Expert-driven labeling of network traffic for Denial of Service (DoS) detection is error prone and prohibitively expensive in large-scale environments, such as Internet Service Provider (ISP) networks. However, supervised Machine Learning-based (ML) DoS detection approaches require high-quality and up-to-date training data sets. To ensure fast and high-quality data set creation for ML model training while facing evolving traffic patterns in the legitimate and the attack traffic, there is a need for a labeling approach without an expert in the loop. We introduce FeADable, a retrospective and fully autonomous labeling approach that leverages autoencoders to distinguish between legitimate and attack traffic based on reported feedback about occurred attacks. FeADable enables the scalable labeling of application layer DoS attacks and volumetric Distributed DoS (DDoS) attacks with near-perfect precision and false-positive feedback resilience, which ensures fast retraining of deployed detection models in response to successful attacks. We evaluate FeADable with authentic, real-world data sets that are publicly available, i.e., from the Canadian Institute for Cybersecurity, and with network traffic of a tier-1 ISP. We further outline FeADable’s compatibility with different monitoring approaches, i.e., micro-flows and traffic aggregates, to emphasize its labeling capability of DoS traffic independent of the traffic representation.

6G networks will be highly dynamic, reconfigurable, and resilient. To enable and support such features, employing AI has been suggested. Integrating AI in networks will likely require distributed AI deployments with resilient connectivity, e.g., for communication between RL agents and environment. Such approaches need to be validated in realistic network environments. In this demo, we use ContainerNet to emulate AI-capable and autonomic networks that employ the routing protocol KIRA to provide resilient connectivity and service discovery. As an example AI application, we train and infer deep RL agents learning medium access control (MAC) policies for a wireless network environment in the emulated network.

Volumetric Distributed Denial of Service (DDoS) attacks remain a persistent threat to network infrastructures. The increasing number of devices connected to the Internet, e.g., through the Internet of Things, and growing data rates make volumetric DDoS attacks easier to execute at a large scale, resulting in a high impact on the target. Drill-down DDoS Destination Detection aggregates ingress traffic in two dimensions, the source and destination IP address space, represented as a fixed-state image. A Convolutional Neural Network (CNN) identifies the attack’s target subnet using multi-class classification. Iteratively monitoring only the subnet detected by the CNN at a finer granularity leads to increasingly accurate results until the exact destination IP address is determined. The destination drill-down is evaluated on synthetic and authentic traffic, detecting an attack with 2.5% of the background traffic within 275 milliseconds.

Network infrastructures are critical and, therefore, subject to harmful attacks against their operation and the availability of their provided services. Detecting such attacks, especially in high-performance networks, is challenging considering the detection rate, reaction time, and scalability. Attack detection becomes even more demanding concerning networks of the future facing increasing data rates and flow counts. We thoroughly evaluate eMinD, an approach that scales well to high data rates and large amounts of data flows. eMinD investigates aggregated traffic data, i.e., it is not based on micro-flows and their inherent scalability problems. We evaluate eMinD with real-world traffic data, compare it to related work, and show that eMinD outperforms micro-flow-based approaches regarding the reaction time, scalability, and the detection performance. We reduce required state space by 99.97%. The average reaction time is reduced by 90%, while the detection performance is even increased, although highly aggregating arriving traffic. We further show the importance of micro-flow-overarching traffic features, e.g., IP address and port distributions, for detecting distributed network attacks, i.e., DDoS attacks and port scans.

Increasingly flexible and dynamic network infrastructures, due to softwarization, virtualization and increasing mobility (5G and 6G networks), challenge network management. To cope with the increasing dynamics and complexity, recent research focuses on autonomic network management solutions that do not require human intervention. However, autonomic network management solutions often require up-to-date topological information during network bootstrapping or to quickly react to dynamic events. Therefore, a fast, efficient, and scalable link-layer topology discovery, providing autonomic network management solutions with topological information in highly dynamic and large-scale networks, is required. This paper introduces KeLLy an efficient, scalable link layer topology discovery algorithm for large-scale networks (evaluated with up to 100 000 nodes). KeLLy is fast, discovering large topologies within a few seconds, guarantees discovery of all nodes and all links while inducing low, predictable overhead by querying only a subset (generally below 4 percent) of nodes. It achieves these properties regardless of the type of underlying topology.

Attacks on critical infrastructure networks can have severe impact on the physical realm, which makes fast and reliable attack detection a primary security goal. To enhance the security of networked control systems, we introduce a novel approach to detect model-based stealth attacks on industrial real-time protocols. Specifically, we outline how stealth attacks can be detected through passive network monitoring using several supervised and unsupervised machine learning techniques. Our approach leverages computationally inexpensive, well-known detectors (e.g., Support Vector Machines and Local Outlier Factor) and operates in a protocol-agnostic manner that does not require protocol parsing. We evaluate detection capabilities by injecting attack traffic into PROFINET real-time traffic obtained from two different real-world networks. Our results indicate that stealth attacks can be reliably detected within tens of milliseconds.

