Cyber Threat Intelligence (CTI) reports provide valuable insights into cybersecurity attack techniques, which are essential for understanding threat execution. Identifying the root causes of these techniques is crucial for developing effective defense mechanisms. However, the unstructured nature and inconsistent terminology of CTI reports pose significant challenges in extracting causal factors, such as Common Weakness Enumerations (CWEs) and vulnerable data components, limiting proactive responses and the understanding of attack interdependencies. To address these challenges, we propose TRACE, a novel framework that extracts causal factors linked to adversarial techniques and generates comprehensive causal graphs revealing interdependencies within CTI reports. TRACE combines pattern extraction and tagging methods to address the limitations of existing approaches. Utilizing Sentence-based Bidirectional Encoder Representations from Transformers (SBERT) embeddings enhanced with knowledge mappings and deep learning techniques, TRACE discovers and models causal relationships between attack techniques within the reports. By bridging the gap between attack techniques and their underlying vulnerabilities, TRACE provides actionable insights to enhance cybersecurity defenses. Evaluated on 710 CTI reports, TRACE achieved an F1 score of 0.87, demonstrating its accuracy in extracting causal factors and its potential to advance automated causal analysis in cybersecurity.

The integration of artificial intelligence (AI) with the Internet of Things (IoT) marks a significant advancement in sixth-generation (6G) networks. The complexity of these AIoT services has promoted an as-a-service model, where service providers offer tailored architectures to meet varied application needs. Despite the critical importance of optimizing both training and inference in service architectures, this aspect remains under-explored. Our study introduces service scenarios such as ‘no shared (NS)’, where tenants manage their data and models independently, ‘data shared (DS)’, where tenants provide data for collective training, and ‘parameter sharing (PS)’, where only model parameters are shared. We utilize a tandem queue model to simulate the communication and computing demands across cloud-edge-fog architectures. Our proposed Cost and Delay Resource Allocation (CDRA) method significantly reduces costs, with edge and fog-based training and inference lowering costs by up to 44% compared to cloud setups. The evaluation shows that the NS scenario is resource-intensive but offers high privacy, DS is cost-effective and improves model accuracy, and PS balances privacy with longer wait times. These findings provide service providers with a comprehensive comparison of service scenarios and architectures, offering guidance for strategic and economically sound decisions in the ever-evolving landscape of AIoT.

The rise of AI solutions has driven the emergence of AI as a Service (AIaaS), offering cost-effective and scalable solutions by outsourcing AI functionalities to specialized providers. Within AIaaS, three key components are essential: segmenting AI services into preprocessing, training, and inference tasks; utilizing GPU-CPU heterogeneous systems where GPUs handle parallel processing and CPUs manage sequential tasks; and minimizing latency in a distributed architecture consisting of cloud, edge, and fog computing. Efficient task scheduling is crucial to optimize performance across these components. In order to enhance task scheduling in AIaaS, we propose a user-experience-and-performance-balanced reinforcement learning (UXP-RL) algorithm. The UXP-RL algorithm considers 11 factors, including queuing task information. It then estimates resource release times and observes previous action outcomes, to select the optimal AI task for execution on either a GPU or CPU. This method effectively reduces the average turnaround time, particularly for rapid inference tasks. Our experimental findings show that the proposed RL-based scheduling algorithm reduces average turnaround time by 27.66% to 57.81% compared to the heuristic approaches such as SJF and FCFS. In a distributed architecture, utilizing distributed RL schedulers reduces the average turnaround time by 89.07% compared to a centralized scheduler.

An Intrusion Detection System (IDS) employing machine learning (ML) solutions is crucial for identifying network intrusions. To minimize operational expenses and enhance performance, enterprises have begun outsourcing IDS management to service providers, giving rise to the concept of Intrusion Detection as a Service (IDaS). Earlier research primarily aimed at enhancing the accuracy of ML-based IDS models or expediting their computational process. However, from the service provider's perspective, an optimal architecture ensuring minimal computation cost and processing delay is crucial to increasing revenue. This study evaluates the performance of IDaS in a multi-tier architecture, utilizing traffic split offloading to enhance performance by mapping three in-sequence ML-based IDS tasks (pre-processing, binary detection, multi-class classification) to the architectures as the offloading destinations. We employ a simulated annealing-based traffic offloading and cost allocation (SA-TOCA) algorithm to determine the offloading ratio for each traffic path and the cost requirements for each tier. The results indicate that the edge-cloud architecture is 15% and four times more cost-effective compared to the fog-edge and fog-cloud architectures, respectively, and it demonstrates superior performance in minimizing processing delays. Offloading the majority of traffic to the edge and the remainder to the cloud proves to be an efficient strategy, reducing both computation costs and average delays.

Delay-sensitive applications demand ultra-low latency, which can be achieved by leveraging edge and fog computing to provide computation services closer to users. However, the server capacity limitation of edge and fog computing necessitates offloading to balance the computation load across cloud, edge, and fog servers. While previous works typically focus on the average delay of users' requests and employ probabilistic offloading schemes based on certain probabilities, our study introduces a novel approach that considers the QoS violating probability and offloads users' requests based on the queue length of computing servers. We propose an approximate model with closed-form solutions to determine the near-optimal offloading thresholds of the queue lengths at fog and edge servers. Although the performance results of the approximate queueing model do not precisely match the simulation results, our numerical findings demonstrate that they share the same trend, and the approximate queueing model can provide the optimal queue length threshold in most cases. Moreover, our numerical results reveal that the QoS violating probability of the queue-length-based offloading is significantly lower than that of the probabilistic offloading scheme, with potential reductions of up to 60% in QoS violations in large-scale network scenarios.

Mobile Edge Computing (MEC) is a key technology for supporting low latency applications close to the end user. Users can access application servers in MEC instead of routing to the Internet by passing through a core cellular network. Few security challenges arise as the traffic does not traverse through the core network, and these can be solved by providing authentication services in the MEC. However, authentication and application mobility issues arise in the case of multiple MECs where a user is mobile and needs continuous service from application servers, without needing to establish a new session and providing authentication information repeatedly to every new MEC the user connects with. In this work, we propose two solutions, a TC3A (Token-based Cookie transfer & 3rd-party Authentication) and a TS3A (Token-based State transfer & 3rd-party Authentication) for resolution of authentication and application mobility issues while achieving low latency. We conducted experiments on a testbed that had MECs deployed in a real-time cellular network (emulated via OpenAirInterface) and performed user handover between two MECs. The experimental results show that TC3A and TS3A successfully re-authenticate the users, without provision of login credentials with target MEC, while reducing the latency by approximately 49.76–59.72% as compared to simple login method. The TC3A and TS3A also eliminate the need of keeping multiple accounts for applications at different MECs and most importantly provide application service continuity, through state transfer during cross-system handover, which is not provided by a simple login method. TC3A provides the application service continuity without any loss of session state, which is suitable for applications that cannot afford state loss, and TS3A provides the same while reducing the latency by 47.05–51.25% as compared to TC3A, which is suitable for applications that require low latency.

