) providers having CDN caching nodes hosted by another operator. We implemented and deployed VNFs capable to map virtual links on the physical substrate and monitor the traffic of each client, ultimately providing the means to instantiate and orchestrate a policy-based traffic engineering service as a business application.

Cloud computing builds upon advances on virtualization and distributed computing to support cost-efficient usage of computing resources, emphasizing on resource scalability and on demand services. Moving away from traditional data-center oriented models, distributed clouds extend over a loosely coupled federated substrate, offering enhanced communication and computational services to target end-users with quality of service (QoS) requirements, as dictated by the future Internet vision. Toward facilitating the efficient realization of such networked computing environments, computing and networking resources need to be jointly treated and optimized. This requires delivery of user-driven sets of virtual resources, dynamically allocated to actual substrate resources within networked clouds, creating the need to revisit resource mapping algorithms and tailor them to a composite virtual resource mapping problem. In this paper, toward providing a unified resource allocation framework for networked clouds, we first formulate the optimal networked cloud mapping problem as a mixed integer programming (MIP) problem, indicating objectives related to cost efficiency of the resource mapping procedure, while abiding by user requests for QoS-aware virtual resources. We subsequently propose a method for the efficient mapping of resource requests onto a shared substrate interconnecting various islands of computing resources, and adopt a heuristic methodology to address the problem. The efficiency of the proposed approach is illustrated in a simulation/emulation environment, that allows for a flexible, structured, and comparative performance evaluation. We conclude by outlining a proof-of-concept realization of our proposed schema, mounted over the European future Internet test-bed FEDERICA, a resource virtualization platform augmented with network and computing facilities.

This paper presents our work toward organizing and managing various forms of federations of virtualized infrastructures. We adopt the Ponder2 policy framework and the SMC architecture as a powerful engineering approach, which we apply to semantic-aware management of federations of Future Internet (FI) virtualized infrastructures. To cater for context-awareness, we plan for a common information model, based on the Network Description Language (NDL), capturing a common set of abstractions of virtualized resources and services, nodes, routers and switches, custom network topologies with specific bandwidth demands, etc. To handle management of generic complex federated environments, we employ structural patterns to model federations as graphs, whose vertices represent SMCs and edges denote the type of relationship between them. We give an illustration of such structures corresponding to existing FI experimental platforms in the US and Europe and we provide examples containing inter-domain management responsibilities as missions. Finally, we propose to augment the Ponder2 framework with single & multi-domain resource provisioning capabilities, enabling efficient sharing of virtualized networked facilities among federation users.

The spread of active attacks has become a frequent cause of vast systems breakdown in modern communication networks. In this paper, we first present a probabilistic modeling framework for the propagation of an energy-constrained mobile threat in a wireless ad hoc network. The introduced formulation is used to identify and evaluate different attack strategies and approaches, which in turn can help in the development of efficient countermeasures for such attacks. Through modeling and simulation, we evaluate the impact of various parameters associated with the operational characteristics of the mobile attack node - such as transmission radius, mobility, energy - on an outbreak spreading and the evolution of the network. Furthermore, we introduce a new metric which indicates the overall infection-capability of each attack strategy and characterize their ability to harm the network according to this metric

Detection of distributed denial of service attacks should ideally take place near their sources, at edge networks, where countermeasures are most effective. DDoS detection by monitoring an over-provisioned backbone link either near the source or the victim is challenging because congestion isn't the identifying anomaly signature. Most research efforts try to identify a single detection metric that can reliably detect DDoS attacks. On the contrary, we use multiple metrics to successfully detect flooding attacks at the edge and classify them as incoming or outgoing attacks with an artificial neural network (ANN). We explore the DDoS detection ability of multi-layer perceptrons (MLP) as classifiers we can teach by example. The inputs of the MLP are metrics coming from different types of passive measurements that are available today to network administrators. We use these metrics to feed our MLP, train it and evaluate its performance in terms of 'false positive' and 'true positive' rates in the face of new data. Our analysis is based on data from several experiments that were conducted with the use of common DDoS tools in the production network of a university network. We show that the MLP is capable of classifying the state of the monitored edge network as 'DDoS source,' 'DDoS victim' or 'normal'. This way an edge network can use a single mechanism to protect itself from incoming DDoS attacks and at the same time protect the rest of the network from outgoing attacks.