Industrial networking is of increasing importance, for example, for emerging smart factory and smart grid environments. Low latency and real-time requirements together with high end-to-end reliability requirements pose unique challenges. Within this paper, we present TRUST, which provides layer 4 packet redundancy for UDP streams in order to improve end-to-end reliability without affecting latency or usability for real-time applications. The novel packet identification and deduplication technique of TRUST aims to avoid susceptibility to attacks, without requiring extensive cryptography capabilities or shared secrets among devices. We implemented TRUST as a Linux Kernel module and evaluated its memory usage and delay impact.

QUIC aims to become a general-purpose transport protocol, and numerous implementations of the QUIC protocol already exist. Earlier evaluations often examined QUIC in conjunction with HTTP/3.0 or focused on latency metrics. The measurement studies in this paper focus on actual QUIC implementations with respect to their ability to achieve high sustained throughput in network scenarios with data rates of 10 Gbit/s. We compare six popular QUIC implementations developed in different programming languages with TCP. Our findings show significant performance improvements in several QUIC implementations compared to prior evaluations. However, it is not a homogeneous picture, as current QUIC implementations often behave quite differently. We observed that in environments with low RTTs or an increased number of packet losses, most of the surveyed QUIC implementations struggle unexpectedly and cannot compete with TCP regarding sustained throughput performance.

Network infrastructures are becoming increasingly flexible and dynamic not only due to softwarization and virtualization, but also due to increasing mobility in 5G and 6G networks, which consider drones and satellites to be part of the core infrastructure. Since the network topology may change frequently, it becomes challenging to get an up-to-date view of its current state. This paper introduces KeLLy, an efficient, scalable link layer topology discovery algorithm focussing on large-scale networks (evaluated up to 100,000 nodes). KeLLy discovers various large topologies in seconds, guarantees discovery of all nodes (and a high percentage of links), while inducing low, predictable overhead by querying only a subset (4%) of nodes.

Increasing dynamics and an ever growing number of devices make current and future mobile network infrastructures more and more complex. Managing such networks thus becomes progressively challenging. Introducing more autonomic behavior in network management becomes indispensable to not only handle the growing complexity, but also to make these infrastructures more resilient as they constitute a critical component of overall public infrastructures. Autonomic control planes provide a fundamental set of resilient, autonomic infrastructure services (e.g., connectivity) for higher-level autonomic behavior to build upon. In this demo we show how a first real-world implementation of the routing architecture KIRA provides zero-touch control plane connectivity to enable an autonomic 5G network infrastructure. The demonstrator allows an in-depth view of each step in the process of bootstrapping a 5G infrastructure as well as of KIRA's resilience when challenged by failures and dynamics. Based on this autonomic connectivity solution we present our vision of more dynamic and resilient autonomic control networks toward the future design of 6G core networks.

Volumetric Distributed Denial of Service attacks forcefully disrupt the availability of online services by congesting network links with arbitrary high-volume traffic. This brute force approach has collateral impact on the upstream network infrastructure, making early attack traffic removal a key objective. To reduce infrastructure load and maintain service availability, we introduce ReCEIF, a topology-independent mitigation strategy for early, rule-based ingress filtering leveraging deep reinforcement learning. ReCEIF utilizes hierarchical heavy hitters to monitor traffic distribution and detect subnets that are sending high-volume traffic. Deep reinforcement learning subsequently serves to refine hierarchical heavy hitters into effective filter rules that can be propagated upstream to discard traffic originating from attacking systems. Evaluating all filter rules requires only a single clock cycle when utilizing fast ternary content-addressable memory, which is commonly available in software defined networks. To outline the effectiveness of our approach, we conduct a comparative evaluation to reinforcement learning-based router throttling.

Fast detection of Distributed Denial of Service attacks is key for establishing appropriate countermeasures in order to protect potential targets. HollywooDDoS applies well-known techniques from movie classification to the challenge of DDoS detection. The proposed approach utilizes a traffic aggregation scheme representing traffic volumes between IP subnets as two-dimensional images, while preserving detection relevant traffic characteristics. These images serve as input for a convolutional neural network, learning IP address space distributions of both background and attack traffic intensities. It is shown that a real-world DDoS attack can be precisely detected on the time scale of milliseconds. We evaluate classification of images without temporal information about attack traffic development to outline the impact of image resolution and aggregation time frames. We then show that attack detection further improves by 17% when utilizing a consecutive series of images capturing traffic dynamics.