Cyber Threat Intelligence (CTI) plays a crucial role in understanding and preemptively defending against emerging threats. Typically disseminated through unstructured reports, CTI encompasses detailed insights into threat actors, their actions, and attack patterns. The MITRE ATT&CK framework offers a comprehensive catalog of adversary tactics, techniques, and procedures (TTPs), serving as a valuable resource for deciphering attacker behavior and enhancing defensive measures. Addressing the challenge of time-consuming manual analysis of MITRE TTPs in unstructured CTI reports, this paper presents MITREtrieval, a novel system that leverages deep learning and ontology to efficiently extract MITRE techniques. This approach mitigates issues related to the implicit nature of TTPs, textual semantic dependencies, and the scarcity of adequately labeled datasets, enabling more effective analysis even with limited sample sizes. Our approach combines a sophisticated sentence-level BERT deep learning model with ontology knowledge to address sparse data challenges, using a voting algorithm to merge outcomes. This results in a more accurate classification of MITRE techniques, capturing contextual nuances effectively. Our evaluation confirms MITREtrieval’s effectiveness in identifying techniques, regardless of their representation in training samples. MITREtrieval has surpassed benchmarks, achieving F2 scores of 58%, 62%, and 69% in multi-label technique identification across 113, 46, and 23 CTI reports, respectively, thereby streamlining CTI analysis and improving threat intelligence.

Intrusion Detection Systems (IDS) play an important role in detecting network intrusions. Because intrusions have many variants and zero-day attacks, traditional signature- and anomaly-based IDS often fail to detect them. On the other hand, solutions based on Machine Learning (ML), have better capabilities for detecting variants. In this work, we adopt an ML-based IDS which uses three in-sequence tasks, pre-processing, binary detection, and multi-class detection, with a multi-tier architecture with one-, two-, and three-tier architectural configurations. We then mapped three in-sequence tasks into these architectures, resulting in ten task assignments. We evaluated these with queueing theory to determine which tasks assignments were more appropriate for particular service providers. With simulated annealing, we obtained the computation capacity by allocating the total cost appropriate to each tier, based on the fixed parameter set with the objective of minimizing overall delay. These investigations showed that using only the edge and allocating all tasks to it gave the best performance. Furthermore, a two-tier architecture with edge and cloud components was also sufficient for IDS as a Service with the delay that was three times better than for other task assignments. Our results also indicate that more than 85% of the total capacity was allocated and spread across nodes in the lowest tier for pre-processing to reduce delays.

Mobile edge computing and fog computing are promising techniques providing computation service closer to users to achieve lower latency. In this work, we study the optimal offloading strategy in the three-tier federated computation offloading system. We first present queueing models and closed-form solutions for computing the service delay distribution and the probability of the delay of a task exceeding a given threshold. We then propose an optimal offloading probability algorithm based on the sub-gradient method. Our numerical results show that our simulation results match very well with that of our closed-form solutions, and our sub-gradient-based search algorithm can find the optimal offloading probabilities. Specifically, for the given system parameters, our algorithm yields the optimal QoS violating probability of 0.188 with offloading probabilities of 0.675 and 0.37 from Fog to edge and from edge to cloud, respectively.

In 5G networks, multi-access edge computing (MEC) can be embedded into an access network (AN-MEC) and a core network (CN-MEC), which composes a two-tier MEC architecture for better scalability. In pre-Central Office Re-architected as a Data center (pre-CORD), AN-MECs are connected to a single but distant CN-MEC through Central Offices (COs). Disaggregation and virtualization of 5G network functions push CN-MEC into COs, which is known as post-CORD. Post-CORD has more CN-MECs closer to User Equipments than pre-CORD. In this work, we propose a scalable two-tier, multi-site, multi-server MEC architecture for pre-CORD and post-CORD. To adjust capacity and traffic allocation in such a distributed two-tier architecture, we integrate scaling and offloading with the objective of minimizing total capacity cost subject to the latency satisfaction percentage constraints, and solve the problem by Latency Aware Two-Phase Iterative Optimization (LA-TPIO). The results show that post-CORD with ten CN-MEC sites requires 30% less capacity than pre-CORD in satisfying 95% of URLLC traffic. Post-CORD utilizes about 48-77% less AN-MEC capacity than pre-CORD because post-CORD’s aggregated but close-enough CN-MEC sites are ideal for serving URLLC traffic. Under heavy hotspot traffic, post-CORD’s vertical and horizontal offloading percentages are 72% and 28%, respectively, while pre-CORD’s are 99% and 1%, which means post-CORD introduces more horizontal offloading because it has links between not only AN-MEC sites but also CN-MEC sites to accommodate hotspot traffic.

The federation between cloud and edge has been proposed to exploit the advantages of both technologies. However, the existing studies have only considered cloud-edge computing systems which merely support vertical offloading from edges to clouds in one direction. However, there are certain cases, where the offloading needs to be done from clouds to edges and between edges. Such a cloud to edge offloading is called reverse offloading. To this end, this paper proposes a generic Omni-directional architecture of cloud-edge computing systems intending to provide vertical and horizontal offloading. To investigate the effectiveness of the proposed architecture in different operational scenarios, we formulate the dual cost optimization problem with different latency (loose, low, ultra-low) constraints. We develop an offloading algorithm using simulated annealing (SA). The experimental results show by our proposed OMNI architecture we can reduce the total cost by 15-25% and 10-20% in non-uniform and uniform inputs, respectively, compared to other existing architectures. The average latency in OMNI architecture is relatively very less compared to other architectures. It also increases utilization in the edge nodes by 5-30% in comparison to other existing architectures.

A collaborative integration between cloud and edge computing is proposed to be able to exploit the advantages of both technologies. However, most of the existing studies have only considered two-tier cloud-edge computing systems which merely support vertical offloading between local edge nodes and remote cloud servers. This paper thus proposes a generic architecture of cloud-edge computing with the aim of providing both vertical and horizontal offloading between service nodes. To investigate the effectiveness of the design for different operational scenarios, we formulate it as a workload and capacity optimization problem with the objective of minimizing the system computation and communication costs. Because such a mixed-integer nonlinear programming (MINLP) problem is NP-hard, we further develop an approximation algorithm which applies a branch-and-bound method to obtain optimal solutions iteratively. Experimental results show that such a cloud-edge computing architecture can significantly reduce total system costs by about 34%, compared to traditional designs which only support vertical offloading. Our results also indicate that, to accommodate the same number of input workloads, a heterogeneous service allocation scenario requires about a 23% higher system costs than a homogeneous scenario.

The smoothness of human-smartphone interaction directly influences users experience and affects their purchase decisions. A commonly used method to improve user interaction of smartphones is to optimize the CPU scheduler. However, optimizing the CPU scheduler requires a modification of operating system. In addition, the improvement of the smoothness of human-smartphone interaction may be limited because the display subsystem is not optimized. Therefore, in this paper, we design a motion prediction queuing system, named MPQS, to improve the smoothness of human-smartphone interaction. For this, we use the information of vector, speed, movement, provided by the queuing mechanism of Android, to predict the movement of user-smartphone interaction. Based on the prediction, we then utilize available execution time between frames to perform image processing. We conducted a set of experiments on beagleboard-xM to evaluate the performance of MPQS. Our experiment results show that the proposed method can reduce the number of jank by up to 21.75%.

OpenFlow supports internal buffering of data packets in an SDN switch whereby a fraction of data packet header is sent to the controller instead of an entire data packet. This internal buffering increases the robustness and the utilization of the link between SDN switches and controller by absorbing temporary burst of packets which may overwhelm the controller. Existing queuing models for SDN have focused on the switches that immediately send packets to the controller for decisioning, with no existing models investigating the impact of the internal buffer in an SDN switch and the associated trade-offs of having an internal buffer. In this paper, we propose an analytical model for SDN switch with the internal buffer to investigate the potential benefits, drawbacks and trade-off of internal buffering in SDN switches. It was observed that a switch with internal buffer achieves up to 30% lower average packet transfer delay and 7% lower packet loss rate at the cost of requiring up to 50% more queue capacity than one without the internal buffer. The proposed model is validated with discrete event simulation where the difference between simulation and analytical results was between 0.6% and 2.8% for average packet transfer delay and less than 6% for average packet loss rate. With this investigation, we provide some guidelines to SDN switch designers on the merits, demerits and trade-off of internal buffering in an SDN switch.

