Economic transactions in distributed systems are typically atomic operations that exchange resources between two parties. However, these types of transactions are not well-suited for environments where numerous entities contribute to a valuable outcome, such as the Internet of Things or content creation in Web 3.0. In this work, we propose a novel transaction concept called a “value tree” that can involve multiple parties arranged hierarchically. Value trees use smart contracts to enable asynchronous execution, allowing payments to be temporally de-coupled from the underlying resources exchange while providing basic assurances. We describe how we have implemented value trees using smart contracts on the Ethereum blockchain. We demonstrated the use of value trees in the context of named data networking, where all contributors to a successful data delivery are rewarded asynchronously.

Multi-set membership queries are fundamental operations in data science. In this paper, we propose a new data structure for multi-set membership queries, named coloring embedder, which is fast, accurate, and memory efficient. The idea of coloring embedder is to first map elements to a high-dimensional space, which nearly eliminates hashing collisions, and then use a dimensional reduction representation, similar to coloring a graph, to save memory. Theoretical proofs and experimental results show that the coloring embedder is effective in solving the problem of multi-set membership queries. We also find that web cache sharing is one of the typical application scenarios of the multi-set membership queries and current methods based on Bloom filters always send redundant queries. We apply coloring embedder to web cache sharing by arranging our data structure on the on-chip and off-chip memory and designing query, insertion and deletion operations for this scenario. The experimental results show that compared with the present method, our method can reduce the queries sent by proxies while reaching equal hit rate with the same size of on-chip memory. The source code of coloring embedder has been released on Github.

The ability of a network node to verify where traffic is coming from and what path that traffic traversed is important for developing secure network protocols and defense mechanisms against attacks. Cryptographic approaches to source authentication and path validation can have significant computational requirements and thus may not be well-suited for high-performance networks. In prior work, we have described Orthogonal Sequence Verification, which uses orthogonal capabilities based on inner product computations, which can be easily realized by basic bitwise operations in a processor. In this paper, we present the results from a prototype implementation of this technique, which shows that the proposed approach is feasible for implementation in practical networks.

The dynamic nature of software-defined networking requires frequent updates to the flow table in the data plane of switches. Therefore, the ternary content-addressable memory (TCAM) used in switches to match packet header fields against forwarding rules needs to support high rates of updates. Existing off-the-shelf switches update rules in batches for efficiency, but may suffer from forwarding inconsistencies during the batch update. In this paper, we design and evaluate a TCAM update optimization framework that can guarantee consistent forwarding during the entire update process while making use of a layered TCAM structure. Our approach is based on a modified-entry-first write-back strategy that significantly reduces the overhead from movements of TCAM entries. In addition, our approach detects reordering cases, which are handled using efficient solutions. Based on our evaluation results, we can reduce the cost of TCAM updates by 30%-88% compared to state-of-the-art techniques.

In this paper we consider an alternative possibility for routing money in the Internet ecosystem based on a spot market for interconnection service that operates alongside, or in addition to, the traditional contract service model. Recent work by others showed that under certain assumptions, enabling transit providers (i.e., networks that carry packets between networks) to sell their excess capacity on a best-effort basis improves both provider profit and consumer surplus. While prior work only focused on pricing strategies, we explore the technical feasibility of such a market in this paper. We consider what is needed to make such a spot market possible and focus on the interaction between technical and economic considerations. In particular, we describe two approaches that demonstrate how economic software defined exchanges (ESDXs) can be used as trusted intermediaries to tie the forwarding service to the flow of money.

The Internet of Things (IoT) represents the technical foundation to solve some of the most important societal and environmental problems. One of the key challenges in IoT systems is providing security for distributed, networked IoT components that are implemented with potentially very low-end embedded processing systems. As the value of sensor data and actuator access increases in IoT deployments, attackers may increasingly target these vulnerable systems and protocol implementations running on them. For protocols that involve economic transactions on blockchains, as we show in our work, there is a direct monetary value associated with successful attacks. To address this problem, we present a hardware monitoring system that augments processors with logic that tracks the correct execution of software on the embedded systems. Attacks on the system, such as buffer overflow attacks, are recognized and stopped by the hardware monitor. Therefore, the system can avoid economic loss due to an attack and ensure that the protocol implementation is secured. We show the effectiveness of our system on a prototype that uses Linux running on a soft-core LEON3 processor on an Intel Stratix IV FPGA and interacts with the Ethereum blockchain.

Software-defined networking (SDN) provides flexible network control, which has enabled new, more complex network control mechanisms. These approaches impose high demands on flow updates in OpenFlow switches. Existing SDN controllers and firmware have been optimized for high-speed network updates, but specific switch implementations differ in their behavior. Previous optimization schemes for updates ignore the diversity of instruction types and switch behavior. In this paper, we present RuleTailor, an efficient, measurement-based optimization framework for SDN flow updates, to overcome these limitations. In contrast to other measurement-based optimization frameworks, RuleTailor uses new techniques, such as instruction type transformation, pseudo deletion, and match field distance, which can work in both the control plane and the data plane. Our evaluation shows that RuleTailor achieves a performance of fewer than 12 milliseconds per update in a content-addressable flow table with 1k entries, outperforming the state-of-the-art measurement-based framework, Tango, by a factor of 10.

Determining the shortest-path distance between vertices in the weighted graph is an important problem for a broad range of fields, such as context-aware search and route selection. While many efficient methods for querying shortest-path distance have been proposed, they are poorly suited for parallel architectures, such as multi-core CPUs or computer clusters, due to the strong task dependencies. In this paper, we propose ParaPLL, a new parallelism-friendly framework for fast shortest-path distance query on large-scale weighted graphs. ParaPLL exploits intra-node and inter-node parallelism by using shared memory and message passing paradigms respectively. We also design task assignment and synchronization policies, which allow ParaPLL to reach remarkable speedups compared to state-of-the-art solutions. Moreover, we also prove the correctness of ParaPLL. To the best of our knowledge, ParaPLL is the first parallel framework that utilizing pruned landmark labeling to accelerate shortest-path distance queries on large-scale weighted graphs. Our evaluation results show that ParaPLL is 9.46 times faster than the corresponding serial version on a weighted 0.3M-vertex graph using a 12-core computer. ParaPLL on a 6-node computer cluster can also achieve a speedup of up to 5.6 over the single-node implementation.

Neighbor discovery is a critical first step in establishing communication in a wireless ad-hoc network. Existing quorum-based neighbor discovery algorithms only consider a pair of nodes and ensure that this pair can communicate at least once in a bounded interval. However, when the node density of a wireless network increases, collisions are more likely to happen, which makes these quorum-based algorithms inefficient in practice. We propose a novel self-adapting quorum-based neighbor discovery algorithm that can dynamically adjust its cycle pattern to decrease the impact of such collisions. We first assess the collision problem in wireless networks when using quorum-based neighbor discovery algorithms and then establish a theoretical framework to analyze the discovery delay when considering collision effects. Guided by these theoretical results, we design a self-adapting mechanism for cycle patterns in quorum-based algorithms. Simulation results show that our algorithm can achieve complete neighbor discovery in less time than existing quorum-based neighbor discovery algorithms.

Internet-connected embedded systems have limited capabilities to defend themselves against remote hacking attacks. The potential effects of such attacks, however, can have a significant impact in the context of the Internet of Things, industrial control systems, smart health systems, etc. Embedded systems cannot effectively utilize existing software-based protection mechanisms due to limited processing capabilities and energy resources. We propose a novel hardware-based monitoring technique that can detect if the embedded operating system or any running application deviates from the originally programmed behavior due to an attack. We present an FPGA-based prototype implementation that shows the effectiveness of such a security approach.

Monopolies in access networks present challenging problems for network users: providers have no economic incentives to improve service quality or reduce cost. Virtualization of the access infrastructure can enable competition between providers without the need for deploying different physical access networks. For example, municipal broadband networks are owned by local governments and can be sliced to host multiple service providers. In this work, we evaluate the economic incentives in virtualized access networks and compare them to current access networks with limited (or no) provider competition. We also consider fine-grained competition among transit providers to reflect emerging ideas on offering network connectivity and services dynamically through marketplaces. We use an agent-based simulator in a research testbed to obtain results on quality and cost trends as well as on the ability of providers to thrive in the marketplace. Our findings show that having a shared infrastructure and multiple Internet providers is beneficial for subscribers while maintaining a sustainable ecosystem. Moreover, because the risk associated with deploying infrastructure is shared, Internet providers have more incentive to innovate. Thus, our results highlight the importance of virtualizing access networks to leverage economic drivers in this environment.