Networked cyber-physical systems are driven by control loops that commonly depend on tight communication timing guarantees, requiring both complex and inflexible scheduling mechanisms to provide the necessary amount of determinism. We previously presented the fundamental idea of Cooperative Congestion Control (CoCC), which enables elastic control applications to share a common network cooperatively. By balancing the resource demands of control applications, it achieves fairness w.r.t. to the quality of control and efficiently avoids congestion and thus harmful delays and losses without the need for complex scheduling mechanisms. We propose lightweight and effective solutions that enable CoCC to deal with multiple bottlenecks and double its convergence speed. Our evaluation results show that high utilization, low delay, fairness, and fast convergence can be achieved by CoCC even in complex multi-bottleneck scenarios with a high number of flows.

Power synchronicity and limited line capacities will become critical challenges in future power systems. In order to tackle them, we advance the energy packet grid (EP grid), which is an alternative energy grid paradigm, inspired by selected design principles of the Internet. The EP grid breaks up the grid into self-organizing, decentralized EP cells wherein EP devices exchange energy packets. Power synchronicity is independently solved within EP cells, leading to a higher robustness of the overall EP grid. We focus on the interplay between the energy plane and the communication plane, i.e., how power electronics and the ability to exchange messages enable an EP grid. In this context, we introduce SEPT, an EP transfer protocol that allows two neighboring EP devices to exchange energy packets. SEPT takes care of the interplay between the energy plane and the communication plane, adding a new interdisciplinary perspective to the field.

This paper deals with synchronized multicast reception while considering Service Function Chaining (SFC), i.e., all data packets sent towards a multicast group are first processed by the required service functions and then received by the group members at approximately the same time. This is an important requirement for several distributed applications, e.g., emergency push-to-talk services like TETRA or DMR. The presented TopoSync-SFC approach exploits recent advancements in the fields of Software-defined Networking (SDN) and Network Function Virtualization (NFV) to address synchronization directly inside the network, i.e., no dedicated support for synchronization is required by the applications. It is based on the idea of application-specific SFC-embedding multicast distribution trees that exploit paths of different length in the topology to reduce the variance in packet reception times. We present the architecture for TopoSync-SFC and an ILP-based problem formulation that respects synchronization requirements. The evaluation of a push-to-talk use-case shows that TopoSync-SFC is a significant improvement with respect to synchronized reception over approaches that do not consider synchronization.

This work is concerned with our ongoing research project CoCPN: Cooperative Cyber Physical Networking that has the goal to allow cooperation between control applications and the communication system that constitute cyber-physical systems. We describe the envisioned architecture of CoCPN and outline how it improves the flexibility of cyber-physical systems by cooperatively sharing a common network infrastructure. We also present our simulation tool CoCPN-Sim that we developed as a method to thoroughly investigate the interaction between control applications and the communication system. By providing the results of selected simulations using the well-known inverted pendulum, we identify potential aspects that can be exploited for cooperation and hence serve as starting points towards more flexible and adaptive cyber-physical systems.

A frequent problem of Internet services are Sybil attacks, i.e., malicious users create numerous fake identities for themselves. To avoid this, many services employ obstacles like Captchas to force (potentially malicious) users to invest human attention in creating new identities for the service. However, this only makes it more difficult but not impossible to create fake identities. Sybil attacks are especially encountered as a problem in decentralized systems since no single trust anchor is available to judge new users as honest or malicious. The avoidance of a single centralized trust-anchor, however, is desirable in many cases. As a consequence, various decentralized Sybil detection approaches have been proposed. The most promising ones are based on leveraging the trust relationships embedded within social graphs. While most of these approaches are focusing on detecting large existing groups of Sybil identities, our approach Detasyr instead restricts the creation of numerous Sybil identities. For that, tickets are distributed through the social graph and have to be collected, allowing for decentralized and privacy preserving authorization. Additionally, it offers a proof of authorization to users that are considered to be honest, allowing them to display their authorization towards others.

Link capacities increase at an enormous pace, with 100 Gbit/s becoming standard in data centers, campus networks, and the Internet. These ever increasing data rates are challenging since end-system performance (esp. CPU performance) cannot keep up with the growth rates.Still, the TCP protocol and today's hardware are capable of transferring 100 Gbit/s with a single sender/receiver pair. However, extensive tuning is necessary down to manual interrupt configuration and corresponding CPU core pinning for the applications. A major issue is packet loss within the receiving end-system that cannot be prevented by TCP's flow control. This, in turn, affects TCP's default congestion control that interprets the losses as congestion signal. In this paper we show how to tune end-systems that are driven at their performance limits, what data rates are feasible, where the limitations are, and discuss the impact on and by TCP's congestion control.