In a multi-tenancy software defined network (SDN) environment, physical devices such as switches are shared among tenants. In addition to a centralized controller, each tenant has his own controller that manages resources allocated to the tenant. Hence, the centralized controller performs SDN resource virtualization among tenants and acts as proxy between physical resources and tenant controllers. In order to manage the flow tables of the SDN switches, two partitioning strategies are considered. Hard partitioning of flow tables allocates a fixed amount of flow entries to each tenant, but flow tables are wasted if the tenant does not actually use them. On the other hand, soft partitioning strategy shares available flow entries among tenants, resulting in higher utilization but a resource monopoly problem, i.e., flow entries dominated by some greedy tenants. To achieve high flow table utilization and avoid the resource monopoly problem, we propose a soft-partitioning resource manager (SPRM) to manage the flow table resources in a multi-tenancy SDN environment. In SPRM, the allowed number of flow entries for each tenant ranges from a lower bound which equals to the tenant's quota to an upper bound which is dynamically adjusted according to the tenant's past usage. If an incoming flow request of a tenant is beyond his lower bound but under his upper bound, it could be temporarily accepted when there are free entries available. These borrowed flow entries will later be replaced if needed. If a request of a tenant is beyond his upper bound, SPRM will select a least-recently used flow entry of the tenant and replace it with the new request. In addition, SPRM monitors flow table resources and submits modify flow entry messages directly to SDN switches without checks by the management plane as possible in order to reduce flow modification latency. As a result, SPRM could reach higher flow table utilization and lower both flow entry miss rate and Packet_in events. Experimental results show that 100% flow rejections, and 95% Packet_in events are reduced while flow modification latency is decreased by 30%, as compared to hard partitioning.

In order to satisfy the 5G requirements of ultra-low latency, mobile edge computing (MEC)-based architecture, composed of three-tier nodes, core, edges, and devices, is proposed. In MEC-based architecture, previous studies focused on the controlplane issue, i.e., how to allocate traffic to be processed at different nodes to meet this ultra-low latency requirement. Also important is how to allocate the capacity to different nodes in the management plane so as to establish a minimal-capacity network. The objectives of this paper is to solve two problems: 1) to allocate the capacity of all nodes in MEC-based architecture so as to provide a minimal-capacity network and 2) to allocate the traffic to satisfy the latency percentage constraint, i.e., at least a percentage of traffic satisfying the latency constraint. In order to achieve these objectives, a two-phase iterative optimization (TPIO) method is proposed to try to optimize capacity and traffic allocation in MEC-based architecture. TPIO iteratively uses two phases to adjust capacity and traffic allocation respectively because they are tightly coupled. In the first phase, using queuing theory calculates the optimal traffic allocation under fixed allocated capacity, while in the second phase, allocated capacity is further reduced under fixed traffic allocation to satisfy the latency percentage constraint. Simulation results show that MEC-based architecture can save about 20.7% of capacity of two-tier architecture. Further, an extra 12.2% capacity must be forfeited when the percentage of satisfying latency is 90%, compared to 50%.

The subsystem in a smartphone means its hardware components, such as the CPU, GPU, and screen. Accurately estimating subsystem power consumption of commercial smartphones is necessary for applicable to wide research areas. Current subsystem power estimation techniques are mostly based on power models, resulting in considerable errors for various types of power consumption behaviors. These include (1) asynchrony between the measured power consumption and the corresponding workload statistics, and (2) nonlinearity concerning CPU idle states, pixels colors of AMOLED screen, and GPU workload statistics. In this study, we propose a novel utilization-based, subsystem power estimation method for a smartphone, namely Clustering and Symbolic Regression (CSR) that takes these power consumption behaviors into account so as to increase power estimation accuracy. To address asynchrony, we cluster the subsystem workload statistics into synchronous and asynchronous groups by employing affinity propagation clustering. To address nonlinearity, we employ symbolic regression for fitting measured power consumptions with respect to subsystem workload statistics. We compare our approach with various power estimation methods, Linear Regression Model (LM), Genetic Programming (GP), and Support Vector Regression (SVR). The results show Mean Absolute Percentage Error (MAPE) reduction between 23.61 and 42.55 percent on the estimated power consumption of a simple (Nexus S) and complex (Galaxy S4) smartphone subsystems.

Software Defined Networking (SDN) decouples the control plane from the data plane, thereby enhancing flexibility in network management. Earlier works on SDN modeling only focused on packet-level arrivals without considering flow-level arrivals. However, a model without considering flow-level arrivals cannot correctly reflect the probability of sending packets to the controller. In this paper, we propose an analytical model of SDN considering flow-level (TCP connection) arrivals and packet-level arrivals simultaneously. We use an analytical method termed as 4D state model, which uses four-dimensional states. We have derived the state transition rates of the model and also the packet delay and packet loss probability. We have conducted numerical analysis and extensive simulations. Our results show good matches, which verify the suitability and correctness of our analysis. Error ratios of the analytical results for 4D state model and M/M/1 model against simulation results are also given. Results show that for data packet delays, 4D state can achieve error ratios of 1.16-3.30%, which is much better than 8.57-35.7% attained by M/M/1 model, which only considers packet-level arrivals.

Prior load balancing solutions for chaining virtualized network functions cause significant control and data plane overheads and demand special requirements on network hardware. In this study, we present the design, implementation, and evaluation of Hash-based Traffic Steering on Softswitches (HATS), a load balancing mechanism that aims at mitigating such drawbacks. The method exploits flow hashing technique implemented on softswitches to perform server and network load balancing without triggering the control plane. We have implemented this design using OpenDayLight controller and Open vSwitch platform. The implementation demonstrates that HATS can be readily implemented with commodity network hardware. Furthermore, the experiment results confirm that HATS can reduce the number of flow entries and service chaining time up to 85% and 93%, respectively, when compared with Least Load First (LLF), a controller-based service chaining algorithm.

Software Defined Networking (SDN) is a new network architecture that separates control plane and data plane. SDN switch models in the literature primarily use queueing theory in two distinct categories: (i) single shared buffer for control plane traffic and data plane traffic, and (ii) buffer with two priorities to isolate control plane and data plane traffic. Several research works have independently studied these two buffer sharing mechanism but do not address the tradeoffs between these two buffer sharing mechanisms. The evaluation shows that shared buffer requires approximately up to 85% higher delays to install the flow table entries in the switch and up to 82% extra buffer capacity compared with the priority queueing buffer.

An intelligent transportation system is proposed to integrate information and communication technologies into vehicles and transport infrastructure to improve vehicular safety. To accelerate the commercialization of intelligent transportation system, a series of wireless access schemes for vehicular environments are proposed. These schemes, however, still suffer from multiple collisions of emergent messages in control channels (CCH), resulting in a driver may not receiving emergent messages in time. This work develops group reservation medium access control (GRMAC) to minimize the collisions of emergent messages in vehicular environments and thereby increase the availability of emergent messages. GRMAC also allows vehicles to reserve CCH bandwidth when they stay in service channels (SCH) in order to reduce collisions of emergent messages in CCH. GRMAC also migrates the CCH bandwidth scheduling mechanism from CCH to SCHs to reduce the burden on CCH. The theoretical analysis and simulation results under heavy loads shows that GRMAC achieves two time the goodput of conventional IEEE 802.11p/1609 mechanism and six time that of dedicated multi-channel MAC.