Connection setup in software-defined networks (SDN) requires considerable amounts of processing, communication, and memory resources. Attackers can target SDN controllers with simple attacks to cause denial of service. We proposed a defense mechanism based on a proof-of-work protocol. The key characteristics of this protocol, namely its one-way operation, its requirement for freshness in proofs of work, its adjustable difficulty, its ability to work with multiple network providers, and its use of existing TCP/IP header fields, ensure that this approach can be used in practice.

Verifying the authenticity of the source of network traffic and the path that this traffic has traversed is an important building block for secure network protocols and defense mechanisms. We investigate these problems of in-network source authentication and path validation. Existing approaches are either unable to satisfy security requirements or need significant computational resources due to cryptographic operations, thus limiting their suitability in practice where potentially every packet needs to be checked at line rate. We present Orthogonal Sequence Verification (OSV), a lightweight and scalable technique to address this problem. OSV uses orthogonal capabilities to enable source authentication and path verification simultaneously. The verification of these orthogonal capabilities is based on inner product computations, which can be easily realized by basic bitwise operations in a processor. Therefore, OSV significantly reduces computational cost, while achieving the necessary security properties. We present evaluation results which show that OSV is three orders of magnitude faster than the current approaches based on cryptographic operations. Therefore, we believe that our work presents an important contribution toward realizing high-performance, secure network protocols and network attack defenses in practice.

Internet Exchange Points (IXPs) play a major role in the current Internet architecture, serving as the connection point between Internet Service Providers (ISPs). Software-Defined Exchange Points (SDXs)-programmable versions of Internet Exchange Points (IXPs)-have been proposed as a way to give ISPs finer-grained control over the way packets are routed between ISPs. Leveraging software-defined networking (SDN) technology, an SDX enables control software to insert forwarding rules that route traffic on the granularity of individual flows. In this paper, we describe work-in-progress developing controllers for Software-Defined Internet Exchange Points that facilitate dynamic establishment of forwarding relationships between transit ISPs. The core hypothesis of our work is that the SDX can serve as a trusted intermediary, both facilitating establishment of dynamic peering agreements between ISPs, and enforcing their routing policies. Moreover, this building block, which we dub the Coin-Operated SDX, can be used to construct much more dynamic and fine-grained end-to-end routing services than are possible in today's infrastructure. In our model, each ISP independently but cooperatively defines the policies that the SDX enforces on its behalf. The SDX may also serve as a clearinghouse for the inter-ISP economic transactions that drive these policies, i.e., as Economic SDX (ESDX). We describe the overall architecture of a Coin-Op SDX, as well as the specific operations it must support to offer dynamic services. We believe that Coin-Op SDX can play a critical role in future software-defined inter-domain Internet infrastructure.

Connection setup in software-defined networks (SDN) requires considerable amounts of processing, communication, and memory resources. Attackers can target SDN controllers with simple attacks to cause denial of service. We proposed a defense mechanism based on a proof-of-work protocol. The key characteristics of this protocol, namely its one-way operation, its requirement for freshness in proofs of work, its adjustable difficulty, its ability to work with multiple network providers, and its use of existing TCP/IP header fields, ensure that this approach can be used in practice. We present a prototype implementation and performance results that show the effectiveness of this approach to protecting SDN controllers.

Shortest-path queries on weighted graphs are an essential operation in computer networks. The performance of such algorithms has become a critical challenge in emerging software-defined networks (SDN), since SDN controllers need to perform a shortest-path query for every flow. Unlike classic solutions (e.g., Dijkstra's algorithm), high-performance shortest-path query algorithms include two stages: preprocessing and query answering. Despite the improved query answering time, existing two-stage algorithms are still extremely time-consuming in preprocessing large-scale graphs. In this paper, we propose an efficient shortest-path query algorithm, called BBQ, which reduces the running time of both stages via tree decomposition. BBQ constructs a distance oracle in a bottom-top-bottom manner, which significantly reduces preprocessing time over existing algorithms. In addition, BBQ can answer batch queries in bulk by traversing the decomposed tree instead of executing separate queries. Our experimental results show that BBQ outperforms state-of-the-art approaches by orders of magnitude for the running time of the preprocessing stage. Meanwhile, BBQ also offers remarkable acceleration for answering batches of queries. As a result, SDN controllers that use BBQ can sustain 1.1-27.9 times higher connection request rates.

The importance of the Internet for society is increasing. To ensure a functional Internet, its routers need to operate correctly. However, the need for router flexibility has led to the use of software-programmable network processors in routers, which exposes these systems to data plane attacks. Recently, hardware monitors have been introduced into network processors to verify the expected behavior of processor cores at run time. If instruction-level execution deviates from the expected sequence, an attack is identified, triggering processor core recovery efforts. In this manuscript, we describe a scalable network processor monitoring system that supports the reallocation of hardware monitors to processor cores in response to workload changes. The scalability of our monitoring architecture is demonstrated using theoretical models, simulation, and router system-level experiments implemented on an FPGAbased hardware platform. For a system with four processor cores and six monitors, the monitors result in a 6 percent logic and 38 percent memory bit overhead versus the processor's core logic and instruction storage. No slowdown of system throughput due to monitoring is reported.

Network security systems inspect packet payloads for signatures of attacks. These systems use regular expression matching at their core. Many techniques for implementing regular expression matching at line rate have been proposed. Solutions differ in the type of automaton used (i.e., deterministic versus non-deterministic) and in the configuration of implementation-specific parameters. While each solution has been shown to perform well on specific rule sets and traffic patterns, there has been no systematic comparison across a large set of solutions, rule sets and traffic patterns. Thus, it is extremely challenging for a practitioner to make an informed decision within the plethora of existing algorithmic and architectural proposals. Moreover, as multi-core processors are becoming popular, many parameters need to be tuned to maximize the multi-core potential. To address this problem, we present a comprehensive evaluation of a broad set of regular expression matching techniques. We consider both algorithmic and architectural aspects. Specifically, we explore the performance, area requirements, and power consumption of implementations targeting multi-core processors and FPGAs using rule sets of practical size and complexity. We present detailed performance results and specific guidelines for determining optimal configurations based on a simple evaluation of the rule set. These guidelines can help significantly when implementing regular expression matching systems in practice.

SDN-enabled networks offer a great degree of flexibility, programmability and support for multiple applications. Applications running on top of a SDN controller could further benefit if network state information were made available to them as part of the SDN framework. Our work investigates the requirements for abstracting network state on the control plane. We intend to show that, by meeting these pre-requisites, network state can be made available with the guarantee of state safety and integrity. We envision that our state management abstraction will provide safety in the data plane and aid better programmability in the control plane.

Embedded systems require low overhead security approaches to ensure that they are protected from attacks. In this paper, we propose a hardware-based approach to secure the operation of an embedded processor instruction-by-instruction, where deviations from expected program behavior are detected within the execution of an instruction. These security-enabled embedded processors provide effective defenses against common attacks, such as stack smashing. Previous work in this area has focused on monitoring a single task on a CPU while here we present a novel hardware monitoring system that can monitor multiple active tasks in an operating-system-based platform. The hardware monitor is able to track context switches that occur in the operating system and ensure that monitoring is performed continuously, thus ensuring system security. We present the design of our system and results obtained from a prototype implementation of the system on an Altera DE4 FPGA board. We demonstrate in hardware that applications can be monitored at the instruction level without execution slowdown and stack smashing attacks can be defeated using our system.

Deployment of innovative new networking services requires support by network providers. Since economic motivation plays an important role for network providers, it is critical that a network architecture intrinsically considers economic relationships. We present the design of a protocol that associates access to network services with economic contracts. We show how this protocol can be realized in fundamentally different ways, using out-of-band signaling and in-band signaling, based on two different prototype implementations. We present results that show the effectiveness of the proposed protocol and thus demonstrate a first step toward realizing an economy plane for the Internet.