This work introduces the use of data fusion in the field of DDoS anomaly detection. We present Dempster-Shafer Theory of Evidence (D-S), the mathematical foundation for the development of a novel DDoS detection engine. Based on a data fusion paradigm

Network traffic anomalies such as distributed denial of service attacks or the propagation of a new worm are hard to detect on noncongested ISP backbone links. The research community hasn't managed to offer reliable detection metrics that can be implemented with the current technology constraints to network administrators yet. In this work we explore and evaluate the effectiveness of several potential heuristics in detecting flooding attacks. Our observations are based on a daily network traffic analysis for a period longer than 3 months and on more than 40 experiments that were conducted with the use of common DDoS tools in the production network of an academic ISP. The data analyzed are based on different types of passive measurements that are available today to ISP's. We identify multiple effective detection metrics that could give network administrators insight to malicious activities passing through their networks.

This paper is motivated by the increasing need for scalable, distributed management architectures for integrated network, system and application management. Such integration and extension of management functionality impose heavy performance requirements, in direct conflict with the increased volume of management traffic produced. We present an attempt to minimize this traffic and overall response time, by applying the concept of "quasi-copies" (initially introduced in information retrieval technology) in the management information collection process. The proposed scheme improves overall performance of distributed management architectures by taking advantage of various consistency requirements, inherent in distributed management applications. Components are organized in a distributed hierarchy of "management information" clients (managers) and servers (agents) or dual role entities. In an attempt to identify the expected performance gains, we present a simple queuing model that provides analytical results on expected improvement of response time and reduction of management traffic.

Investigates the problem of management and control in a large and, for simplicity, homogeneous packet-switched network. Specifically the authors focus on routing, an important function of network management. The network consists of several individually controlled domains. Domains are interconnected via gateway links. Each domain is controlled by its own network control center, while the overall network performance is managed by an integrated network control center. Each center has only a portion of the information required for global routing. The authors investigate the impact of the reduced information available at each center on network performance (average delay in the present case). They present a general approach to designing a hierarchical algorithm for routing in multidomain networks. They propose a heuristic procedure suitable for packet-switched networks. Several numerical examples illustrate the impact of incomplete information on the network. Performance is compared with a lower bound obtained, which is not differentiating destinations in other domains. Therefore, for this bound, each domain is perceived as a single node in a simplified model of the network.>

The problem of management and control in a large and, for simplicity, homogeneous packet-switched network is investigated. In particular, routing is considered as an important function of network management. The network consists of several individually controlled domains interconnected via gateway links. Each domain is controlled by its own network control center, while the overall network performance is managed by the integrated network control center. Each center has only a portion of the information required for global routing. The impact of the reduced information available at each center on network performance is investigated. A general approach to designing a hierarchical algorithm for routing in multi-domain networks is presented. A heuristic procedure suitable for packet-switched networks is proposed. An example of the algorithm is shown. Its performance is compared against a lower bound to the network performance.>

The static and centralized routing of voice and data traffic in burst switched networks is addressed. It is assumed that the routing allows random bifurcation in voice and data paths and preemptive priorities for voice requirements. A study is made of routing of voice only, by using a multicommodity flow model with linearized link losses and average network loss as a minimization objective. Solving the resulting linear program, it is observed that optimal routing strategies prefer to freeze a requirement at an early stage of its path rather than those requirements that are close to their destinations. A study is made of the voice-data interaction at the link level using an available fluid-flow model, and the combined link performance is translated as a maximum flow constraint on a link. This constraint may have undesirable effects on the voice, such as introducing routes with flow absorbing loops, and unfair freezing of some requirements. All conflicting multiple objectives and constraints are included in a linear programming formulation, and it is shown how parameters can be tuned to produce desirable voice and data paths.>