In this paper, we present a fast failover mechanism and a fast switchover mechanism to deal with link failure and congestion problems. In the fast failover mechanism, the controller pre-establishes multiple paths for each source-destination pair in the related OpenFlow-enabled (OF) switches. When a link becomes faulty, OF switches are able to failover the affected flows to another path. Based on the pre-established paths, in the fast switchover mechanism, the controller periodically monitors the status of each port of each OF switch. When the average transmission rate of a port consistently exceeds the rate threshold, the controller would decrease the transmission rate of the port by iteratively switching the flow with the minimum rate to another path. The emulation on Ryu controller and Mininet emulator shows the average recovery time of the fast failover mechanism is less than 40 ms, compared to hundreds of ms in the fast restoration mechanism. And, the fast switchover mechanism can reduce 47.5%-72.5% sustained time of link congestion depending on the parameter setting.

Chaining virtualized network functions (VNF) is an effective practice to deploy network services in network operator's data centers. Two common concerns arise in such a deployment are network load balancing and server load balancing. In this study, motivated by the argument that such two concerns should be jointly addressed for efficiently chaining VNFs in a data center environment, we propose a 2-phase algorithm, Nearest First and Local-Global Transformation (NF-LGT), which concurrently supports network and service load balancing. The algorithm firstly constructs service chains by a greedy strategy which both considers network latency and server latency. Then a searching technique is applied to improve the solutions. We have implemented the algorithm using Software-defined networking (SDN)/OpenFlow concept. The experimental results indicate that, compared with a sequential approach, NF-LGT improves the system bandwidth utilization up to 45%.

Using the data obtained from a battery monitoring unit (BMU) are a low-cost, easy-to-use way to estimate the power consumption of smartphones. Current online power estimation methods produce significant errors compared to using external power monitors because online methods do not address the three most important factors which affect the efficacy of online power consumption estimates. These are: (1) battery capacity degradation with aging, (2) asynchronous power consumption, and (3) the effect of state-of-charge (SoC) difference, the remaining power level of the battery. This paper presents a semi-online power estimate method which uses charging data to determine actual battery capacity, applies the discrepancy between battery voltage at different workloads for asynchronous power detection, and analyzes the range of SoC (0-100 percent) which causes minimal power estimate errors. The proposed method is validated by conducting a series of experiments on a smartphone and comparing the results with the existing online power estimation methods. Experimental results on the power consumption estimates of real applications indicate that the semi-online method reduced the error rate of power estimates obtained from existing online methods by 27-94 percent. Moreover, this work also shows that battery capacity degradation is the major factor affecting the efficacy of online power estimations.

Abstract It is a common practice to test a network device by replaying network traffic onto it and observe its reactions. Many replay tools support Transmission Control Protocol/Internet Protocol stateful traffic replay and hence can be used to test switches, routers, and gateway devices. However, they often fail if the device under test (DUT) is an application level proxy. In this paper, we design and implement ProxyReplay to replay application‐layer traffic for network proxies. As many application proxies have built‐in security functions, the main purpose of this tool is to evaluate the security functionalities of DUTs using payloads constructed from real network traces. ProxyReplay modifies requests and responses and maintains queues for request‐response pairs to resolve the issues of protocol dependency, functional dependency, concurrent replay, and error resistance. The solution provides two replay modes, that is, the preprocess mode and the concurrent mode. Depending on the benchmark scenario, we show that the preprocess mode is better for benchmarking the performance capability of a DUT. In contrast, the concurrent mode is used when the replayed trace file is extremely large. Our experiments show 99% accuracy. In addition, the replay performance exceeds 320 Mbps by running the benchmark with an off‐the‐shelf personal computer in the preprocess mode. Copyright © 2014 John Wiley & Sons, Ltd.

Abstract To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three‐phase behavior‐based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two‐phase detection scheme outperforms the one‐phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third‐phase classifier also distinguishes the known‐type malware with an accuracy of 85.8%. Copyright © 2015 John Wiley & Sons, Ltd.

Tag anti-collision has long been an important issue in RFID systems. To accelerate tag identification, some researchers have recently adopted bit tracking technology that allows the reader to detect the locations of collided bits in a collision slot. However, these methods still encounter the problem of too many collisions occurring at the beginning of identification. This paper proposes an optimal binary tracking tree protocol (OBTT) that tries to separate all of the tags into smaller sets to reduce collisions at the beginning of identification. Using bit tracking technology, OBTT mainly adopts three proposed approaches, bit estimation, optimal partition, and binary tracking tree. Bit estimation first estimates the number of tags based on the locations of collided bits. Optimal partition then determines the optimal number of the initial sets based on this estimation. Binary tracking tree lets the tag utilize one counter to achieve the split during the identification process. This paper formally analyzes the slot efficiency of OBTT, which represents how many tags can be identified in a slot. Results show that the slot efficiency is close to 0.614, the highest value published to date. Considering slot lengths, OBTT further determines the optimal number of the initial sets to minimize the identification delay. The analytical results show that the delay efficiency of OBTT achieves 0.750, where delay efficiency represents the number of tags that can be identified in a baseline slot, the length of which is the complete ID sent by the tag. The simulation results show that OBTT outperforms other existing algorithms.

ABSTRACT Dynamic analysis is typically performed in a closed network environment to prevent the malware under analysis from attacking machines on the Internet. However, many of today's malwares require Internet connectivity to operate and to be thoroughly analyzed in a closed network environment. We propose a secure and transparent network environment that allows the malware in a dynamic analysis environment to have seemingly unrestricted Internet access in a secure manner. Our environment transparently dispatches malicious network traffic to compatible decoys while allowing harmless control traffic to have Internet access. We use 12 real‐world malware samples, which involve Internet connections, to evaluate the effectiveness of the proposed environment. The evaluation shows that the proposed environment can allow malware to exhibit more network activities than a closed network environment and can even outperform the baseline open network environment in some cases. In the meantime, Internet security is maintained by the dispatching of attack and propagation traffic to decoys inside the analysis environment. Copyright © 2013 John Wiley & Sons, Ltd.

Testing network devices in a live environment is desirable due to its reality. However, the defects are not reproducible, and the network connectivity will be broken if the device is down. For effective defect reproduction from real traffic, we design a new mechanism, which allows the device under test (DUT) to be automatically online/offline, and supports multi-port replay for multi-port network devices with an OpenFlow switch. The defect traces are captured when the DUT is online. When a DUT failure is detected, the DUT will be offline, and the defect-triggering traces will be replayed to identify the defect. For efficient replay, we keep only partial payloads in a reduced number of packets in the defect traces that are sufficient to trigger the defects. For defect identification, reduction based on a binary search algorithm is presented to deal with the defects caused by payload anomalies and by overloading. The downsizing ratios in the cases of payload anomalies and overloading are up to 98.8% and 96%, respectively. The minimum outage time of the failover during the DUT failure is obtained when the check interval is 1 second and the number of tolerable consecutive failures is 2.