Pricing of network services is a key aspect of Internet operation. Most current providers offer end-users only simple and coarse pricing choices. With technological developments for fine-grained service control and automation of dynamic contracts, it can be expected that users and applications can choose among available network service choices at fast timescales. A key question in the context of these economic dynamics is how provider competition and user choices affect price and quality of network services. In this paper, we develop an agent-based simulation system to assess these impacts on economic dynamics. We simulate a monopoly, a duopoly, and an oligopoly, where providers compete and innovate. We derive expected results for simple competition, but also observe that innovation improves a provider's competitiveness in the marketplace. Our results not only show general trends, but provide quantitative results that can help providers to explore and develop pricing strategies to maximize their profits while providing end-users with the choices they need.

Typical routing algorithms use a single criterion, such as hop count or link weight, to calculate paths. As the requirement of flexible routing arises, there are circumstances where multiple criteria are needed for routing. Though there are proposed solutions to the multi-criteria optimal path selection problem for quality-of-service routing, they usually combine all criteria into a single path optimization metric a priori. However, this approach is not feasible in scenarios where the path consumers' weightings of criteria is not known at compute time. Such circumstances require finding all the Pareto-optimal paths, i.e., all the paths that are not dominated by other paths. In this paper, we present the algorithmic foundations for efficiently computing Pareto-optimal paths. We present ParetoBFS, a variant of a breadth-first search that uses branch-and-bound techniques to find all the Pareto-optimal paths while effectively limiting the potentially very large search space. We present several sampling techniques to further increase the speed of the search while degrading the quality of the results only marginally. Our simulation results show that existing multi-criteria combinatorial optimization approaches can only search a small fraction of all the Pareto-optimal paths while ParetoBFS can obtain the whole path set in shorter time. We also present results from an implementation of ParetoBFS on a software-defined network prototype.

Neighbor discovery is a crucial first step in configuring and managing a wireless network. Most existing studies on neighbor discovery are based on broadcast algorithms, where nodes send 1-way messages without getting response from their neighbors. However, when directional antennas are used, the ability to coordinate with a neighbor is crucial for later communication between nodes, which requires handshake-based (at least 2-way) protocols. In this paper, we provide a detailed analysis of neighbor discovery protocols with 2-way communication when using directional antennas. Based on this analysis, we present the design of a randomized 2-way neighbor discovery algorithm that uses a selective feedback. Our result shows that a node needs Θ(n2/k) time to discover its n neighbors with k antenna sectors, which yields a significant performance improvement over pure randomized algorithms. We also extend our schemes to practical cases, where the number of neighbors is unknown, and show a factor of no more than 4/3 slowdown in performance.

As the Internet becomes integrated into nearly all aspects of everyday life, its reliability grows in importance. This vital communication resource, which has become an inviting target for attackers, must be protected with the same vigor as the end-systems it interconnects. Recent trends in network router architecture towards programmability and flexibility have increased the susceptibility of communication hardware to software attacks which modify intended data processing and forwarding functions. Contemporary routers typically feature network processors, whose protocol processing functions are determined via software. Prior work has shown that these general-purpose software-based processing systems can be attacked with data packets sent through the Internet. As a defense mechanism, the correct functionality of a network processor can be verified by a hardware monitor that observes processor operation and compares it to expected behavior. In the event of an attack, the monitor can interrupt the network processor, suppress malicious behavior, and reset the processor to a usable state for processing of subsequent traffic. In this work, we present several significant advances in hardware monitoring for network processors. A low-overhead monitor architecture that evaluates correct network processor operation in real-time on an instruction-by-instruction basis is described and tested. The monitor is shown to effectively prevent stack smashing attacks on processors that use a Harvard architecture, a widely used network processor configuration. Through experimentation, we show that our approach to hardware monitoring does not affect data plane packet throughput. In the event of an attack, malicious packets are dropped while packets of regular network traffic proceed through the network unaffected. A full evaluation of monitor architectural parameters is provided to create an optimized monitor design.

New attacks are emerging that target the Internet infrastructure. Modern routers use programmable network processors that may be exploited by merely sending suitably crafted data packets into a network. Hardware monitors that are co-located with processor cores can detect attacks that change processor behavior with high probability. In this paper, we present a solution to the problem of secure, dynamic installation of hardware monitoring graphs on these devices. We also address the problem of how to overcome the homogeneity of a network with many identical devices, where a successful attack, albeit possible only with small probability, may have devastating effects.

Network architectures for the future Internet envision a variety of novel network services for transmitting, processing, and storaging of data. These network services may involve costly resources that need to be allocated by a service provider. Thus, an important problem is to limit access to authorized users (e.g., Those who have paid for a particular network service). In addition, these resources need to be protected from denial-of-service attacks or attempts to circumvent this access control. Most existing authentication approaches are based on cryptographic techniques. However, the high computational cost of cryptographic operations makes these techniques unsuitable for the data plane of the network, where potentially every packet needs to be checked at Gigabit per second link rates. In this paper, we describe a novel design for data plane capabilities, called OrthCredential, that solves this problem. The main idea is to use a set of orthogonal sequences as credentials that can be verified easily to protect the data plane against various attacks. These orthogonal sequences can be constructed by a Hadamard transform. Our evaluation of a prototype implementation shows that 64-bit credentials only require less than 300 processor cycles for verification, much less than existing access control schemes such as HMAC. And it provides reasonable security properties (e.g., Less than 10 -- 8 probability of successful attack).

Network services, ranging from simple network paths to complex packet processing and content storage, are envisioned as a core aspect of the future Internet. One key challenge is to limit access to these services to traffic that is authorized to use them. In this work, we describe a novel design for data plane capabilities that can provide efficient access control at high-data rates.

Network security systems inspect packet payloads for signatures of attacks. These systems use regular expression matching at their core. Many techniques for implementing regular expression matching at line rate have been proposed. Solutions differ in the type of automaton used (i.e., deterministic vs. non-deterministic) and in the configuration of implementation-specific parameters. While each solution has been shown to perform well on specific rule sets and traffic patterns, there has been no systematic comparison across a large set of solutions, rule sets and traffic patterns. Thus, it is extremely challenging for a practitioner to make an informed decision within the plethora of existing algorithmic and architectural proposals. To address this problem, we present a comprehensive evaluation of a broad set of regular expression matching techniques. We consider both algorithmic and architectural aspects. Specifically, we explore the performance, area requirements, and power consumption of implementations targeting processors and field programmable gate arrays using rule sets of practical size and complexity. We present detailed performance results and specific guidelines for determining optimal configurations based on a simple evaluation of the rule set. These guidelines can help significantly when implementing regular expression matching systems in practice.

The Internet represents an essential communication infrastructure that needs to be protected from malicious attacks. Modern network routers are typically implemented using embedded multi-core network processors that are inherently vulnerable to attack. Hardware monitor subsystems, which can verify the behavior of a router's packet processing system at runtime, can be used to identify and respond to an ever-changing range of attacks. While hardware monitors have primarily been described in the context of general-purpose computing, our work focuses on two important aspects that are relevant to the embedded networking domain: We present the design and prototype implementation of a high-performance monitor that can track each processor instruction with low memory overhead. Additionally, our monitor is capable of defending against attacks on processors with a Harvard architecture, the dominant contemporary network processor organization. We demonstrate that our monitor architecture provides no network slowdown in the absence of an attack and provides the capability to drop attack packets without otherwise affecting regular network traffic when an attack occurs.

Modern routers use high-performance multi-core packet processing systems to implement protocol operations and to forward traffic. As the diversity of protocols and the number of processor cores increases, it becomes increasingly difficult to manage these systems and ensure their correct operation at runtime. In particular, it is challenging to identify situations in which a part of processor cores behave incorrectly, either due to failure or due to malicious attacks. To address this problem, we present a novel approach to verifying correct operation of a packet processor by analyzing packet latency and throughput. This approach can treat the network processor as a “black box” and does not need to observe internal functionality. We show that processing time statistics are affected by system misbehavior and present an analytic model to quantify these effects. Our results show that the presented technique is an effective approach to provide an extra level of protection to packet processor systems.

New Internet architectures have been proposed to address some of the shortcomings of the current Internet. Many new architectures represent existing and novel networking functionality as network "services". These services are fundamental building blocks that need to be described and can be composed in an effective manner. Any service-based network architecture fundamentally struggles to assign specific physical resources to a service when a user requests for a service. This "instantiation" problem of mapping an advertised service to a reservable physical entity becomes complex when advanced services comprise of multiple basic services. In our work, we present a resolution to the service instantiation problem that can identify multiple potential solutions. Since candidate solutions may use multiple metrics to express quality, our approach takes into account multiple criteria and yields results that are fewer in number but more optimal than others in nature. We show that this approach can be used to to make an efficiently tradeoff between time taken and the number of solutions obtained without having to explore the complete solution space. Thus, our approach presents a practical heuristic for instantiating network services in the future Internet.