This paper presents GCMI, a novel API for generic control message interception that can be used to programmatically access control messages exchanged between controllers and switches in a software-defined network. The approach allows it to program GCMI apps that register for specific control messages, e.g., all monitoring replies or flow table modification requests for a certain subnet. If such a control message is sent, it is redirected to the GCMI app where it may (or may not) be altered prior to forwarding to the original destination. This intermediate processing is widely used in the SDN domain, e.g., for transparent optimizations, verification or debugging purposes. In practice, however, the same interception functionality is re-implemented over and over again because there currently is no generic solution to access control messages. In this paper, we show that there is a strong demand for GCMI, present a proxy-based OpenFlow prototype and demonstrate the features and benefits of our approach by re-implementing different use cases that rely on control message interception.

Hierarchical Heavy Hitters (HHHs) identify frequent items in streaming data. Finding these items has several applications to network monitoring, particularly in distributed denial-of-service (DDoS) mitigation and anomaly detection. Several algorithms are available to compute HHHs, each with different performance characteristics in terms of resource consumption, speed and accuracy. These characteristics determine which HHH algorithm may be best suited for a given network situation (e.g., because it offers sufficient accuracy for fine-grained traffic analysis). However, since the situation can evolve over time, the best choice for an HHH algorithm may also change. Simply replacing a chosen HHH algorithm has the drawback of losing all previously acquired monitoring information. This paper introduces the novel concept of HHH-transitions that transfer monitoring information between HHH variants and consequently allows it to adopt new performance characteristics by switching algorithms at runtime. For example, this enables a DDoS mitigation system to adapt to evolving network situations and therefore increase overall Return-on-Mitigation. We present explicit transition rules for common one-dimensional HHH variants and evaluate our approach based on real traffic from MAWILab. Results indicate that trade-offs between performance characteristics can be realized at runtime and that it is possible to increase overall post-transition accuracy by retaining monitoring information.

Simultaneously achieving high throughput, a low and bounded queuing delay, and providing fairness among competing flows is very challenging for end-to-end congestion controls. Table 1 shows the properties of a reasonable selection of wellknown and recently proposed congestion controls. Except from TCP LoLa [1], none of them achieve all three goals at once.

Modern distributed analytics stacks consist of application frameworks that enable processing of large amounts of data, and a resource manager that allows applications to share computational resources. The initial use case for these systems was running batch jobs with long lifetimes (e.g., a few hours), but, since their inception, new use cases have emerged where users increasingly use them to gain insight interactively, or even online. Efficiently sharing resources under these additional use cases, requires operating at smaller timescales (minutes or even seconds) than the existing systems were designed for and are capable of.In this paper, we present Mira, a system for optimized elastic execution of short-running and interactive data-analytics applications with low-latency execution startup, fast resource management and efficient resource utilization on shared clusters. We analyze the resource sharing overheads in a commonly used distributed processing stack (Spark+YARN) and reveal opportunities to accelerate applications in shared environments. Our experiments show, that Mira is able to reduce resource sharing related overheads by more than 400× and reduce application runtime by up to 4.2×.

Software-Defined Networking (SDN) allows fine granular control by applications running in the network control plane, facilitating the management, orchestration, and deployment of network services. However, the diversity of application, protocols, and switches makes the task of developing applications for such networks very complex. Besides, such heterogeneity makes it harder to support the manifold requirements that may arise from different control plane applications and to verify if the underlying infrastructure satisfies the requirements from these applications. In this paper, we propose a two-phase solution for this problem, extending the Model-Driven Networking (MDN) framework for: i) enabling it to model infrastructure capabilities, so that we can verify if these capabilities could satisfy applications requirements; and ii) applying a flow delegation technique to leverage the set of network capabilities in order to support applications requirements. Our experiments demonstrate that our flow delegation mechanism not only improves the network compatibility but also achieves better bandwidth usage and jitter ratios ^22% lower when considering QoS requirements.

BBR is a recently proposed congestion control. Instead of using packet loss as congestion signal, like many currently used congestion controls, it uses an estimate of the available bottleneck link bandwidth to determine its sending rate. BBR tries to provide high link utilization while avoiding to create queues in bottleneck buffers. The original publication of BBR shows that it can deliver superior performance compared to Cubic TCP in some environments. This paper provides an independent and extensive experimental evaluation of BBR at higher speeds. The experimental setup uses BBR's Linux kernel 4.9 implementation and typical data rates of 10Gbit/s and 1 Gbit/s at the bottleneck link. The experiments vary the flows' round-trip times, the number of flows, and buffer sizes at the bottleneck. The evaluation considers throughput, queuing delay, packet loss, and fairness. On the one hand, the intended behavior of BBR could be observed with our experiments. On the other hand, some severe inherent issues such as increased queuing delays, unfairness, and massive packet loss were also detected. The paper provides an in-depth discussion of BBR's behavior in different experiment setups.