Automated GUI testing consists of simulating user events and validating the changes in the GUI in order to determine if an Android application meets specifications. Traditional record-replay testing tools mainly focus on facilitating the test case writing process but not the replay and verification process. The accuracy of testing tools degrades significantly when the device under test (DUT) is under heavy load. In order to improve the accuracy, our previous work, SPAG, uses event batching and smart wait function to eliminate the uncertainty of the replay process and adopts GUI layout information to verify the testing results. SPAG maintains an accuracy of up to 99.5 percent and outperforms existing methods. In this work, we propose smart phone automated GUI testing tool with camera (SPAG-C), an extension of SPAG, to test an Android hardware device. Our goal is to further reduce the time required to record test cases and increase reusability of the test oracle without compromising test accuracy. In the record stage, SPAG captures screenshots from device's frame buffer and writes verification commands into the test case. Unlike SPAG, SPAG-C captures the screenshots from an external camera instead of frame buffer. In the replay stage, SPAG-C automatically performs image comparison while SPAG simply performs a string comparison to verify the test results. In order to make SPAG-C reusable for different devices and to allow bettersynchronization at the time of capturing images, we develop a new architecture that uses an external camera and Web services to decouple the test oracle. Our experiments show that recording a test case using SPAG-C's automatic verification is as fast as SPAG's but more accurate. Moreover, SPAG-C is 50 to 75 percent faster than SPAG in achieving the same test accuracy. With reusability, SPAG-C reduces the testing time from days to hours for heterogeneous devices.

Tag anticollision has long been an important issue in RFID systems. To accelerate tag identification, some researchers have recently adopted bit tracking technology that allows the reader to detect the locations of collided bits in a collision slot. However, these methods still encounter the problem of too many collisions occurring at the beginning of identification. This paper proposes an optimal query tracking tree protocol (OQTT) that tries to separate all of the tags into smaller sets to reduce collisions at the beginning of identification. Using bit tracking technology, OQTT mainly adopts three proposed approaches, bit estimation, optimal partition, and query tracking tree. Bit estimation first estimates the number of tags based on the locations of collided bits. Optimal partition then determines the optimal number of the initial sets based on this estimation. Query tracking tree splits a set of collided tags into two subsets using the first collided bit in the tag IDs. This paper analyzes the efficiency of OQTT, which represents how many tags can be identified in a slot. Results show that its efficiency is close to 0.614, the highest efficiency published to date. The simulation results further show that OQTT outperforms other existing algorithms.

Many burst construction algorithms for Orthogonal Frequency Division Multiple Access (OFDMA) were proposed. However, these algorithms do not meet the uplink burst characteristics specified in the IEEE 802.16 standard. This paper therefore proposes the Best Sub channel Oriented algorithm (BSO). BSO not only complies with uplink burst characteristics, but also obtains high throughput by considering the issues of internal fragmentation, external fragmentation, and good-sub channels exploring. BSO shrinks the burst area to avoid internal fragmentation, if the requested bandwidth has been satisfied. BSO minimizes the external fragmentation by evaluating all divided bandwidth areas and shrinking the burst area to fit into a proper available bandwidth area if no available area can accommodate it. To explore the good sub channels, BSO analyzes the channel quality of sub channels and constructs the burst on the sub channels which provide largest throughput. The simulation results under a heavy load indicate that BSO achieves 2 times the throughput achieved by Raster, a conventional algorithm.

Real traffic replay is one of the solutions used to test network devices over complicated scenarios. Packet traces captured in a real environment hold more details than any mathematical models. However, the lack of packet-replay control and environment emulation might highly affect traffic behaviors, especially in wireless networks. Real traffic replay in wireless networks requires packet-replay control to manage the interactions with the device under test (DUT), and coordinately reproduces environment effects, such as fading, noise, and interference. In this work, we propose a method, called Event-driven Automata-synchronized Replay (EAR), to address real traffic replay over WLAN. EAR transforms the captured packet trace into a sequence of events that follow the IEEE 802.11 protocol. The three-level automata are applied to achieve packet-replay control and synchronize the environment effects in traffic replay with the packets and signals captured in a real environment. We propose a quantitative metric, called the event reproduction ratio (ERR), to evaluate the effectiveness of traffic replay. Our software implementation on the Linux-based system demonstrates that EAR achieves the ERR of 95.9% and 92.45% over the DUT-dependent traffic and fading environments, respectively. Under the same condition, the straight-forward replay can only produce the ERR of 20.6% and 0%, respectively.

How to accelerate tag identification is an important issue in Radio Frequency Identification (RFID) systems. In some cases, the RFID reader repeatedly identifies the same tags since these tags always stay in its communication range. An anticollision protocol, called the adaptive query splitting protocol (AQS), was proposed to handle these cases. This protocol reserves information obtained from the last process of tag identification so that the reader can quickly identify these staying tags again. This paper proposes two blocking protocols, a couple-resolution blocking protocol (CRB) and an enhanced couple-resolution blocking protocol (ECRB), based on AQS. CRB and ECRB not only have the above-mentioned capability as AQS but also use the blocking technique, which prohibits unrecognized tags from colliding with staying tags, to reduce the number of collisions. Moreover, CRB adopts a couple-resolution technique to couple staying tags by simultaneously transmitting two ID prefixes from the reader, while ECRB allows the reader to send only one ID prefix to interrogate a couple of staying tags. Thus, they only need half time to identify staying tags. We formally analyze the identification delay of CRB and ECRB in the worst and average cases. Our analytic and simulation results show that they obviously outperform AQS, and ECRB needs less transmitted bits than CRB.

Virus scanning involves computationally intensive string matching against a large number of signatures of different characteristics. Matching a variety of signatures challenges the selection of matching algorithms, as each approach has better performance than others for different signature characteristics. We propose a hybrid approach that partitions the signatures into long and short ones in the open-source ClamAV for virus scanning. An algorithm enhanced from the Wu-Manber algorithm, namely the Backward Hashing algorithm, is responsible for only long patterns to lengthen the average skip distance, while the Aho-Corasick algorithm scans for only short patterns to reduce the automaton sizes. The former utilizes the bad-block heuristic to exploit long shift distance and reduce the verification frequency, so it is much faster than the original WM implementation in ClamAV. The latter increases the AC performance by around 50 percent due to better cache locality. We also rank the factors to indicate their importance for the string matching performance.

Taint tracking is a novel technique to prevent buffer overflow. Previous studies on taint tracking ran a victim's program on an emulator to dynamically instrument the code for tracking the propagation of taint data in memory and checking whether malicious code is executed. However, the critical problem of this approach is its heavy performance overhead. This paper proposes a new taint-style system called Embedded TaintTracker to eliminate the overhead in the emulator and dynamic instrumentation by compressing a checking mechanism into the operating system (OS) kernel and moving the instrumentation from runtime to compilation time. Results show that the proposed system outperforms the previous work, TaintCheck, by at least 8 times on throughput degradation, and is about 17.5 times faster than TaintCheck when browsing 1KB web pages.

IEEE 802.16 technology is a promising technology to solve the last mile problem by its wireless, long distance, and high-bandwidth transmission. However, there isn't any suitable simulator to evaluate the performance between different IEEE 802.16 bandwidth allocation algorithms. In this paper, an IEEE 802.16 network simulator, Light WiMAX simulator (LWX), is proposed to provide flexible and robust functionalities for evaluating varies IEEE 802.16 bandwidth allocation algorithms. The contributions of LWX are (1) to support QoS, OFDMA, and multi-hop relay, (2) to provide a dynamic binding mechanism for the users to "plug-and-play" different algorithms without modifying and recompiling LWX, and (3) to supply the complete sample source codes and rich simulation scripts to let the users easily and quickly understand the architecture of LWX and integrate their works into LWX. Thus, it can benefit academic researchers and industrial developers to verify their designed algorithms and mechanisms.