Large-scale wireless mesh networks, like the ones used as cellular back-haul, operate under circumstances, where individual links are affected by weather conditions. Reliability requirements in wireless mesh networks necessitate the ability to reconfigure the network in the face of changing environmental conditions. In this paper, we present a predictive routing protocol for wireless mesh networks, which operate at millimeter-wave bands with directional links, that uses in-network parameter prediction to make the network adaptive, as opposed to using meteorological weather information from external sources, such as weather radars. We validate our approach through simulations based on real-world weather events, observed through a network of weather radars, and comparisons with approaches that do not make use of predictions but may use the link quality as a parameter in routing decision making. Our results show that our link quality-based predictive approach can achieve throughput performance that is almost 8% better than a link quality-based routing algorithm that does not use prediction for the real weather scenario we use for our simulations.

We were able to put together an excellent technical program for ICNP 2013, thanks to the joint efforts by our authors, TPC members, and technical area leads. We received 251 submissions to the main conference this year, the highest number in ICNP's 21-year history. Each paper received at least three reviews, and the 66 technical program committee members produced 765 paper reviews. The 11 area chairs ensured review quality and consistency between reviewers. The final papers for the main conference were selected during a TPC meeting in July. To accommodate for the larger number of submissions, we decided to shorten paper presentations slightly. Overall, 46 papers were accepted for presentation at the conference, which corresponds to an acceptance rate of 18.3%.

Capabilities-based networks present a fundamental shift in the security design of network architectures. Instead of permitting the transmission of packets from any source to any destination, routers deny forwarding by default. For a successful transmission, packets need to positively identify themselves and their permissions to the router. A major challenge for a high-performance implementation of such a network is an efficient design of the credentials that are carried in the packet and the verification procedure on the router. We present a capabilities system that uses packet credentials based on Bloom filters. The credentials are of fixed length (independent of the number of routers that are traversed by the packet) and can be verified by routers with a few simple operations. This high-performance design of capabilities makes it feasible that traffic is verified on every router in the network, and most attack traffic can be contained within a single hop. We present an analysis of our design and a practical protocol implementation that can effectively limit unauthorized traffic with only a small per-packet overhead.

The system architecture of a network system is of fundamental importance to the performance of computer networks. However, evaluating different architectural and algorithmic choices of network systems is usually difficult. This poster presents NetSysSim, a network system simulator implemented in SystemC. NetSysSim provides a hierarchical framework of different levels of abstraction. With SystemC's modular and timing based simulation, researchers can simulate any part of the system with the desired level of details. Our design of NetSysSim allows for performance evaluation of data plane architectures, including different queuing, scheduling or transmission schemes.

The next-generation Internet promises to provide a fundamental shift in the underlying architecture to support dynamic deployment of network protocols. With the introduction of programmability and dynamic protocol deployment in routers, potential vulnerabilities and attacks are expected to increase. In this paper, we consider the problem of detecting packet forwarding misbehavior in routers. Specifically, we focus on an attack scenario, where a router selectively drops packets destined for another node. Detecting such an attack is challenging since it requires differentiating malicious packet drops from congestion-based packet losses. We propose a controller-based misbehavior detection technique that effectively detects malicious routers using a hash-based delay sampling and verification. We provide a performance analysis of the detection accuracy and quantify the performance overhead of our system. Our results show that our technique provides accurate detection with low sampling rates.

Reducing the power consumption of network interfaces contributes to lowering the overall power needs of the compute and communication infrastructure. Most modern Ethernet interfaces can operate at one of several data rates. In this paper, we present Queue Length Based Rate Adaptation (QLBRA), which can dynamically adapt the link rate for Ethernet interfaces at runtime using existing Ethernet standards. An implementation of the proposed rate adaptation functionality is demonstrated at runtime on a NetFPGA platform. Our results show that the rate adaptation approach can achieve significant energy savings and at the same time improve the throughput of TCP traffic due to the effect of packet pacing.

Network virtualization is a core technology in next-generation networks to overcome the ossification problem that is observed in the current Internet. The key idea of network virtualization is to split physical network resources into multiple logical networks, each supporting different network services and functionalities. One of the key challenges for virtual network infrastructure providers is to efficiently allocate network resources based on virtual network requests, which is referred to as the virtual network mapping problem. While several algorithms have been proposed previously to solve this mapping problem, their effectiveness is limited since virtual requests specify the internal topology of the virtual network. In this paper, we argue that such internal topologies lead to unnecessary constraints and less efficient solutions. Instead, we propose an alternate formulation of the problem that represents virtual network requests as traffic matrices. We provide a solutions to solving this traffic-matrix-based mapping problem using a mixed integer programming formulation. Our simulation results show that our approach can map significantly more virtual network requests on a physical network infrastructure than previous mapping algorithms and thus improves the efficient use of networking resources in virtual networks.

The network architecture of the current Internet cannot accommodate the deployment of novel network-layer protocols. To address this fundamental problem, network virtualization has been proposed, where a single physical infrastructure is shared among different virtual network slices. A key operational problem in network virtualization is the need to allocate physical node and link resources to virtual network requests. While several different virtual network mapping algorithms have been proposed in literature, it is difficult to compare their performance due to differences in the evaluation methods used. In this paper, we proposed VNMBench, a virtual network mapping benchmark that provides a set of standardized inputs and evaluation metrics. Using this benchmark, different algorithms can be evaluated and compared objectively. We present such an evaluation using three existing virtual network mapping algorithms. We compare the evaluation results of our synthetic benchmark with those of actual Emulab requests to show that VNMBench is sufficiently realistic. We believe this work provides an important foundation to quantitatively evaluating the performance of a critical component in the operation of virtual networks.

There has been a great interest in defining a new network architecture that can meet the needs of a future Internet. One of the main challenges in this context is how to realize the many different technical solutions that have developed in recent years in a single coherent architecture. In addition, it is necessary to consider how to ensure economic viability of architecture solutions. In this work, we discuss how to design a network architecture where choices at different layers of the protocol stack are explicitly exposed to users. This approach ensures that innovative technical solutions can be used and rewarded, which is essential to encourage wide deployment of this architecture.

Security issues in computer networks have focused on attacks on end systems and the control plane. An entirely new class of emerging network attacks aims at the data plane of the network. Data plane forwarding in network routers has traditionally been implemented with custom-logic hardware, but recent router designs increasingly use software-programmable network processors for packet forwarding. These general-purpose processing devices exhibit software vulnerabilities and are susceptible to attacks. We demonstrate-to our knowledge the first-practical attack that exploits a vulnerability in packet processing software to launch a devastating denial-of-service attack from within the network infrastructure. This attack uses only a single attack packet to consume the full link bandwidth of the router's outgoing link. We also present a hardware-based defense mechanism that can detect situations where malicious packets try to change the operation of the network processor. Using a hardware monitor, our NetFPGA-based prototype system checks every instruction executed by the network processor and can detect deviations from correct processing within four clock cycles. A recovery system can restore the network processor to a safe state within six cycles. This high-speed detection and recovery system can ensure that network processors can be protected effectively and efficiently from this new class of attacks.

Computer networks require increasingly complex packet processing functions in the data plane to adapt to new requirements. To meet performance demands, packet processing systems on routers employ multiple processor cores. To efficiently utilize processing resources in such systems, we propose a novel methodology for allocating tasks to processors. The main idea is to obtain runtime profiling information and to duplicate tasks with heavy processing requirements. Using our duplication algorithm, a balanced workload can be obtained and the complexity of packing tasks with different processing requirements can be reduced. By translating traffic characteristics into processing requirements, the system is able to adapt to dynamic changes in the workload and balance the utilization of all processing resources to maximize system throughput. Our approach can adapt to any traffic change in a single iteration, whereas existing adaptive approaches may require multiple steps. Results from our prototype implementation based on the Click modular router show that our system only requires on average 5.3-31.5 percent of the adaptation steps that are necessary in iterative systems. In addition, our system achieves a throughput that is 1.32 times higher than the throughput achieved with symmetric multiprocessing support with general-purpose task allocation.

