We mine the logs of network traffic data to find the contexts of attacks; we call them attack patterns. We propose an iterative algorithm for discovering attack patterns via a feedback mechanism, with the degrees of belief for attack instances propagated to the next iteration to further refine the search. Our simulations verify that the algorithm achieves accuracy in discovering attack patterns. Our attack pattern discovery has the additional advantage of being an unsupervised algorithm, e.g., it does not require a priori user-defined thresholds.

We introduce a statistical technique of inferring the position of RFID tags by means of computation on multiple data streams from distributed RFID receivers. Using a single statistical model that describes the detection rate between tags and receivers, we are able to perform Bayesian inference on the positions of the observed tags. If permitted by the receivers, our method can optimally coordinate the signal strength of multiple receivers to improve the time response of our positional inference system.

In a peer-to-peer overlay network, the phenomenon of multiple overlay links sharing bottleneck physical links leads to correlation of overlay link capacities. We are able to more accurately model the overlay by incorporating these linear capacity constraints (LCCs). We formulate the problem of maximizing bandwidth in overlay multicast using our LCC model. We show that finding a maximum bandwidth multicast tree in an overlay network with LCC is NP-complete. Therefore, an efficient heuristics algorithm is designed to solve the problem. Extensive simulations show that our algorithm is able to construct multicast trees that are optimal or extremely close to optimal, with significantly higher bandwidth than trees formed in overlays with no LCC. Furthermore, we develop a fully distributed algorithm for obtaining near-optimal multicast trees, by means of gossip-based algorithms and a restricted but inherently distributed class of LCC (node-based LCC). We demonstrate that the distributed algorithm converges quickly to the centralized optimal and is highly scalable.

In this paper, we revisit the problem of multicast tree construction in overlay peer-to-peer networks. We present an iterative online multicast tree construction algorithm for multi-session multicasting of elastic content. Our framework allows receivers to request multiple sessions from possibly different servers. Each receiver expresses a quality-of-service requirement using a utility function. We propose an online algorithm which constructs multicast trees to maximize the overall receiver utility functions in an iterative fashion, allowing it to adapt to changes in network topology and cross-traffic.

Overlay networks are virtual networks residing overthe IP network, consequently, overlay links may share hiddenl ower-level bottlenecks. Previous work have assumed an independent overlay model: a graph with independent link capacities.We introduce a model of overlays which incorporates correlated link capacities and linear capacity constraints (LCC) to formulate hidden shared bottlenecks; we refer to these as LCC-overlays. We define metrics to qualitatively measure overlay quality in terms of its accuracy (in representing the true network topology) and efficiency (i.e., performance). Through analysis and simulations,we show that LCC-overlay is perfectly accurate and hence enjoys much higher efficiency than the inaccurate independent overlay. We discover that even a highly restricted LCC class — node basedLCC— yields near-optimal accuracy and significantly higher efficiency. We study two network flow problems in the context of LCC-graphs: Widest-Path and Maximum-Flow. Weprove that Widest-Path with LCC is NP-complete. We formulate Maximum-Flow with LCC as a linear program, and propose an efficient distributed algorithm to solve it. Based on the LCCmodel, we further study the problem of optimizing delay while still maintaining optimal or near-optimal bandwidth. We also outline a distributed algorithm to efficiently construct an overlay with node-based LCC.

We study the problem of indexing continuous data streams in which data are heterogeneous in structure. Such data streams arise naturally in many real-life scenarios such as sensor networks. Our index structure uses bitmap based techniques to efficiently sketch the structures to allow space-efficient lossless archiving of the data stream. It also allows very fast query processing on the archived data stream. Furthermore, our index structure adapts to structural evolutions of the stream to ensure good indexing and querying performance both in space and time. We developed a cost-based optimization framework so the indexing engine adjusts its configuration at run-time to adapt to changes in the data stream. By means of linear feedback controllers, structural clustering and steepest gradient ascent optimization, our indexing engine can achieve excellent performance without any human intervention.

We model the overlay using linear capacity constraints, which accurately and succinctly capture overlay link correlations. We show that finding a maximum-bandwidth multicast tree in an overlay with LCC is NP-complete and propose an efficient distributed heuristics algorithm.

In this paper, we consider the problem of data dissemination from a source to multiple receivers over application-layer overlay networks, and seek to significantly improve end-to-end throughput of data dissemination sessions by constructing topologies of high quality. We propose oEvolve, a distributed algorithm that uses the strategy of progressively and adaptively evolving the overlay topology over time toward high-quality topologies, especially with respect to end-to-end throughput of data dissemination. To validate the effectiveness and efficiency of oEvolve, we present a fully distributed real-world oEvolve implementation over PlanetLab , a global-scale wide-area overlay network testbed. Our implementation consists of a framework of components that involves a high-performance data forwarding engine and a centralized performance monitoring facility.

All of the advantages of application-layer overlay networks arise from two fundamental properties: 1) the network nodes in an overlay network, as opposed to lower-layer network elements such as routers and switches, are end systems and have capabilities far beyond basic operations of storing and forwarding; 2) the overlay topology, residing above a densely connected Internet protocol-layer wide-area network, can be constructed and manipulated to suit one's purposes. We seek to improve end-to-end throughput significantly in application-layer multicast by taking full advantage of these unique characteristics. This objective is achieved with two novel insights. First, we depart from the conventional view that overlay nodes can only replicate and forward data. Rather, as end systems, these overlay nodes also have the full capability of encoding and decoding data at the message level using efficient linear codes. Second, we depart from traditional wisdom that the multicast topology from source to receivers needs to be a tree, and propose a novel and distributed algorithm to construct a two-redundant multicast graph (a directed acyclic graph) as the multicast topology, on which network coding is applied. We design our algorithm such that the costs of link stress and stretch are explicitly considered as constraints and minimized. We extensively evaluate our algorithm by provable analytical and experimental results, which show that the introduction of two-redundant multicast graph and network coding may indeed bring significant benefits, essentially doubling the end-to-end throughput in most cases.