False Positive (FP) and False Negative (FN) happen to every Intrusion Prevention System (IPS). No one could do better judgment than others all the time. This work proposes a system of Attack Session Extraction (ASE) to create a pool of suspicious traffic traces which cause potential FNs (abbreviated as P-FNs) and potential FPs (abbreviated as P-FPs) to IPSes. Developers of IPSes can use these suspicious traffic traces to improve the accuracy of their products. Traffic traces are called suspicious since what they cause are P-FNs and P-FPs which need to be confirmed by the developers of IPSes whether P-FNs are FNs and P-FPs are FPs. First, the ASE captures real traffic and replays captured traffic traces to multiple IPSes. By comparing the logs of IPSes, we can find that some attack logs are logged or not logged only at certain IPS. The former is P-FPs, while the latter is P-FNs to that IPS. The ASE then starts to extract this suspicious traffic from replayed traffic traces. The extracted traffic traces can then be used for further analysis by IPS developers. Some of the traces may prove to be guilty, i.e. confirmed to be FNs and FPs. To completely extract a suspicious session, the ASE uses an association mechanism based on anchor packets, five-tuple and time, and similarity for the first packet, first connection, and whole session, respectively. It calculates the degree of similarity among packets to extract a suspicious session containing multiple connections. We define variation and completeness/purity as the performance indexes to evaluate ASE. The experiments demonstrate that 95% of extracted sessions have low variation, and the average completeness/purity is around 80%.

Network processors can be categorized into two types, the coprocessors-centric model in which the data-plane is handled by coprocessors, and the core-centric model in which the core processes most of the data-plane packets yet offloading some tasks to coprocessors. While the former has been properly explored over various applications, researches regarding the latter remain limited. Based on the previous experience of prototyping the virtual private network (VPN) over the IXP425 network processor, this work aims to derive design implications for the core-centric model performing computational intensive applications. From system and IC vendors' perspectives, the continuous-time Markov chain and Petri net simulations are adopted to explore this architecture. Analytical results prove to be quite inline with those of the simulation and implementation. With subsequent investigation we find that appropriate process run lengths can improve the effective core utilization by 2.26 times, and by offloading the throughput boosts 7.5 times. The results also suggest single process programming since context switch overhead impacts considerably on the performance.

Home and office network gateways often employ a cost-effective embedded network processor to handle their network services. Such network gateways have received strong demand for applications dealing with intrusion detection, keyword blocking, antivirus and antispam. Accordingly, we were motivated to propose an appropriate fast scalable automaton-matching (FSAM) hardware to accelerate the embedded network processors. Although automaton matching algorithms are robust with deterministic matching time, there is still plenty of room for improving their average-case performance. FSAM employs novel prehash and root-index techniques to accelerate the matching for the nonroot states and the root state, respectively, in automation based hardware. The prehash approach uses some hashing functions to pretest the input substring for the nonroot states while the root-index approach handles multiple bytes in one single matching for the root state. Also, FSAM is applied in a prevalent automaton algorithm, Aho-Corasick (AC), which is often used in many content-filtering applications. When implemented in FPGA, FSAM can perform at the rate of 11.1Gbps with the pattern set of 32,634 bytes, demonstrating that our proposed approach can use a small logic circuit to achieve a competitive performance, although a larger memory is used. Furthermore, the amount of patterns in FSAM is not limited by the amount of internal circuits and memories. If the high-speed external memories are employed, FSAM can support up to 21,302 patterns while maintaining similar high performance.

Many network security applications rely on string matching to detect intrusions, viruses, spam, and so on. Since software implementation may not keep pace with the high-speed demand, turning to hardware-based solutions becomes promising. This work presents an innovative architecture to realize string matching in sub-linear time based on algorithmic heuristics, which come from parallel queries to a set of space-efficient Bloom filters. The algorithm allows skipping characters not in a match in the text, and in turn simultaneously inspect multiple characters in effect. The techniques to reduce the impact of certain bad situations on performance are also proposed: thebad-blockheuristic, a linear worst-case time method and a non-blocking interface to hand over the verification job to a verification module. This architecture is simulated with both behavior simulation in C and timing simulation in HDL for antivirus applications. The simulation shows that the throughput of scanning Windows executable files for more than 10000 virus signatures can achieve 5.64 Gb/s, while the worst-case performance is 1.2 Gb/s if the signatures are properly specified.

In an IEEE 802.16 network, mobile stations locating different places will encounter various interferences during transmission, leading that their communication channels experience different packet loss conditions and adopt suitable modulations. Thus, an excellent bandwidth allocation algorithm should not only satisfy various quality of services (QoS) required by heterogeneous traffic, but also consider the channel quality to maximize bandwidth utilization. In this paper, a bandwidth allocation algorithm with channel quality awareness and QoS guarantee, called CQQ, is proposed. Besides satisfying each connection's QoS requirement, CQQ raises the throughput by dynamically adjusting the downlink/uplink (DL/UL) bandwidth to match current DL/UL traffic and allocating more bandwidth to the connections having better channel quality. Simulation results demonstrate that CQQ provides lower delay violation ratio and higher goodput, comparing with the previous algorithms.

This paper addresses how to provide the proportional delay differentiation (PDD) in a wireless LAN (WLAN) and proposes a cross-layer fine-tuning scheduling (CFS) scheme with the goal to maintain PDD among all wireless stations while improving performance in a WLAN. CFS additionally considers the time-varying channel capacity to schedule packets, finely tunes the contention window, and properly arbitrates the backoff time. Also, it operates in a fully distributed manner among all stations and in a cross- layer approach in each station. The simulation results demonstrate that the CFS scheme can provide more satisfactory PDD and higher performance in a WLAN, compared with 802.11e.

This work tries to derive ideas for thread allocation in chip multiprocessor (CMP)-based network processors performing general applications by continuous-time Markov chain modeling and Petri net simulations. The concept of P-M ratio, where P and M indicate the computational and memory access overhead when processing a packet, is introduced and the relation to thread allocation is explored. Results indicate that the demand of threads in a processor diminishes rapidly as P-M ratio increases to 0.066, and decreases slowly afterwards. Observations from a certain P-M ratio can be applied to various software-hardware combinations having the same ratio.

Differentiated quality of service is a way for a website operator to provide different service levels to its clients. Traditional HTTP request scheduling schemes can achieve this, but they schedule requests to manage only one server resource, such as CPU or disk I/O. Actually, processing a request on the server will consume multiple resources. This paper presents a multiple-resource request scheduling algorithm, called mQoS, for differentiating the utilization of the server resource. The mQoS scheduler consists of several sub-schedulers and a main scheduler. Each sub-scheduler manages a server resource to differentiate its utilization among the classes. The main scheduler checks the availability of every server resource and triggers an appropriate sub-scheduler to balance the utilization of server resources. The implementation of the mQoS gateway is based on Squid and Linux. The evaluation compares the mQoS scheduling with no scheduling (nQoS) and single-re source request scheduling (sQoS). The mQoS scheduling reveals the accurate differentiation on every server resource. In addition, the total server throughput in the mQoS scheduling is improved by 21%, compared with the sQoS scheduling. The average user-perceived latency of the mQoS scheduling is also shorter than other scheduling.