TCP LoLa is a new delay-based congestion control that supports both, low queuing delay and high network utilization in high speed wide-area networks. This is particularly useful for traffic mixes consisting of bandwidth demanding and delay sensitive flows (e.g., long file transfer and interactive "web 2.0" traffic). TCP LoLa keeps the queuing delay at the bottleneck link low around a fixed target threshold value. This target value is independent from the number of flows sharing the bottleneck. TCP LoLa achieves high link utilization and attains convergence to fairness even among flows with different round-trip times, due to its novel mechanism called "fair flow balancing".

Interactive and delay-sensitive applications constitute an important and growing part of the Internet. Today, low delays can only be achieved if there are no congested links along the path. At a bottleneck, the commonly used congestion control mechanisms induce high queuing delay and packet loss. Specialized congestion control mechanisms achieving a low queuing delay in an otherwise congested network exist. However, if their flows share a bottleneck with traditionally congestion controlled flows, they get suppressed or loose their low-delay property. This paper presents three approaches - Separate Paths, Separate Queues and Limited Queue - that enable coexistence of congestion control mechanisms that are optimized for different goals, e.g., interactive applications and bulk transfers. The measurement results show that concurrent operation of different congestion control mechanisms can be successfully implemented this way.

Abstract The upcoming IEEE 802.11s standard enables easy establishment and maintenance of wireless mesh networks in residential and enterprise scenarios. They, however, need special attention with respect to security. Due to multi‐hop communication and routing on layer 2 in mesh networks, attacks on the routing, selective forwarding, and eavesdropping on confidential data become relatively easy. To avoid such attacks, we introducedifferentiated securitywhich is based on protection levels associated with nodes in the network. Participation in the MAC layer routing is facilitated according to the respective protection level of a node. Using additional cryptographic protection our approach can also avoid unintentional disclosure of confidential data. Copyright © 2009 John Wiley & Sons, Ltd.

The current Internet architecture nicely structures functionality into layers of protocols. While this reduces complexity, many tweaks have emerged because of the architecture's limited flexibility. Cross Layer Functionality corrodes the layer boundaries, intermediate layers had to be introduced for protocols like MPLS and IPsec, and middleboxes - like in case of NAT - further complicate the interaction of protocols. To overcome these problems, many publications have proposed modular solutions or protocol composition, allowing software engineering ideas to improve protocol design. Other publications state that instead of choosing a single common network architecture for the Future Internet, it might be advantageous to run multiple different architectures in parallel. We combine both approaches and make it possible to rapidly create and run different network architectures in parallel. While this allows for simplified Future Internet development, it requires the network architecture to be dynamically chosen. This paper not only presents a node architecture enabling the parallel operation of different network architectures but also introduces algorithms for their selection at runtime.

We will demonstrate a wireless sensor network system for the surveillance of critical areas and properties -- e.g. borders. The system consists of up to 10 sensor nodes that monitor a small border area. The protocols we show focus on detecting trespassers across a predefined area and reporting the detection to a gateway node securely. There, the trespasser's path will be graphically diplayed on a border map. The demonstration features secure protocols for the detection of trespassers, node failure and network partitioning, along with a duty cycle protocol to ensure network longevity. All information pertaining to relevant events in the network or border area will be graphically displayed on a gateway computer.

Energy efficiency is a common requirement for most WSN applications. We present our approach utilizing precise distributed monitoring of energy consumption to support the development of energy efficient protocols. There-fore we designed dedicated energy monitoring and management hardware for a wireless sensor network testbed. In our demonstration we show distributed energy measurement in a typical sensor network application based on an area monitoring scenario.

Todaypsilas Internet has a growing number of protocols and mechanisms to protect data in transmission. One can choose from IP Security (IPsec), Transport Layer Security (TLS), and many other protocols. However, available security protocols and mechanisms are not widely used due to usability issues [1], [2] and because users often underestimate the risk their data is exposed to. An approach to solve this problem consists of automated selection and configuration of available security protocols in a user-transparent way. In this paper, we present a method for automatically choosing the right security protocol based on Security, Quality of Service, and Energy Consumption aspects. We describe the necessary aspects, value functions, and a hierarchical, flexible, and efficient decision process.

In-network data aggregation allows energy-efficient communication within a sensor network. However, such data aggregation introduces new security challenges. As sensor nodes are prone to node-compromise, a fraction of nodes might act maliciously and forge aggregated data. For arbitrary aggregation functions, the verification of authenticity of aggregated data, i.e., its correctness, integrity, and origin, is impossible. Thus, one can either aggregate data and save energy or verify authenticity, not both. We present "ESAWN", a protocol that probabilistically relaxes authenticity in the presence of a fraction of compromised nodes. This enables a trade-off between probabilistic authenticity and probabilistic, energy-saving data aggregation. Besides theoretical analysis, we present MICA2-based simulation results. They indicate that even for high probabilities of authenticity and fraction of compromised nodes, ESAWN is more energy-efficient compared to (100%-)secure but non-aggregating communication. For example, with a fraction of 20% compromised nodes and 90% authenticity, ESAWN saves up to 40% energy.