Programmable packet processors have replaced traditional fixed-function custom logic in the data path of routers. This programmability introduces new vulnerabilities in these systems that can lead to new types of network attacks. We propose a modular packet processor monitoring technique that can help in detecting and avoiding such attacks. Using information about the processing time distribution of individual modules, input/output traffic characteristics can be inferred and abnormal behavior can be detected.

Virtualized networks provide a shared infrastructure platform for hosting multiple independent networks with different protocol stacks. The infrastructure and the virtual networks are operated by different entities who may not trust each other. In our work, we address one of the arising security issues by providing data confidentiality for forwarding network traffic. We propose an encrypted representation of IP addresses and forwarding data structures that hides the operations of the virtual network from the infrastructure provider. We describe the cryptographic computations and data structures that forwards network traffic and discuss their space requirements.

Network virtualization allows multiple logical networks to coexist on the same physical infrastructure. A key problem that needs to be solved in this context is management of substrate network resources, in particular when mapping virtual network requests to the substrate. Several efficient algorithms have been proposed to provide effective solutions, but they assume that the virtual network request topology is given. In this paper, we show that the use of these topology-based requests may limit the efficiency of physical network usage. As an alternative, we propose a problem formulation and mapping algorithm that is based on traffic matrices to specify virtual network requests.

Optical packet switching networks promise to provide high-speed data communication and serve as the foundation of the future Internet. A key technological problem is the very small size of packet buffers that can be implemented in the optical domain. Existing protocols, for example the transmission control protocol, do not perform well in such small-buffer networks. To address this problem, we have proposed techniques for actively pacing traffic to ensure that traffic bursts are reduced or eliminated and thus do not cause packet losses in routers with small buffers. In this paper, we present the design and prototype of a hardware implementation of a packet pacing system based on the NetFPGA system. Our results show that traffic pacing can be implemented with few hardware resources and without reducing system throughput. Therefore, we believe traffic pacing can be deployed widely to improve the operation of current and future networks.

As the demand on the Internet bandwidth keeps increasing, all-optical network architectures emerge as a promising solution to high-speed telecommunication networks. However, the performance of optical routers/switches is sensitive to the statistics of Internet traffic due to their limited buffer size, which weakens the optical routers' capability of absorbing Internet traffic surges (known as burstiness), resulting in a high packet drop rate and, hence, lowering the quality of service. As a natural solution to the Internet traffic burstiness, pacing has long been studied and a variety of pacing techniques have been proposed in the literature. Nevertheless, the effect of pacing has not been conclusive. In this paper, we aim to answer the following questions: (1) in what situation pacing is beneficial, (2) does pacing harm short-lived flows, (3) does pacing affect the established fairness? We adopt in our simulation a newly proposed queue length-based pacing technique as a cure to the burstiness. The experimental results show that with appropriate parameter settings, pacing (1) significantly improves the performance of a moderately loaded small-buffer network, (2) brings little negative impact on short-lived flows in a nearly drop-free environment, and (3) is able to maintain the same fairness as achieved on the current Internet. These observations are of significant importance to a potentially wide adoption of small-buffer all-optical networks.

We present the first practical example of an entirely new class of network attacks - attacks that target the network infrastructure. Modern routers in computer networks use general-purpose programmable packet processors. The software used for packet processing on these systems is potentially vulnerable to remote exploits. In this paper, we demonstrate a specific attack that can launch a devastating denial-of-service attack by sending just a single packet. We show that vulnerable packet processing code can be exploited on a Click modular router as well as on a custom packet processor on the NetFPGA platform. We also show that defense techniques based on processor monitoring that we have proposed in prior work can help in detecting and avoiding such attacks.

Packet losses in the network have a considerable performance impact on transport-layer throughput. For reliable data transfer, lost packets require retransmissions and thus cause very long delays. This tail of the packet delay distribution causes performance problems. There are several approaches to trading off networking resources up-front to reduce long delays for some packets (e.g., forward error correction, network coding). We propose packet pacing as an alternative that changes traffic characteristics favorably by adding intentional delay in packet transmissions. This intentional delay counters the principle of best effort but can reduce the burstiness of traffic and improve overall network operation - in particular in network with small packet buffers. As a result, pacing improves transport-layer performance, providing a tradeoff example where small amounts of additional delay can significantly increase connection bandwidth. We present a Queue Length Based Pacing (QLBP) algorithm that paces network traffic using a single queue and that can be implemented with small computational and memory overhead. We present a detailed analysis on delay bounds and the quantitative impact of QLBP pacing on network traffic. Through simulation, we show how the proposed pacing technique can improve connection throughput in small-buffer networks.

Programmability in the data path of routers provides the basis for modern router implementations that can adapt to new functional requirements. This programmability is typically achieved through software-programmable packet processing systems. One key concern with the proliferation of these programmable devices throughout the Internet is the potential impact of software vulnerabilities that can be exploited remotely. We present a design and proof-of-concept implementation of a packet processing system that uses two security techniques to defend against potential attacks: a processing monitor is used to track operations on each processor core to detect attacks at the processing instruction level; an I/O monitor is used to track operations of the router to detect attacks at the protocol level. Our prototype implementation on the NetFPGA system shows that these monitors can be implemented to operate at high data rates and with little additional hardware resources.

The development of Network Intrusion Detection Systems (NIDS) is nowadays a powerful solution to defend against various network security threats. There has been a lot of research effort devoted to hardware-based NIDS, because of (1) the massive amount of computation performed by regular expression matching algorithms and (2) the gigabit per second performance requirement of modern NIDS. Hardware-based NIDS take advantage of parallelization inherent in FPGAs, ASICs or network processors to support very high network speeds, while software approaches fail to do so.

Network virtualization requires careful control of networking resources, including link bandwidth, router memory, and packet processing time. Isolation and fair sharing of processing resources in current high-performance packet processors occur at the granularity of entire processor cores. Scaling of network virtualization to larger numbers of parallel slices requires a more fine-grained processor sharing mechanism. Our work presents a novel approach, called Fair Multithreading (FMT), that allows hardware threads to share a processor core while ensuring isolation and weighted fair access. We present an analysis of the FMT algorithm and a prototype implementation on a NetFPGA system. Our evaluation results indicate that FMT can be implemented at speeds that are necessary to make scheduling decisions at the instruction level. We show the impact of having such fine-grained processor schedulers in substrate nodes by comparing the resource utilization of virtual network slices in our system to traditional whole-core allocations. Our simulation results show the FMT-based substrate networks can be utilized more efficiently and more virtual network requests can be accommodated. These results indicate the significant improvement in system scalability that can be gained from our fine-grained processor scheduling system.

Programmable packet processors have replaced traditional fixed-function custom logic in the data path of routers. Programmability of these systems allows the introduction of new packet processing functions, which is essential for today's Internet as well as for next-generation network architectures. Software development for many existing implementations of these network processors requires a deep understanding of the architecture and careful resource management by the software developer. Resource management that is tied to application development makes it difficult for packet processors to adapt to changes in the workload that are based on traffic conditions and the deployment of new functionality. Therefore, we present a network processor design that separates programming from resource management, which simplifies the software development process and improves the system's ability to adapt to network conditions. Based on our initial system design, we present a prototype implementation of a 4-core network processor using the NetFPGA platform. We demonstrate the operation of the system using header-processing and payload-processing applications. For packet forwarding, our simplified network processor can achieve a throughput of 2.79 Gigabits per second at a clock rate of only 62.5 MHz. Our results indicate the proposed design can scale to configurations with many more processors that operate at much higher clock rates and thus can achieve considerable higher throughput while using modest amounts of hardware resources.

We argue that applications can benefit from the offloading of processing tasks into the data path of next-generation networks, where custom packet processing functions can be implemented. We present the concept of application-layer services and how they can be integrated into our existing network service architecture for easy use and control. Using a web server application as an example, we discuss how an application can be partitioning between end-system and offloading tasks. Our prototype implementation based on an Intel IXP2855 network processor demonstrates that web page access times can be improved by using our application-layer services.

With dozens to hundreds of processing cores deployed in next generation packet processor, regular topologies such as mesh are widely adopted in Network-on-Chip design to provide scalable interconnection to cores. Although such packet processors are rich in raw system processing power, utilization of hardware resource plays a critical role in overall system performance. In this paper, we focus on processing task mapping and on-chip packet routing, which are the key issues for data path performance on next-generation packet processors. We present a genetic algorithm to explore the assignment of tasks, and utilize on-chip interconnections by splitting the traffic between cores across multiple paths. The split flow traffic assigned to each routing path is solved with linear programming. Our experimental results on a packet processor architecture prototype show that the proposed algorithm is efficient and scalable.