The mobile WiMAX systems based on IEEE 802.16e-2005 provide high data rate for the mobile wireless network. However, the link quality is frequently unstable owing to the long-distance and air interference and therefore impacts real-time applications. Thus, a bandwidth allocation algorithm is required to be modulation-aware, while further satisfying the latency guarantee, service differentiation and fairness. This work proposes the Highest Urgency First (HUF) algorithm to conquer the above challenges by taking into consideration the adaptive modulation and coding scheme (MCS) and the urgency of requests. Downlink and uplink sub-frames are determined by reserving the bandwidth for the most urgent requests and proportionating the remaining bandwidth for others. Then, independently in the downlink and uplink, the HUF allocates bandwidth to every mobile station according to a pre-calculated U-factor which considers urgency, priority and fairness. Simulation results prove the HUF is modulation-aware and achieves the above three objectives, notably the zero violation rate within system capacity as well as the throughput paralleling to the best of the existing approaches.

Network processors can be categorized into two types, the coprocessors-centric model in which data-plane is handled by coprocessors, and the core-centric model in which the core processes most of the data-plane packets yet offloading some tasks to coprocessors. While the former has been properly explored over various applications, research regarding the latter remain limited. Based on the previous experience of prototyping the virtual private network (VPN) over the IXP425 network processor, this work aims to derive design implications for the core-centric model performing computational intensive applications. From system and IC vendors' perspectives, the continuous-time Markov chain and Petri net simulations are adopted to explore this architecture. Analytical results prove to be quite inline with those of the simulation and implementation. With subsequent investigation, we find that appropriate process run lengths can improve the effective core utilization by 2.26 times, and by offloading the throughput boosts 7.5 times. The results also suggest single-process programming, since context-switch overhead impacts considerably on the performance.

This work presents an in-kernel gateway architecture on Linux, namely kP2PADM, for managing P2P traffic on dynamic ports. This design can effectively eliminate redundant data passing between the kernel space and the user space. The management functions include: (1) classifying and filtering P2P traffic, (2) scanning viruses on shared files, (3) auditing chatting messages and transferred files, and (4) bandwidth control. Practical implementation issues and techniques in the system design are discussed herein. This design proposes a dual-queue architecture to handle packet reassembly and resolve head-of-line blocking. A connection cache accelerates handling the reconnection requests from the peers. The throughput can achieve up to 185.73 Mbps even with content filtering, and remains around 79.09 Mbps when virus scanning is enabled. The impacts of each management function and out-of-order packets on performance are also analyzed through the internal benchmarks.

The proportional delay differentiation (PDD) is one of the most well-known quality of service (QoS) models and has drawn much attention because of its ‘controllable’ and ‘predictable’ characteristics. How to provide PDD in a wireless LAN (WLAN) is addressed and a cross-layer fine-tuning scheduling (CFS) scheme with the goal to maintain PDD among all wireless stations is proposed, while improving performance in a WLAN. CFS additionally considers the time-varying channel capacity to schedule packets, finely tunes the contention window and properly arbitrates the backoff time. Also, it operates in a fully distributed manner among all stations and in a cross-layer approach in each station. The simulation results demonstrate that the CFS scheme can provide more satisfactory PDD and higher performance in a WLAN, compared with 802.11e.

We propose a new parallel automaton string matching approach and its hardware architecture for content filtering coprocessor. This new approach can improve the average matching time of the parallel automaton with pre-hashing and root-indexing techniques. The pre-hashing technique uses a hashing function to verify quickly the text against the partial patterns in the automaton, and the root-indexing technique matches multiple bytes for the root state in one single matching. A popular automaton algorithm, Aho-Corasick (AC) is chosen to be implemented by adding the two techniques; we employ these two techniques in a memory efficient version of AC namely bitmap AC. For the average-case time, our approach improves bitmap AC by 494% and 224% speedup for URL and virus patterns, respectively. Since pre-hashing and root-indexing techniques can be concurrently executed with bitmap AC in the hardware, our proposed approach has the same worst-case time as bitmap AC.

The queueing delay or loss rate is usually used as the performance metric for the real-time multimedia applications. In this paper, to provide more suitable quality of services (QoS) requirements of some applications, we propose a new performance metric, junk rate, where junk is the packet which queueing delay exceeds its time threshold. The model of proportional junk rate differentiation is also constructed to provide the predictable and controllable ratio of junk rates for different classes. Three schedulers, namely, proportional junk rate scheduler with infinite memory, proportional junk rate scheduler with memory M, average junk distance scheduler, are proposed to achieve this model. Simulation results show that three schedulers actually yield this model well.

Networking applications, such as VPN and content filtering, demand extra computing power in order to meet the throughput requirement nowadays. In addition to pure ASIC solutions, network processor architecture is emerging as an alternative to scale up data-plane processing while retaining design flexibility. This article, rather than proposing new algorithms, illustrates the experience in developing IPSec-based VPN gateways over network processors, and investigates the performance issues. The external benchmarks reveal that the system can reach 45 Mbps for IPSec using 3DES algorithm, which improves by 350% compared to single XScale core processor and parallels the throughput of a PIII 1 GHz processor. Through the internal benchmarks, we analyze the turnaround times of the main functional blocks, and identify the core processor as the performance bottleneck for both packet forwarding and IPSec processing.

The proportional delay differentiation (PDD) model provides a consistent packet delay differentiation between classes of service. So far, present schedulers performing the PDD model still cannot achieve desired delay proportion observed under light load, or in all timescales under moderate load. Thus, we propose a nonwork-conserving (NWC) scheduler, which utilizes the pseudo-waiting time for an empty queue and forces each class to compare its priority with those of all other classes. Simulation results reveal that NWC outperforms all current schedulers in achieving the PDD model.

The proportional delay differentiation model provides controllable and predictable delay differentiation, that is, the packet delay proportion between two classes of services is consistent on any measured timescale. Previous studies have focused on improving the accuracy of the achieved delay proportion-between classes, and have not considered reducing the packet queueing delay since these proposed scheduling algorithms are independent of the packet service time, such that the mean queueing delay is invariant, as specified by the conservation law. This paper proposes maximum WTP (MWTP), variance WTP (VWTP), and counting WTP (CWTP) schedulers, modified from the waiting-time priority (WTP) algorithm which is an excellent scheduler for performing proportional delay differentiation. All of the proposed schedulers account for the packet transmission time. Simulation results indicate that when the link utilization is moderate, the three schedulers not only yield a more accurate delay proportions than the WTP scheduler, regardless of whether the timescale is long or short, but also reduces the mean queueing delay.

With the rapid advance of network technologies over the past decade, more and more real-time multimedia applications, such as telephony and video conference, are widely deployed in the Internet. These multimedia applications are commonly implemented using UDP because some characteristics of TCP, for example, the burst transmission and frequent window variation, are not suitable for them. However, since UDP does not employ any congestion control, the unfair treatment towards TCP occurs. For these reasons, a new concept, "TCP-friendliness" is advocated. A TCP-friendly flow shares bandwidth similar to competing TCP flows. We present a new TCP-friendly congestion control, slack term, by patching TCP-friendly rate control (TFRC). Slack term limits the variation of sending rate to guarantee the smoothness, records the deficit or excess of bandwidth, and then returns it in the future to guarantee the friendliness. Simulation results show that our algorithm can enhance them with the smoother transmission rate and achieve the similar friendliness to TCP flows.