In various sensor network scenarios, data of low entropy is measured and transported towards a data-sink. For example, sensor networks monitor temperature, air pressure, or humidity. As periodic sensor measurements rarely change over time, a receiver can often predict them. Therefore, energy-expensive periodic radio transmission of the measurement can often be omitted. Instead, the node taking and sending a measurement S and the node receiving the measurement R agree on a model. This work states that model updates for data prediction in wireless sensor networks must take the reliability of underlying communication as well as computational overhead into account.

The deployment and use of IPsec has consistently increased in recent years. IPsec is a protocol that allows, besides other things, secure branch offices connectivity and secure VPN access for road warriors. The limitations of IPsec are much better understood today, and efforts to improve IPsec are still underway. One aspect of improvement is the integration of IPsec with other functions and protocols of the network. Quality of Service (QoS) is one example. QoS is used to prioritize demanding traffic like Voice over IP, network control messages, and traffic for other mission-critical systems. QoS can be used to mitigate risks of DoS attacks, ill-behaving hosts, and other attacks by separating traffic classes and treating packets according to the respective class. In order to facilitate all the advantages QoS can offer, an IPsec implementation must not only be superficially changed, but needs thorough modifications or, even better, should be designed with QoS support as an objective. The current IPsec standard does hardly offer any guidance to do this. In this paper, we detail our QoS-capable IPsec and compare it with a widely-used regular IPsec implementation. Furthermore, we show that these QoS extensions prove to be valuable, even in difficult scenarios, e.g. using host CPUs for packet processing.

Key establishment is a fundamental prerequisite for secure communication in wireless sensor networks. A new node joining the network needs to efficiently and autonomously set up secret keys with his communication partners without the use of a central infrastructure. Most cited current research papers focus on a probabilistic distribution of sets of keys from larger key pools to new nodes. This results in unnecessary expensive communication and memory consumption, growing linearly with the size of the network, and guarantees secure connections only with a certain probability. This work presents a novel approach for efficient and secure key establishment of nodes joining the network by utilizing the fact that communication in sensor networks follows a paradigm called aggregation. Keys are split into shares and forwarded using disjoint paths in the network. The approach is self-organizing and minimizes memory consumption as well as radio transmissions efficiently -- down to logarithmic behavior.

Mobile communication systems increasingly adopt Internet Protocol solutions for transport of control and data traffic. To optimize scalability of the mobile communication infrastructure and to save mobile energy resources, mobile devices can set their network interface to power save mode, such as for instance supported by the IEEE 802.11 technology, and refrain from sending superfluous location information towards the network in case the device is idle. Such systems utilize paging to locate and reactivate mobile devices in power save mode. In this paper, we show how mobile terminal power saving efficiently complements IP paging in an IEEE 802.11-enabled network. By means of simulations, we evaluate and compare a mobile terminal's power consumption due to mobility management within a Mobile IPv6 network with and without paging and power save mode support. The results show that IP paging with complementary power save mode support harmonizes efficient location tracking with optimized energy resource usage, while taking requirements on routing delay constraints into account.

In times of network convergence and increasingly challenging customer demands, automated tools can help operating next generation networks more efficiently. Since operators have different ideas and requirements about the strategies they use for network operation and maintenance, automated solutions need to be very flexible. This paper presents a concept that allows for an easy and flexible configuration of the operational strategy carried out by a traffic and performance management node

In the recent years, several routing protocol for mobile ad hoc networks (MANETs) have been developed. The performance of these protocols in a special scenario highly depends on the selection of "good" parameter values, e.g. update intervals. In MANETs, there does not exist any administrator or any infrastructure which could parameterize the routing protocols and static predefined parameters might not be suitable for the current scenario. So the mobile nodes have to self-parameterize. This paper presents a novel approach which enables mobile nodes to do a mobility-adaptive self-parameterization of their routing protocol. To measure the mobility in the MANET, we developed the MANET relative velocity indicator (MARVIN). Based on the continuously measurement of MARVIN the parameters of the routing protocol are adapted to the current scenario

Efficient support for multimedia communication is essential for next generation mobile wireless networks. In order to provide the necessary quality-of-service (QoS) in mobile wireless networks, appropriate signaling has to be defined. Our QoS signaling architecture integrates resource management with mobility management. It is based on a domain resource manager concept and nicely supports different handover types. In particular, our approach supports anticipated handover with pre-reservation of resources before the mobile node is attached to the new access point. The article discusses the protocol design and implementation, in particular integration with mobile IP, and shows the benefit of anticipated handover by measurement results.

