We revisit the long-standing problem of providing network QoS to applications, and propose the concept of judicious QoS - combining the cheaper, best effort IP service with the cloud, which offers a highly reliable infrastructure and the ability to add in-network services, albeit at higher cost. Our proposed J-QoS framework offers a range of reliability services with different cost vs. delay trade-offs, including: i) a forwarding service that forwards packets over the cloud overlay, ii) a caching service, which stores packets inside the cloud and allows them to be pulled in case of packet loss or disruption on the Internet, and iii) a novel coding service that provides the least expensive packet recovery option by combining packets of multiple application streams and sending a small number of coded packets across the more expensive cloud paths. We demonstrate the feasibility of these services using measurements from RIPE Atlas and a live deployment on PlanetLab. We also consider case studies on how J-QoS works with services up and down the network stack, including Skype video conferencing, TCP-based web transfers and cellular access networks.

Many popular cloud applications use inter-data center paths; yet, little is known about the characteristics of these ``cloud paths''. Over an eighteen month period, we measure the inter-continental cloud paths of three providers (Amazon, Google, and Microsoft) using client side (VM-to-VM) measurements. We find that cloud paths are more predictable compared to public Internet paths, with an order of magnitude lower loss rate and jitter at the tail (95th percentile and beyond) compared to public Internet paths. We also investigate the nature of packet losses on these paths (e.g., random vs. bursty) and potential reasons why these paths may be better in quality. Based on our insights, we consider how we can further improve the quality of these paths with the help of existing loss mitigation techniques. We demonstrate that using the cloud path in conjunction with a detour path can mask most of the cloud losses, resulting in up to five 9's of network availability for applications.

We make a case for judicious use of cloud infrastructure -- as an overlay to aid IP's best effort service. As an example, we propose ReWAN, a packet recovery service for real time, wide area communication. ReWAN uses cloud-based edge proxies that exchange "recovery" packets, which are used only in case of packet loss. ReWAN leverages the cloud provider's well-connected, global data center network, and its ability to handle many concurrent users. To minimize bandwidth cost, it uses coding to generate a small number of recovery packets that are sent across the inter data center network. The recovery packets use both FEC, which is applied within a user stream, and network coding, which is applied across user streams. If a small fraction of packets within the user stream are lost, ReWAN uses the FEC packets for recovery; for other losses, ReWAN recovers them with the help of other receivers and the network coded packets. Preliminary measurements show the promise of ReWAN in providing a fast and cost effective packet recovery service.

Infected machines pose threats to not only their users, but also their network owners (ISPs and enterprises). To neutralize the effect of these infected machines, common solutions span two ends of an architectural spectrum; either fully distributed solutions that are host-based, or completely centralized appliances at the network core. We present NetworkRadar, inspired by an SDN-enabled ISP framework, that operates in between these extremes and contains the benefits of both these approaches. We perform data-plane intensive event monitoring at aggregation points close to customers, and maintain a centralized control plane for correlating and high-granularity blocking of malicious bot activity. Here we present the architecture of our solution and evaluate a prototype deployment over an isolated slice of an ISP network, showing its viability due to a negligible (<;1%) impact on customer throughput and its control plane scaling linearly to the customer base.

Botnets are an evolutionary form of malware, unique in requiring network connectivity for herding by a botmaster that allows coordinated attacks as well as dynamic evasion from detection. Thus, the most interesting features of a bot relate to its rapidly evolving network behavior. The few academic and commercial malware observation systems that exist, however, are either proprietary or have large cost and management overhead. Moreover, the network behavior of bots changes considerably under different operational contexts. We first identify these various contexts that can impact its fingerprint. We then present Titan: a system that generates faithful network fingerprints by recreating all these contexts and stressing the bot with different network settings and host interactions. This effort includes a semi-automated and tunable containment policy to prevent bot proliferation. Most importantly, Titan has low cost overhead as a minimal setup requires just two machines, while the provision of a user-friendly web interface reduces the setup and management overhead. We then show a fingerprint of the Crypto locker bot to demonstrate automatic detection of its domain generation algorithm (DGA). We also demonstrate the effective identification of context specific behavior with a controlled deployment of Zeus botnet.