Advanced packet processing in the data path of networks is common in the current Internet and is expanding to next-generation networks. Dynamic composition of such "network services" allows networks to establish connections with customized communication characteristics to satisfy various application requirements. In these networks, there are two problems that need to be solved: finding the optimal composition of services to satisfy the communication requirements of a given connection ("service composition") and finding the optimal path for a given composition of services such that the required services are executed in sequence along the path ("service routing"). So far, these two problems have been studied separately. In our work, we combine both into a "service composition and routing" approach that can achieve better solutions than the current, separate approach. We present a novel decision making system that can determine the optimal or near-optimal solutions for the service composition and routing problem. We develop a synthetic benchmark for service requests to help comprehensively evaluate the performance of our systems. The results show that considering service composition and service routing jointly results in connections that have lower end-to-end delay while still meeting all service requirements.

Anomaly detection in network traffic is an important technique for identifying operation and security problems in networks. Numerous anomaly detection algorithms have been proposed and deployed in practice. The recent availability of high-performance embedded processors in network systems has made it possible to implement these algorithms to monitor traffic in real-time. Since it is unlikely that any single anomaly detection technique will ever be sufficient, we propose the use of multiple existing anomaly detection algorithms in parallel. In this paper, we develop a method of combining different classes of anomaly detection algorithms and address the question of which combination of existing anomaly detection algorithms achieves the best detection accuracy. We also present a taxonomy of anomaly detection algorithms and evaluate six specific algorithms on a common evaluation platform. Based on this evaluation, we identify the combination of anomaly detection algorithms that achieve the highest detection accuracy and derive a few rules that can be used when deciding on combining and aggregating multiple algorithms.

For the optical packet-switching routers to be widely deployed in the Internet, the size of packet buffers on routers has to be significantly small. Such small-buffer networks rely on traffic with low levels of burstiness to avoid buffer overflows and packet losses. We present a pacing system that proactively shapes traffic in the edge network to reduce burstiness. Our queue length based pacing uses an adaptive pacing on a single queue and paces traffic indiscriminately where deployed. In this work, we show through analysis and simulation that this pacing approach introduces a bounded delay and that it effectively reduces traffic burstiness. We also show that it can achieve higher throughput than end-system based pacing.

The inherent limitations of embedded systems make them particularly vulnerable to attacks. We have developed a hardware monitor that operates in parallel to an embedded processor and detects any attack that causes the embedded processor to deviate from its originally programmed behavior. We explore several different characteristics that can be used for monitoring and quantify trade-offs between these approaches. Our results show that our proposed hash-based monitoring pattern can detect attacks within one instruction cycle at lower memory requirements than traditional approaches that use control flow information.

Virtualization is the base for a diversified next-generation network architecture design. Much work has been done on virtualization infrastructure, but it is still unclear how to easily instantiate a network slice that meets a high-level description of network functionality. Our work addresses this problem that occurs at the interface between network service providers and virtualized infrastructure providers. The proposed Service-based Network Virtualization System (SNVS), which is based on our previously developed network service architecture, provides a comprehensive and extensible interface to ease the development of new network services, protocols, and applications in virtualized networks.

Customizable packet processing is an important aspect of next-generation networks. Packet processing architectures using multi-core systems on a chip can be difficult to program. In our work, we propose a new packet processor design that simplifies packet processing by managing packet contexts in hardware. We show how such a design scales to large systems. Our results also show that the management of such a system is feasible with the proposed mapping algorithm.

Developing algorithms to detect anomalies in network traffic is an important goal to achieve secure and efficient operation of the Internet. To evaluate different algorithms, it is crucial to have a set of standardized test cases. We propose a benchmark suite called "AnomBench" that consists of sixteen different traffic scenarios that contain various different traffic anomalies. We describe why these scenarios are representative and show the results of a prototype implementation on DETERlab.

The demand for more bandwidth has lead to proposals for an all-optical network core. Due to inherent constraints of optical technology, only routers with small packet buffers are feasible to be implemented. In order to ensure efficient operation of such small-buffer networks, it is necessary to ensure that traffic is less bursty than in conventional networks. We propose a novel packet pacing mechanism that can smooth traffic bursts. Our theoretical analysis shows that our pacing scheme can guarantee that queue length of routers is BIBO stable. Experimental results from our prototype implementation show the effectiveness of our pacer on in terms of reduced network congestion and improving network throughput.

Novel network architectures with distributed service components on both routers and end-systems have been proposed to provide the necessary flexibility in the next-generation Internet. Such architectures allow services to be composed along the data path to satisfy different communication requirements. A major operational challenge in such systems is to determine where to perform the required services along the data path. This problem, which we call as the "service placement problem" is proven to be NP-complete when considering resource (e.g., link and processing capacity) constraints. In this paper, we present an evaluation of several existing and newly developed heuristic algorithms for solving the problem. We explore the quality of the achieved placement in terms of effective use of system resources, end-to-end delay, connection drop rate, and load balancing. Our results show the design trade-offs of these different algorithms.

Designs of next-generation Internet architectures propose a diverse and changing set of features in the data path of routers. These routers require high-performance programmable packet processing platforms to allow for dynamic feature deployment and adaptation. In this paper, we present programming abstractions that quantifies processing and storage of network services. We further devise a runtime environment that provides the ability of adaptation to dynamically deployed network services and varying network traffic.

Computer networks are vulnerable to attacks, where the network infrastructure itself is targeted. Emerging router designs, which use software-programmable embedded processors, increase the vulnerability to such attacks. We present the design of a secure packet processing platform (SPPP) that can protect these router systems. We use an instruction-level monitoring system to detect deviations in processing behavior. If such deviations are detected, a recovery system is invoked to restore the system into an operational state. Our preliminary results show that most attacks can be detected within a single instruction. The system overhead for secure monitoring is limited to a fraction of the overall space, memory, and power budget.

Network processors are heterogeneous system-on-chip multiprocessors that are optimized to perform packet forwarding and processing tasks at Gigabit data rates. To meet the performance demands of increasing link speeds and complex network applications, network processors are implemented with several dozen embedded processor cores and hardware accelerators that run multiple packet processing applications in parallel. The parallel nature of the processing system makes it increasingly difficult for application developers to understand and manage resources and map processing tasks to the hardware. To address this problem, we present a methodology for profiling and analyzing network processor applications, mapping processing tasks to a generalized network processor architecture, and analytically determining the expected throughput performance. The key novelty of this work is not only the adaptation of application analysis and mapping algorithms to heterogeneous network processors, but also that the entire process can be automated and hidden from the application developer. Starting with the analysis of a uniprocessor implementation of the application, the process yields a mapping of the partitioned application that shows best performance for a given network processor system. The simplicity of the proposed randomized mapping algorithm allows the use of this methodology in network processor runtime systems where dynamic reallocation of tasks is necessary but processing power is limited. We present results that show the effectiveness of the analysis and mapping methodology as well as its application to design space exploration.

Capabilities-based networks present a fundamental shift in the security design of network architectures. Instead of permitting the transmission of packets from any source to any destination, routers deny forwarding by default. For a successful transmission, packets need to positively identify themselves and their permissions to the router. The analysis of the data path credentials data structure that we propose shows that as few as 128 bits are sufficient to reduce the probability of unauthorized traffic reaching its destination to a fraction of a percent.

Computer networks require increasingly complex packet processing in the data path to adapt to new functionality requirements. To meet performance demands, packet processing systems on routers employ multiple processor cores. We investigate the design of an efficient run-time management system that handles the allocation of processing tasks to processor cores. Using run-time profiling information about processing requirements and traffic characteristics, the system is able to adapt to dynamic changes in the workload and balance the utilization of all processing resources to maximize throughput. We present a prototype implementation of our system that is based on the Click modular router. Our results show that our prototype system can adapt to changing workloads and process computationally demanding packets at 1.32 times higher data rates than SMP Click.

To support the increasing diversity of systems and protocols in the Internet, modern routers offer a variety of data path processing functions. Such "network services" are easy to implement on a single node, but a network-wide deployment is difficult. We discuss our implementation of a network service architecture that uses novel end-to-end abstractions to access and control advanced data path functions. To make such functions available to end-system applications, we introduce a "service socket" API. We demonstrate the operation of this network architecture and its socket API in the context of a video distribution scenario that we have implemented on a 60-node Emulab testbed.