An investigation is conducted of routing in packet-switched networks that consist of two individually controlled domains. Each domain controller determines a static routing plan for requirements that are contained within its domain and for requirements that are addressed to nodes in the other domain. The authors propose two routing algorithms, assuming that each controller has limited information on the configuration of the other domain. Numerical examples are provided that compare the delay performance of such algorithms with the optimal routing of a centralized scheme that has full information and control over both domains. Implications of distributed control on network design are explored.>

The authors extend earlier work (ibid., vol.36, p.834-44, Jul. 1988) in modeling video sources using interframe coding schemes and in carrying out buffer queueing analysis for the multiplexing of several such sources. The previous models and analysis were suitable for relatively uniform activity scenes. Here, models are considered for scenes with multiple activity levels which lead to sudden changes in the coder output bit rates. Such models apply to talker-listener alternating scenes, as well as to situations where there is a mix of dissimilar services, e.g., television and videotelephony. Correlated Markov models for the corresponding sources are given. A flow-equivalent queueing analysis is used to obtain common buffer queue distributions and probabilities of packet loss. The results demonstrate the efficiency of packet video on a single link, due to the smoothing effect of multiplexing several variable-bit-rate video sources.>

Models and results are presented that assess the performance of statistical multiplexing of independent video sources. Presented results indicate that the probability of buffering (or delaying) video data beyond an acceptable limit drops dramatically as the number of multiplexed sources increases beyond one. This demonstrates that statistical or asynchronous time-division multiplexing (TDM) can efficiently absorb temporal variations of the bit rate of individual sources without the significant variations in reception quality exhibited by multimode videocoders for synchronous TDM or circuit-switched transmission. Two source models are presented. The first model is an autoregressive continuous-state, discrete-time Markov process, which was used to generate source data in simulation experiments. The second model is a discrete-state, continuous-time Markov process that was used in deriving a fluid-flow queuing analysis. The presented study shows that both models generated consistent numerical results in terms of queuing performance.>

In this paper, we use a Markov model to develop a product form solution to efficiently analyze the throughput of arbitrary topology multihop packet radio networks that employ a carrier sensing multiple access (CSMA) protocol with perfect capture. We consider both exponential and nonexponential packet length distributions. Our method preserves the dependence between nodes, characteristic of CSMA, and determines the joint probability that nodes are transmitting. The product form analysis provides the basis for an automated algorithm that determines the maximum throughput in networks of size up to 100 radio nodes. Numerical examples for several networks are presented. This model has led to many theoretical and practical extensions. These include determination of conditions for product form analysis to hold, extension to other access protocols, and consideration of acknowledgments.

Recently, emphasis has been placed on integrated communication facilities capable of handling both line-switching and packet-switch-ing digital traffic. The problem of dynamically allocating the bandwidth of a trunk to both types of traffic is formulated as a Markovian decision process. Line switching is modeled as a time division multiplexing loss scheme over a varying portion of a fixed time frame. Packet-switching traffic is served through the remaining portion of the frame and requires queueing at the multiplexer-concentrator. Two different cost criteria are examined involving probability of blocking for line switching and average queueing delay for packets. The corresponding optimization problems are presented under reasonable simplifying assumptions. The movable boundary scheme suggested for commercial implementation of integrated multi-plexers is shown to offer optimal or near-optimal performance.

A scheme which multiplexes long messages and single packets using a time-varying frame is presented. Long messages, generated from a fixed number of terminals, immediately access a main trunk, sharing a dynamically dedicated subchannel in a roundrobin fashion. Fixed size packets arrive with Poisson statistics in a FIFO queue and are served through the same trunk, using the remaining capacity. The two traffic categories share an integrated variable length frame. The frame length is determined by the volume of the increasing traffic at the beginning of the frame and cannot exceed a maximum value. Analysis of the performance of the system is carried out using finite population round-robin processor sharing andM/G/Nqueueing techniques. Simplifying modeling assumptions are checked with simulation. A comparison with fixed frame schemes demonstrates the superiority of the variable frame, in terms of more efficient bandwidth utilization.