Sketch-based solutions are widely used to estimate item frequencies in infinite data streams.Traditional hand-crafted sketches face the bottleneck of further eliminating errors because they cannot fully utilize the data stream distribution.Although recent neural sketches represented by MetaSketch and LegoSketch have improved generalization capabilities, they face bottlenecks such as high computational overhead and parameter sensitivity.Meanwhile, they ignore load information, fail to fully utilize the local information in hand-crafted sketches, and do not focus on the frequent items that are usually more important in data streams.In this paper, we propose RatioSketch, a novel lightweight neural network correction framework that synergizes the advantages of hand-crafted sketches and neural sketches in a ``micro-correction'' paradigm.The key idea is to retain the efficient underlying data structure of the hand-crafted sketch and to build a neural correction layer in its output space. We select multiple representative hand-crafted sketches as use cases to study the correction performance of RatioSketch on them.Extensive experimental evaluations on several real-world datasets show that RatioSketch-corrected sketches achieve consistently higher estimation accuracy than their uncorrected counterparts, as well as outperforming neural baselines such as MetaSketch and LegoSketch under identical memory budgets.

Today's fast-growing Video-on-Demand (VoD) service needs efficient content delivery to guarantee the user experience. To reduce costs, the industry has been exploring the adoption of unstable, heterogeneous, low-performance edge nodes as cost-efficient alternatives to expensive CDN servers. To compensate for the resulting degradation in user experience, Multi-source Parallel Downloading (MPD) is becoming a new VoD transport paradigm. However, existing transport optimization solutions face performance obstacles when applied to the MPD scenarios. They cannot handle the contention between MPD flows of the same download task, which is likely to occur at the shared last-hop, and lack the ability to quickly adapt to the unstable network environments brought by dynamic, heterogeneous, and low-performance edge nodes. To fill this gap, we propose Hermit, a VoD-oriented MPD transport algorithm. Hermit (1) continuously monitors the state of the flows and makes timely scheduling decisions, and (2) efficiently coordinates across the flows to mitigate self-contention at the shared last hop. As a client-driven scheme, Hermit does not require cumbersome coordination among edge nodes, nor does it increase server complexity. Through extensive experiments on real-world large-scale testbed and locally emulated network conditions, we demonstrate that Hermit can improve the consistent downloading rate by 9.2% to 21.3%.

Emerging high-quality real-time applications require consistently low latency, which is often disrupted by latency spikes. We identify the reason as the mismatch between the abrupt bandwidth reallocation on routers and gradual sending rate reaction of congestion control. For example, when a burst of new flows arrives, queue schedulers such as fair queueing immediately reallocate the bandwidth for existing and new flows. However, the flow's sending rate, determined by the congestion control algorithm (CCA), needs several RTTs to converge to the new available bandwidth, during which severe stalls occur. This has been increasingly critical with the demand on consistent low latency. In this paper, we present Confucius, a practical queue management scheme that reallocate the bandwidth for flows following CCA's reaction. Confucius slows down bandwidth adjustment to match the reaction of congestion control, so that the end host can reduce the sending rate without overshooting the network. Confucius is designed for offering real-time flows with consistently low latency regardless of uncertain competition. Experiments show that Confucius reduces the stall duration by more than 50% against existing practical schemes, while competing flows also fairly enjoy on-par performance.Available at: https://github.com/hkust-spark/confucius-qdisc

Real-time communication (RTC) applications demand not only low average latency but also tight tail-delay bounds to ensure smooth user experience. However, sudden fluctuations in wireless networks can cause in-flight packets to accumulate in bottleneck queues, delaying or invalidating subsequent frames. Traditional mechanisms focus on rate adaptation but largely overlook managing already enqueued packets that contribute to tail delay. We present Gecko, a lightweight end-to-network coordination mechanism that enables frame-aware queue flushing without requiring any in-network packet modification or protocol negotiation. Gecko-enabled routers monitor queuing delay and implicitly signal the sender, which then makes frame-skipping decisions and conveys flushing intent through minimal in-band RTP markings. This approach preserves end-to-end integrity and is broadly compatible with existing RTC applications. We evaluate Gecko via trace-driven simulations and real-world experiments. Results show that Gecko reduces average frame delay by 21.8% and cuts tail-delay frame ratios by 25% to 91%, demonstrating both its effectiveness and deployability in wireless RTC environments.