In the next-generation Internet architecture, more functionality will be placed in the data path of routers in the form of "services" and other packet processing features. This trend will increase the amount of state information that is maintained by system inside the network. In this paper, we present a framework for structuring and managing network state information distributed across the next-generation Internet architecture.

The rapid and accurate detection of anomalies in network traffic has always been a challenging task, and is absolutely critical to the efficient operation of the network. The availability of numerous different detection algorithms makes it difficult to choose a suitable configuration. An algorithm may have a high detection rate for high rate attacks, but might behave unfavorably when faced with attacks with gradually increasing rates. This paper proposes an online parallel anomaly detection system that implements multiple anomaly detection algorithms in parallel to detect anomalies in real-time. The main idea is to aggregate the detection data from multiple algorithms to come up with a single anomaly metric. We evaluate this system with realistic attacks on the DETER testbed. Our results show improved true positive and false negative rates for both high intensity and slow-rise ramped floods. Furthermore, the system is able to detect attacks separated by as little as 15 seconds with a high true positive rate.

Many next-generation Internet architectures propose advanced packet processing functions in the data path of the network. Such "services" are typically performed on some nodes along the path of a packet. We present a novel decentralized algorithm that can determine an allocation of services to network nodes. The algorithm can obtain globally optimal solutions for a single service and approximate solutions for two or more services. In our simulation results, we validate the correctness of the algorithm, quantify the quality of the approximations, and compare the results to those of a centralized algorithm. Our results show that the proposed algorithm presents an effective solution to the service placement problem that can be implemented in a realistic network.

Detecting anomalies during the operation of a network is an important aspect of network management and security. Recent development of high-performance embedded processing systems allow traffic monitoring and anomaly detection in real-time. In this paper, we show how such processing capabilities can be used to run several different anomaly detection algorithms in parallel on thousands of different traffic subclasses. The main challenge in this context is to manage and aggregate the vast amount of data generated by these processes. We propose (1) a novel aggregation process that uses continuous anomaly information (rather than binary outputs) from existing algorithms and (2) an anomaly tree representation to illustrate the state of all traffic subclasses. Aggregated anomaly detection results show a lower false positive and false negative rate than any single anomaly detection algorithm.

Advanced packet processing functions in the data path of routers are commonly used in the current Internet and are likely to expand in next-generation networks. One of the key challenges related to such “network services” is to develop a suitable control plane infrastructure for routing and connection setup. In this paper, we present a novel distributed algorithm and routing protocol to facilitate allocation of services during connection setup. The protocol is scalable for deployment in large networks and can obtain globally optimal solutions for a single service and approximate solutions for two or more services. We have implemented a prototype on Emulab to evaluate the proposed protocol. Our implementation shows that the proposed protocol is indeed an effective and scalable solution to the routing problem in networks with data-path services.

Virtual laboratories are a potential replacement for standard laboratory facilities. Use of these virtual resources can reduce cost and maintenance overheads for teaching institutions while still ensuring that students have access to real equipment. Previous work indicates that students respond well to such environments, but one important operational aspect has been overlooked. In this work, we consider instructor overhead by comparing the amount of work required to teach courses with and without the use of a virtual laboratory. In particular, we examine two graduate computer networking courses, each taught with the standard software-only approach and then taught later with the Open Network Laboratory. Our data show that the effort required by the instructor to use a virtual laboratory is not much more than in a software-only environment, and that the increased interaction between student and instructor can be beneficial as the student questions are primarily focused on fundamental networking concepts.

Modern network processor systems require the ability to adapt their processing capabilities at runtime to changes in network traffic. Traditionally, network processor applications have been optimized for a single static workload scenario, but recently several approaches for runtime adaptation have been proposed. Comparing these approaches and developing novel runtime support algorithms is difficult due to the multicore system-on-a-chip nature of network processors. In this paper, we present a model for network processors that can aid in evaluating different runtime support systems. The model considers workload characteristics of applications and network traffic using a queuing network abstraction. The accuracy of this analytical approach to modeling runtime systems is validated through simulation. We illustrate the effectiveness of our model by comparing the performance of two existing workload adaptation algorithms.

Embedded systems present significant security challenges due to their limited resources and power constraints. This paper focuses on the issues of building secure embedded systems on reconfigurable hardware and proposes a security architecture for embedded systems (SAFES). SAFES leverages the capabilities of reconfigurable hardware to provide efficient and flexible architectural support for security standards and defenses against a range of hardware attacks. The SAFES architecture is based on three main ideas: (1) reconfigurable security primitives; (2) reconfigurable hardware monitors; and (3) a hierarchy of security controllers at the primitive, system and executive level. Results are presented for reconfigurable AES and RC6 security primitives and highlight the value of such an architecture. This paper also emphasizes that reconfigurable hardware is not just a technology for hardware accelerators dedicated to security primitives as has been focused on by most studies but a real solution to provide high-security and high-performance for a system.

Next-generation Internet architectures require designs with inherent security guarantees.We present a network architecture that uses credentials to audit traffic in the data path, where defenses can be employed often more quickly and efficiently than on end-systems.

In the next generation Internet architecture, more functionality in the form of "services" and packet processing features will be placed inside the network rather than on end-systems. This trend will increase the amount of network state information maintained by the systems inside the network. We present a framework for structuring and managing network state information that can be used in the next generation Internet architecture.

The inherent limitations of embedded systems make them particularly vulnerable to attacks. We have developed a hardware monitor that operates in parallel to the embedded processor and detects any attack that causes the embedded processor to deviate from its originally programmed behavior. We explore several different characteristics that can be used for monitoring and quantitative tradeoffs between these approaches. Our results show that our proposed hash-based monitoring pattern can detect attacks within one instruction cycle at lower memory requirements than traditional approaches that use control-flow information.

Considerable research efforts in the networking community are focused on defining a new Internet architecture that not only solves some of the problems of the current design, but also meets future needs. Our work focuses on the issue of how to provide suitable abstractions for communication between end-systems. This is a particularly important aspect of the network architecture as it is exposed to all applications and also determines what kind of services can be provided by the network. We present an architecture for network services that are implemented on router systems. We illustrate how control and data plane interact to provide the necessary end-to-end functionality. Our prototype implementation indicates that such a design is feasible and scalable for high-performance networks.

79-83

The Open Network Laboratory (ONL) is an Internet-accessible virtual laboratory facility that can deliver a high quality laboratory experience in advanced networking [3,7]. Our experience with ONL indicates that it has potential to improve student understanding of fundamental networking concepts and increase enthusiasm for experimentation with complex technology. Furthermore, these benefits can be delivered with less effort from the instructor than using a traditional approach of socket programming and ns-2 simulation exercises. The system is built around a set of high-performance, extendible routers which connect personal computers acting as end systems. Users configure their virtual network through the Remote Laboratory Interface (RLI), an intuitive graphical interface. The RLI's real-time charts and user data facility make it easy to directly view the effect of system parameters on traffic behavior. These features can enhance learning by providing users with multiple representations of network phenomena. We describe how the ONL facilities have improved our ability to meet instructional objectives and discuss some approaches to improving the laboratory experience.

Modern network processor systems require the ability to adapt their processing capabilities at runtime to changes in network traffic. Traditionally, network processor applications have been optimized for a single static workload scenario, but recently several approaches for run-time adaptation have been proposed. Comparing these approaches and developing novel run-time support algorithms is difficult due to the multicore system-on-a-chip nature of network processors. In this paper, we present a model for network processors that can aid in evaluating different run-time support systems. The model considers workload characteristics of applications and network traffic. We use a queuing network abstraction to model different runtime systems. We illustrate the effectiveness of this model by comparing the performance of two existing workload adaptation algorithms.

Next-generation network architectures will be governed by the need for flexibility. Heterogeneous end-systems, novel communication abstractions, and security and manageability challenges will require networks to provide a broad range of services that go beyond the simple store-and-forward capabilities of today's Internet. This paper introduces new abstractions for information transfer and data services in the network, which overcome the constraints of the end-to-end argument that has dominated current network designs. The explicit separation of communication and processing allows the composition of a variety of information transfer patterns that expand the capabilities of the network to meet its next-generation challenges. We discuss implementation issues that arise in this network architecture and present several examples of how applications can utilize the proposed abstractions. This present a first step towards a unified view of the convergence of networking, processing, and their distributed applications.