The proportional delay differentiation model provides a consistent packet delay differentiation between various classes of service. The waiting time priority (WTP) scheduler is a priority scheduler in which the priority of a packet increases in proportion to its waiting time, and it is known as the best scheduler to achieve proportional delay differentiation model. This paper proposes an advance WTP (AWTP) scheduler, modified from WTP, which accounts for the packet transmission time. Simulation results reveal that when the link utilization is moderate (60%-90%), this scheduler not only obtains more accurate delay proportion than the WTP scheduler, but also reduces the average queuing delay (waiting time). The effects of traffic load distribution are also examined. However, AWTP may not maintain stable delay ratios under various traffic load distributions. A modification named AWTP/sup +/ is proposed and proven to relieve this problem.

Current admission controls seeking to optimize network utilization create a bias against large-bandwidth calls. This paper proposes a BNP (buffer without preemption) model that will hold a call in a buffer rather than directly reject it when the residual bandwidth is insufficient. Such a mechanism increases throughput since the buffer can temporarily hold a call; it also reduces the bias for large-bandwidth calls since all calls are rejected when the buffer is not empty, even when the residual bandwidth suffices for small-bandwidth calls. The performance of the models is analyzed by solving a multi-dimensional Markov chain. A modified model, BNP/spl I.bar/W, in which a waiting threshold is added, is further offered to prevent an overlong wait for the queued call. Also, different thresholds for various bandwidth calls are set to maintain the optimal fairness. Analytical and numerical results demonstrate that this latter model actually achieves optimal fairness, even when the perfect fairness can not be achieved.

The advanced waiting time priority scheduler (AWTP), modified from the waiting time priority scheduler (WTP), was proposed to achieve proportional delay differentiation. AWTP not only achieves more accurate delay proportion than the WTP scheduler in short or long timescales, but also greatly reduces the overall queuing delay when the traffic load is moderate. In this paper, we find that AWTP cannot steadily keep the delay ratio under different traffic load distributions because its scheduling sometimes ignores considering packet waiting time. Thus, three remedied algorithms, named minus-WTP (MWTP), existing-WTP (EWTP), and counting-WTP (CWTP), are proposed to resolve this problem. All remedies simultaneously consider the packet waiting time and packet transmission time. Simulation results reveal that these modifications inherit the merit of AWTP and actually alleviate this side effect.

An admission control mechanism is performed while establishing a new connection to determine whether that connection should be admitted. Admittance depends on whether the QoS (quality of services) of this new connection can be supported and whether the QoS of the existing connections can be maintained. Various admission controls have been designed to improve network utilization. However, utilization optimization is the only goal, serious unfairness occurs among connections with different QoS requirements; that is, large-bandwidth connections are hardly admitted. A good admission control should achieve not only high utilization but also good fairness. This paper develops four novel measurement-based admission controls, namely, number guarantee, bandwidth segment, half partition, and request holding. Simulation results indicate that our proposed algorithms achieve a higher utilization and fairness than does the measure sum algorithm, presently the fairest known algorithm.

The evolution of TCP congestion control algorithms and underlying concepts of each algorithm are presented herein. According to their specific strategies, TCP algorithms are classified into four groups: Reno and NewReno, SACK and the variants, smooth-start and dynamic recovery (SSDR), and loss-avoidance algorithms. Numerous simulations are conducted to compare the performances of these TCP algorithms, and simulation results clearly indicate the merits and limitations of them. Comments are also presented to provide users and developers with a better understanding of these algorithms.

Many results indicate that TCP Vegas exhibits better throughput and higher stability than TCP Reno in homogeneous cases where a single version exists, but it performs poorly in heterogeneous cases where two versions coexist. Hence users are delaying, even protesting, the adoption of TCP Vegas. The difference in performance is due to the fact that Reno vibrates in the high throughput level and Vegas almost stabilizes in the low level. We propose two simple approaches to address this problem, the RED (random early discard) approach and parameter adjustments to Vegas. These approaches enable Vegas to achieve its fair share of bandwidth, even gaining an advantage over Reno, encouraging users to switch their TCP from Reno to Vegas.

Admission controls are required to determine whether new connections should be admitted to networks. These controls ensure the quality of service (QoS) for data transmission. This paper introduces three measurement-based admission control algorithms called Measured Sum, Hoeffding bound and Adaptive Weight Factor. The unfairness of these algorithms in a heterogeneous environment is investigated. Simulation results indicate the fairness of the Measured Sum exceeds that of the other methods. Connections with large peak rates or traveling many hops are difficulty admitted.

With the advances in switching technologies, explicit rate (ER) switches are becoming popular since they perform better than explicit forward congestion indication (EFCI) switches. In the transitional period, the EFCI and ER switches may coexist in the same ATM network. Hence the efficiency of various ER schemes should be considered in the mixed EFCI-ER environment, not only in the homogeneous ER environment. In this paper we describe five ER control mechanisms and compare their performance in the mixed EFCI-ER environment. Simulation results show that these algorithms can interoperate with the EFCI switches. However, the behavior of these ER schemes in the mixed EFCI-ER environment is sometimes different from that in the homogeneous ER environment. These ER schemes are re-evaluated based on their interoperability with EFCI schemes.

The paper presents a performance analysis of a rate-based congestion control mechanism. The switching capacity of the buffer is finite to reflect real conditions. Using a differential equation approach, we get the closed-form equations of cell loss probability, and utilization. Numerical results are given to show that our analysis is correct. In rate-based control, the important issue is how to determine congestion occurrence and congestion relief. The most common method is to set two thresholds of queue length, a high threshold and a low threshold. The values of these two thresholds seriously influence the system performance. Hence, we present the concept of best area to determine how to set the high and low thresholds to guarantee good performance, i.e., cell loss probability is zero and utilization is one, if it is possible. When good performance is not achieved due to too many connections or too large propagation delay, some rules are also given to prevent unnecessary cell-loss and under-utilization.

In this paper, we make a survey of distance vector multicast routing protocol (DVMRP) and find that it is not optimal in the aspect of network cost (NC). Therefore, we propose a modified version of DVMRP, called "group membership near first-DVMRP" (GMNF-DVMRP), to decrease the NC of the multicast tree formed by DVMRP. A simulation is implemented to compare our modified version and the original DVMRP. We find that our method save about 5-7 percent of NC of the multicast tree formed by DVMRP.

By assuming network traffic to be independent from each other, the analysis of network performance can be simplified. However, the real traffic sources may have some correlation which makes their behavior tend to converge or diverge. This phenomenon has a tremendous influence on congestion control. In this paper, we explain the possible reasons for correlated behavior, namely, top-down and client-server correlation, and analyze their impacts. We also use the rapid matrix-geometric solution to investigate the cost to pay when applying the leaky bucket input control scheme to the independent traffic sources (e.g. Poisson) and the correlated traffic sources (such as on-off and HAP (hierarchical arrival process)).

Recent advances in cable TV networks and multimedia technologies open the possibilities for network/service/content providers to offer residential customers with video-on-demand services. However, the mass storage system in supporting such services demands proper organization and management. We present a three-level hierarchical network storage architecture for the video-on-demand storage system. At the first-level (local service center, LSC) a limited number of programs with high viewing probabilities are stored while at the second-level (local central service center, LCSC) a few programs with second high viewing probabilities are stored. The third-level (central service center, CSC) contains all programs provided in the system. Based on this architecture and the program viewing probability distribution function, we use a minimum-cost function to find out the number of programs stored in the two service centers (LSC and LCSC) and the number of links among these three service centers. We also describe two program reallocation algorithms which swap programs between service centers according to the change in user request patterns.