This paper presents the on-demand overlay multicast protocol (ODOMP), a novel approach for multicast data distribution in mobile ad hoc networks. ODOMP is a reactive protocol which creates an overlay among the group members on-demand. The created overlay is a source rooted tree which connects the group members via IP-in-IP tunnels. Routing is done by an arbitrary underlying unicast routing protocol. A novel creation mechanism allows ODOMP to create an efficient overlay with low communication overhead. The performance of ODOMP is compared with the performance of the well known multicast routing protocol ODMRP by means of simulations.

Interactive networked multimedia applications are sensitive to delay and jitter affecting the transmission of their data packets. Without the support of quality of service, the nature of the Internet makes it difficult to deliver data streams in the demanded constant and steady way these applications need for an acceptable performance. Because of this limitation, value-added services like the "virtual wire"-per-domain behavior (VW-PDB) impose the obligation of traffic conditioning mechanisms in the transmission path to assure a continuous data stream to an end user. However, each traffic conditioning action is a potential source for additional delays experienced by the processed data packets. In this paper we will show that the configuration suggested by the VW-PDB for traffic conditioners in a last hop router can quickly lead to unwanted significant additional delays. Although applications will then be served with a constant data stream with minimal jitter, the traffic conditioning might exceed their delay limitations. Since modern multimedia applications normally use their own playback buffers for jitter compensation, they do not depend on a complete jitter-free transmission, like the VW-PDB tries to establish by emulating a dedicated switched-circuit. Hence, two suggestions with more flexible reliable traffic conditioning mechanisms in the last-hop-router will be presented. Both approaches will be compared to the strict rules prescribed by the VW-PDB in terms of jitter compensation and additional delay.

The differentiated services (DiffServ) approach is intended to provide quality of service (QoS) in IP-based networks. This is a very important issue not only in wire-line fixed networks but also in IP-based wireless mobile networks. Currently, services within the DiffServ approach including premium service, assured service and best-effort service are intended for fixed networks. We have proposed the mobile differentiated services QoS model [J. Diederich, et al., 2003] to enhance the above services so they are better suited for wireless mobile networks. One part of this QoS model is the so-called best-effort low-delay (BELD) service, which has the same low-delay and low-jitter characteristic as premium service, but a certain probability for packet loss. This service is especially suited for delay-sensitive and loss-tolerant applications and can take favor of unused premium service resources to increase the network utilization. This paper presents details on the BELD service including initial simulation results showing the feasibility of BELD service.

Today, learners on the move are typically disconnected from their learning environment and from other learning partners. With the advances in mobile communication, we envision distributed and mobile learners to be seamlessly connected to learning sessions and learning content. Connection should be supported in an ad-hoc fashion, if applicable, and during mobility. Mobile learners are usually equipped with mobile devices, such as laptops or handheld computers (PDAs). This has to be considered for the development of collaborative applications. Furthermore, an integration of existing collaborative frameworks in to interactive workspaces is investigated. This requires the development of new learning scenarios that provide support for such integration.

AMnet is a framework for flexible and rapid service creation and provides primarily heterogeneous user-tailored group communication services, AMnet is based on Active and Programmable Networking technologies and uses active nodes (AMnodes) located within the network to execute so-called service modules for the provision of individual group communication services. It is, however not limited to group communication since it provides a rather generic framework. The AMnode design is shaped for the efficient execution of flexible loadable service modules, including dedicated hardware support.

Today we are faced with an increasing variety of networks and end systems. The resulting heterogeneous environment imposes new challenges on communication support for multimedia and collaborative applications. AMnet is an approach that provides multipoint communication support for large-scale groups with heterogeneous receivers. Active network nodes are used to deliver data streams with user-tailored QoS. They provide so-called QoS filters that remove information from continuous media streams in order to reduce data rate for low-end receivers without affecting high-end receivers. A prototype implementation of AMnet based on RSVP Filer is presented.

Future networking environments are expected to be hybrid, i.e., consisting of both wireless and fixed subnetworks. Due to the presence of the wireless link, the performance of end-to-end protocols (e.g., TCP) suffers degradation. One approach to overcome this performance penalty is to subdivide the end-to-end transport layer connection into two separate ones. This approach leads to performance improvements without loss of interoperability with existing networking structures. The focus of this paper is on error recovery mechanisms suitable for the transport protocol operating over the wireless subpath. These mechanisms have to address the increased bit error probability and temporary disruptions of wireless links. The efficiency of different error correction mechanisms within wireless scenarios is investigated and possible modifications that lead to higher performance are pointed out. Mobile communications are discussed in particular.