We present an architecture for a Distributed Online Measurement Environment (DOME) which is a passive measurement system that correlates network information between several measurement nodes placed at different locations in the network to offer a large scale view of network operation. The system is capable of capturing packet traces and pre-processing them on the measurement node itself. Real-time queries are implemented by breaking them down into standard statistics that are updated during run-time. We present details of a prototype implementation of our architecture on an Intel IXP2400 network processor. The prototype is deployed on the main Internet access link of the University of Massachusetts and measurement results are validated against those obtained from an Endace DAG card. Performance of the prototype is compared to that of a conventional post processing system for an application to detect network anomalies.

To provide a variety of new and advanced communications services, computer networks are required to perform increasingly complex packet processing. This processing typically takes place on network routers and their associated components. An increasingly central component in router design is a chip-multiprocessor (CMP) referred to as "network processor" or NP. In addition to multiple processors, NPs have multiple forms of on-chip memory, various network and off-chip memory interfaces, and other specialized logic components such as CAMs (content addressable memories). The design space for NPs (e.g., number of processors, caches, cache sizes, etc.) is large due to the diverse workload, application requirements, and system characteristics. System design constraints relate to the maximum chip area and the power consumption that are permissible while achieving defined line rates and executing required packet functions. In this paper, an analytic performance model that captures the processing performance, chip area, and power consumption for a prototypical NP is developed and used to provide quantitative insights into system design trade offs. The model, parameterized with a networking application benchmark, provides the basis for the design of a scalable, high-performance network processor and presents insights into how best to configure the numerous design elements associated with NPs

Network processors (NPs) promise a flexible, programmable packet processing infrastructure for network systems. To make full use of the capabilities of network processors, it is imperative to provide the ability to dynamically adapt to changing traffic patterns and to provide run-time support in the form of a network processor operating system. The differences to existing operating systems and the main challenges lie in the multiprocessor nature of NPs, their on-chip resources constraints, and the real-time processing requirements. In this paper, we explore the key design tradeoffs that need to be considered when designing a network processor operating system. In particular, we explore the performance impact of (1) application analysis for partitioning, (2) network traffic characterization, (3) workload mapping, and (4) run-time adaptation. We present and discuss qualitative and quantitative results in the context of a particular application analysis and mapping framework, but the observations and conclusions are generally applicable to any run-time environment for network processors.

Transparent TCP acceleration is an approach to increasing TCP throughput without requiring any changes in end-system TCP implementations. Network processing technology is used to intercept and transparently relay TCP connections inside the network. Due to the transparent nature of the system, incremental deployment and opportunistic acceleration is easily possible. The simulation results show that a single acceleration node can improve throughput twofold. More acceleration nodes can further increase the performance improvement, particularly on lossy links.

Network processing is becoming an increasingly important paradigm as the Internet moves towards an architecture with more complex functionality inside the network. Modern routers not only forward packets, but also process headers and payloads to implement a variety of functions related to security, performance, and customization. It is important to get a detailed understanding of the workloads associated with this processing in order to be able to develop efficient network processing engines. We present a tool called PacketBench, which provides a framework for implementing network processing applications and obtaining an extensive set of workload characteristics. PacketBench provides the support functions to handle various packet traces and manage packet memory. For statistics collection, PacketBench provides the ability to derive a number of microarchitectural and networking related metrics. The understanding of workload details of network processing has many practical applications. As network processing systems move towards highly parallel embedded systems, it is becoming increasingly important to explore the processing requirements of individual packets rather than averaged statistics. We show a range of workload results that focus on individual packets and the variation between them

Computer networks have progressed from a simple store-and-forward medium to a complex communication infrastructure. Routers in the network need to implement a variety of functions ranging from simple packet classification for forwarding and firewalling to complex payload modifications for encryption and content adaptation. As these functions increase in number and complexity, more processing time is required, and packets experience a significant processing delay. In most network simulations, this delay has not been addressed because it was considered negligible. However, we show that this network processing delay can reach the magnitude of long-distance propagation delay and thus becomes a significant contributor to the overall packet delay. We evaluate different network applications and develop a model that characterizes packet processing cost with only a few parameters that can easily be derived from our simulations. To validate our simulation and our model, we compare them to actual network measurements. The contributions of this work can be used to increase the accuracy of network simulations and improve network performance estimations.

Developments toward ubiquitous and pervasive computing have lead to application scenarios where a large number of sensors and computing devices are connected to the network. These devices might constantly send status information via multicast to a number of applications or users. One big challenge in this environment is the amount of data traffic generated by such sensors, which depends on the size of the data, the transmission frequency, and the number of senders and receivers. However, for certain applications it is sufficient to receive less accurate, aggregated data from a group of sources. This leads to the possibility of using programmable routers to perform such data aggregation inside the network. While the basic algorithm for data merging has been described in literature, we address how a large number of sources can be organized in a hierarchical structure to allow multiple users to get a view of all sensors at different levels of aggregation. With the control information that is provided by an aggregating node, the user can traverse the aggregation tree by joining different multicast sessions that transmit different levels of detail. This provides a novel communication paradigm that reduces the network overhead from continuously transmitting sources and organizes data in a way that it is useful to receivers. We provide two detailed example scenarios: A battlefield information system, which aggregates geographic location data of units, and a conferencing application, which aggregates audio data. We describe the aggregation algorithm that is used and analyze its effect on delay and jitter of periodic transmissions by the sources. We describe the hierarchical control structure that provides multiple levels of aggregation and how real-time transport protocol (RTP) can be used to implement it. The performance of the proposed scheme is evaluated with measurements that were done on an implementation of the audio aggregation application.

To provide flexibility in deploying new protocols and services, general-purpose processing engines are being placed in the datapath of routers. Such network processors are typically simple RISC multiprocessors that perform forwarding and custom application processing of packets. The inherent unpredictability of execution time of an arbitrary instruction code poses a significant challenge in providing QoS guarantees for data flows that compete for such processing resources in the network. However, we show that network processing workloads are highly regular and predictable. Using estimates of execution times of various applications on packets of given lengths, we provide a method for admission control and QoS scheduling of processing resources. We present a processor scheduling algorithm called estimation-based fair queuing (EFQ) which uses these estimates, and provides significantly better delay guarantees than processor scheduling algorithms which do not take packet execution times into consideration.

The provision of advanced computational services within networks is rapidly becoming both feasible and economical. We present a general approach to the problem of configuring application sessions that require intermediate processing by showing how the session configuration problem can be transformed to a conventional shortest path problem for unicast sessions or to a conventional Steiner tree problem for multicast sessions. We show, through a series of examples, that the method can be applied to a wide variety of different situations.

Demands for flexible processing have moved generalpurpose processing into the data path of networks. Processor schedulers have a great impact on the performance of these real-time systems. We present measurements that show that the workload of a network processor is highly regular and predictable. Processing time predictions, based on these measurements, can be used in scheduling together with information about locality in the instruction stream to significantly improve throughput performance. We propose two scheduling schemes, Locality-Aware and Locality-Aware Predictive, that try to avoid cold caches when scheduling packets for processors. Simulations of the schedulers using packet processing times obtained from an operational network processor show the tradeoffs between the algorithms and their performance improvements over First-Come-FirstServe scheduling.

Modern networks require the flexibility to support new protocols and network services without changes in the underlying hardware. Routers with general-purpose processors can perform data path packet processing using software that is dynamically distributed. However, custom processing of packets at link speeds requires immense computational power. This paper proposes a design of a scalable, high-performance active router. Multiple network processors with cache and memory on a single application specific integrated circuit are used to overcome the limitations of traditional single processor systems. The proposed design is used as a vehicle for studying the key issues that must be resolved to allow active networking to become a mainstream technology. Benchmark measurements are used to put the design in relation to actual application demands.

The paper presents a benchmark, CommBench, for use in evaluating and designing telecommunications network processors. The benchmark applications focus on small, computationally intense program kernels typical of the network processor environment. The benchmark is composed of eight programs, four of them oriented towards packet header processing and four oriented towards data stream processing. The benchmark is defined and characteristics such as instruction frequencies, computational complexity, and cache performance are presented. These measured characteristics are compared to the standard SPEC benchmark. Three examples are presented indicating how CommBench can aid in the design of a single chip network multiprocessor.