Today, there is a fundamental imbalance in cybersecurity. While attackers act more and more globally and coordinated, network defense is limited to examine local information only due to privacy concerns. To overcome this privacy barrier, we use secure multiparty computation (MPC) for the problem of aggregating network data from multiple domains. We first optimize MPC comparison operations for processing high volume data in near real-time by not enforcing protocols to run in a constant number of synchronization rounds. We then implement a complete set of basic MPC primitives in the SEPIA library. For parallel invocations, SEPIA's basic operations are between 35 and several hundred times faster than those of comparable MPC frameworks. Using these operations, we develop four protocols tailored for distributed network monitoring and security applications: the entropy, distinct count, event correlation, and top-k protocols. Extensive evaluation shows that the protocols are suitable for near real-time data aggregation. For example, our top-k protocol PPTKS accurately aggregates counts for 180,000 distributed IP addresses in only a few minutes. Finally, we use SEPIA with real traffic data from 17 customers of a backbone network to collaboratively detect, analyze, and mitigate distributed anomalies. Our work follows a path starting from theory, going to system design, performance evaluation, and ending with measurement. Along this way, it makes a first effort to bridge two very disparate worlds: MPC theory and network monitoring and security practices.

Over the past several years a lot of research has focused on distributed top-k computation. In this work we are interested in the following privacy-preserving distributed top-k problem. A set of parties hold private lists of key-value pairs and want to find and disclose the fe key-value pairs with largest aggregate values without revealing any other information. We use secure multiparty computation (MPC) techniques to solve this problem and design two MPC protocols, PPTK and PPTKS, putting emphasis on their efficiency. PPTK uses a hash table to condense a possibly large and sparse space of keys and to probabilistically estimate the aggregate values of the top-k keys. PPTKS uses multiple hash tables, i.e., sketches, to improve the estimation accuracy of PPTK. We evaluate our protocols using real traffic traces and show that they accurately and efficiently aggregate distributions of IP addresses and port numbers to find the globally most frequent IP addresses and port numbers.

Topology control in ad-hoc networks tries to lower node energy consumption by reducing transmission power and by confining interference, collisions and consequently retransmissions. Commonly low interference is claimed to be a consequence to sparseness of the resulting topology. In this paper we disprove this implication. In contrast to most of the related work claiming to solve the interference issue by graph sparseness without providing clear argumentation or proofs, we provide a concise and intuitive definition of interference. Based on this definition we show that most currently proposed topology control algorithms do not effectively constrain interference. Furthermore we propose connectivity-preserving an spanner constructions that are interference-minimal.