Federico Errica, Davide Sanvito, Giuseppe Siracusano, Roberto Bifulco. Proceedings of the 2025 Conference of the Nations of the Americas Chapter of the Association for Computational Linguistics: Human Language Technologies (Volume 1: Long Papers). 2025.

Behavioural analysis based on filesystem operations is one of the most promising approaches for the detection of ransomware. Nonetheless, tracking all the operations on all the files for all the processes can introduce a significant overhead on the monitored system. We present MUSTARD, a solution to dynamically adapt the degree of monitoring for each process based on their behaviour to achieve a reduction of monitoring resources for the benign processes.

Abstract Ideally, the network should be dynamically reconfigured as traffic evolves. Yet, even within the software defined network paradigm, network reconfigurations cannot be too frequent due to a number of reasons related to route consistency, forwarding rules instantiation, individual flows dynamics, traffic monitoring overhead, and so on. In this paper, we focus on the fundamental issue of deciding whether, when, and how to reconfigure the network while traffic evolves. We consider a problem of optimizing semi‐stable routing in the capacitated multicommodity flow network when one may use at most a given maximum number of routing configurations (called routing clusters) and when each routing configuration must be used for at least a given minimum amount of time. We propose an efficient solution approach based on routing cluster generation that provides a tight lower bound on the minimum of a selected objective function (like maximum link delay or a sum of link delays) and suboptimal solutions very close to the calculated bound. The approach scales well with the size of the network.

Data-center topologies interconnect an ever larger number of servers using a high number of alternative paths to provide high bandwidth and a high degree of resiliency. The state-of-the-art routing strategy is based on Equal-cost multipath (ECMP) which employs static hashing mechanism over packet header fields to spread the traffic over multiple paths. Routing the traffic without considering the size of the flows and the utilization of the paths might cause congestion due to the collision of multiple large flows on a same downstream path. We present CEDRO, an in-switch mechanism to detect and reschedule colliding large flows. By exploiting the latest advances in SDN programmable network devices, we offload to the network the detection of both the elephant flows and the path congestion conditions and the rescheduling mechanism. CEDRO is able to promptly cope with path congestion and failures directly from the dataplane, regardless of the availability of the external controller. We implemented CEDRO in an emulated SDN network and tested it against realistic traffic scenarios. Numerical evaluation shows CEDRO is able to improve the average and 95-th percentile of the Flow Completion Time compared to ECMP.

Ideally, the network should be dynamically reconfigured as traffic evolves. Unfortunately, even in SDN paradigm, network reconfigurations cannot be too frequent due to a number of reasons related to route stability, forwarding rules instantiation, individual flows dynamics, traffic monitoring overhead, etc. In this paper, we focus on the fundamental problem of deciding whether, when, and how to reconfigure the network during traffic evolution. We consider a problem of optimizing semi-stable routing in the capacitated multicommodity flow network when one may use at most a given maximum number of routing configurations (called clusters) and when each routing configuration must be used for at least a given minimum amount of time. We propose a solution method based on cluster generation that provides a good lower bound on the minimum network delay (i.e., the total of link delays) and scales well with the size of the network.

Traffic classification allows network operators to gain important insights to better characterize packet flows, enabling fundamental applications such as traffic engineering, network analytics and Quality of Service (QoS) enforcing. A common approach adopted for flow classification is based on Deep Packet Inspection (DPI): all the traffic is processed by a middlebox whose task is the association of a network flow to the application-level information by inspecting the entire content of the packets. The increased volume of encrypted traffic limits the type of analysis performed by network middleboxes. However, an important amount of information can still be extracted from packets belonging to the very initial phase of a connection which are transmitted in clear (e.g. DNS and TLS handshake). Furthermore, recent research work has shown that it is possible to reduce the burden on the DPI without a significant loss in classification accuracy, by limiting the amount of data processed per flow. In this paper, we propose to exploit the programmability of new stateful SDN data planes to offload down to the network the process of filtering traffic to the DPI. We show that it is jointly possible to reduce the required computing power of the DPI, as well as the network bandwidth between the switches and the DPI. By taking advantage of the flexibility of stateful data planes we also manage to delegate to switches the computation of useful network analytics metrics (such as number of packets, number of bytes and duration) which would otherwise require the DPI to inspect the entire traffic flow.

We propose a method for classifying Wi-Fi enabled mobile handheld devices (smartphones) and non-handheld devices (laptops) in a completely passive way, that is resorting neither to traffic probes on network edge devices nor to deep packet inspection techniques to read application layer information. Instead, classification is performed starting from probe requests Wi-Fi frames, which can be sniffed with inexpensive commercial hardware. We extract distinctive features from probe request frames (how many probe requests are transmitted by each device, how frequently, etc.) and take a machine learning approach, training four different classifiers to recognize the two types of devices. We compare the performance of the different classifiers and identify a solution based on a Random Decision Forest that correctly classify devices 95% of the times. The classification method is then used as a pre-processing stage to analyze network traffic traces from the wireless network of a university building, with interesting considerations on the way different types of devices uses the network (amount of data exchanged, duration of connections, etc.). The proposed methodology finds application in many scenarios related to Wi-Fi network management/optimization and Wi-Fi based services.