Networks for factory automation, often named fieldbuses, have been developed to fulfill real time requirements. However, they can only cover geographical areas such as factory halls or buildings. The paper describes a model for internetworking fieldbuses via ATM networks. A remote bridge is used to span longer distances between fieldbus components in a separated fieldbus. Furthermore, a multiport bridge connecting several independent fieldbuses is investigated. The emphasis is laid on the investigation of quality of service requirements the transport channel provided by the ATM network has to meet. By means of the wide spread fieldbus PROFIBUS the implications for real time applications and the system behavior are considered.

The high performance transparent bridge (HPTB) is a multiport bridge interconnecting gigabit networks. The provision of specialized hardware support coupled with proper partitioning of bridging protocol entities makes it possible to process frames at very high rates. The HPTB architecture allows concurrent bridging of asynchronous, synchronous and isochronous traffic among heterogeneous networks. It supports both traditional networks, such as variable packet size local area networks (LANs), and cell-based net works, such as distributed queue dual bus (DQDB) and metropolitan area networks (MANs). This device is capable of interconnecting any combination of high speed LANs of rates up to 800 Mbps and/or MANs of rates up to 622 Mbps.>

A framework containing a number of resources, languages, and tools for generating customized protocols that support diverse multimedia applications running on high-performance networks is described. The framework facilitates the configuration of application-tailored, function-based communication protocols that are automatically synthesized from high-level specifications.

The proliferation of local area networks (LANs) and the emergence of high-bandwidth public networks will create an environment in which it will become increasingly simple and attractive to communicate among different organizations across a common public networking infrastructure. The open bridging scheme proposed, which employs inherent features of forthcoming cell-based metropolitan area networks (MANs) in order to achieve efficient interenterprise communications is introduced. It uses enhanced remote LAN bridging techniques to ensure router-level functionality with bridge-level simplicity and performance. The practicality of open bridging is shown by describing how it can be incorporated in networks using current standard protocol stacks, such as open systems interconnnection (OSI) and transmission control protocol/internet protocol (TCP/IP).>

A function-based communication model that allows applications to request individually tailored services from the communication subsystem is presented. Based on service requirements and available resources, suitable protocol machines are configured to serve the application. This configuration is done using a proper combination of functional modules. The concept of layering is therefore abandoned for both flexibility and efficiency reasons.>

An analysis of potential parallelism in TCP/IP is presented for two purposes. First, it is used as a basis for an implementation on a multiprocessing platform. Second, it reveals the areas where protocol modifications and/or tuning would yield more efficient implementations on multiprocessors. The focus is on the analysis, and detailed dependence graphs among the atomic TCP/IP protocol functions are presented. No specific implementation design is shown, since this highly depends on the particular hardware chosen.>

Interconnections of remote local area networks (LANs) across public networks are of growing interest. The paper presents an OSI gateway to interconnect LANs across ISDN. The OSI connectionless network protocol (CLNP) supports interconnection of different subnetworks. The most important component of the gateway is an adaption layer to integrate ISDN into the gateway structure. The main task of this adaption layer is mapping the service provided by the connection oriented ISDN subnetwork to the service expected by CLNP and vice versa. It is designed to fulfil requirements on fairness, low costs, and acceptable performance. The gateway components are implemented on a multiprocessor platform built with transputers.>

High performance communication systems have to provide very high data rates of more than 100 Mbit/s to new applications such as multimedia applications. To overcome the bottleneck in communication systems, the protocol processing of the layers above media access control layer, light weight protocols such as XTP (Xpress Transfer Protocol) are used. XTP is a protocol with functionality of layers three and four and was designed for protocol processing in reliable high speed networks such as FDDI, XTP is based on parallel finite state machines (FSMs) to support an efficient realization in VLSI. This paper presents a software implementation of XTP for a multiprocessor system. The implementation is based on these FSMs, which are mapped onto processes running on the processors of a multiprocessor architecture and communicating with each other by message passing.>

The use of parallelism for protocol processing in a parallel architecture of an internetworking unit is presented. This architecture consists of pipelines and arrays of processors and supports multiple memory concepts (local and global memory). A high-performance parallel implementation of the internetworking protocol in a gateway is discussed, and selected performance results are presented. The results show that requirements of high-speed networks with throughputs of more than 100 Mb/s can be fulfilled with the proposed parallel architecture and implementation.>

A multiprocessor architecture suitable for the implementation of high-speed gateways is presented. It is based on a horizontal and vertical subdivision of communication systems. The resulting architecture consists of several receive and send pipelines, where every receive and send pipeline is associated with one subnetwork connected to the gateway. The pipeline stages are implemented on several processors which are combined into a processor unit. The internal structure of each processor unit is adapted to the protocol functions that are to be implemented on it. The architecture comprises pipeline structures and array structures and thus permits temporal parallelism as well as spatial parallelism.>