LLM supporting long contexts faces a critical memory bottleneck due to the linear growth of KV cache. Distributing the storage across multiple GPUs alleviates this burden but introduces significant communication overhead or traffic incast, especially during the decoding phase. We propose Turbo, a first-of-its-kind in-network aggregation system that accelerates long-context inference by offloading query broadcast and attention aggregation to switches. We address three key challenges to map complex attention mechanisms onto restricted switch hardware: (i) To bypass the switch's inability to buffer global states or perform complex operations, we devise online table-based aggregation, which decomposes global reduction into pairwise operations and approximates nonlinear functions via lookup tables. (ii) To circumvent the restriction on retroactive state access in RMT pipelines, we introduce a rolling forward scheme that propagates states to enable cross-stage updates. (iii) To mitigate aggregation stragglers caused by topology-induced load imbalance, we construct a load-aware aggregation tree that optimizes workload distribution. Evaluations on a Tofino2-based testbed show that Turbo reduces end-to-end inference latency by up to 37%. Large-scale simulations on NS-3 demonstrate that Turbo significantly outperforms state-of-the-art baselines in both inference latency and network traffic reduction with negligible accuracy loss.

In the modern internet, with the proliferation of real-time applications such as online gaming and video conferencing, the timely detection of network jitter has become a critical task in network measurement. Network jitter is defined as the abrupt fluctuations in packet inter-arrival times within network flows, which severely degrade the Quality of Service for these applications. Traditional jitter detection methods primarily focus on macro-level end-to-end or hop-by-hop latency variations, neglecting the fine-grained jitter that occurs within specific flows. In this paper, we present JitterSketch, the first sketch-based algorithm specifically designed for detecting jittery flows. JitterSketch employs a novel three-stage structure to efficiently filter out infrequent and stable flows, thereby identifying and reporting the jittery flows that have the most significant impact on network quality. Extensive experiments demonstrate that JitterSketch achieves an improvement of up to 50 percentage points in both recall and precision rates compared to baseline solutions, while maintaining high processing throughput. Furthermore, we deployed JitterSketch in a QoS simulation system, where it yielded significant improvements in QoS.

Efficient data stream processing, particularly for persistence estimation, is crucial in handling high-velocity data streams characterized by skewed distributions of item frequencies. Unlike more straightforward frequency metrics, persistence captures items' recurrence across multiple time windows, posing a significant challenge to existing single-structure sketches where high-persistence and low-persistence items collide. To address this, we introduce the Hypersistent Sketch, a unified framework for high-performance estimation built on two decoupled mechanisms: filtering and accelerating. The filtering component, a Cold Filter, directly addresses the skewed nature of data streams. It separates hot items from the majority of cold ones, which allows for differential treatment. The accelerating component, a Burst Filter, then optimizes the processing of hot items. It significantly improves throughput by preventing repeated insertions within a single window. We demonstrate its generality by applying it to various state-of-the-art sketches (e.g., On-Off, Waving, P-Sketch), showing it consistently enhances their original performance. We also deploy our framework on Redis platforms, demonstrating the framework’s broad applicability and scalability.

Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting (WF) attacks have demonstrated effectiveness even against Tor-protected network traffic. However, existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions, where the holistic pattern of individual websites is no longer preserved, and the number of tabs opened by a client is unknown a priori. In this paper, we propose ARES, a novel WF framework natively designed for multi-tab WF attacks. ARES formulates the multi-tab attack as a multi-label classification problem and solves it using the novel Transformer-based models. Specifically, ARES extracts local patterns based on multi-level traffic aggregation features and utilizes the improved self-attention mechanism to analyze the correlations between these local patterns, effectively identifying websites. We implement a prototype of ARES and extensively evaluate its effectiveness using our large-scale datasets collected over multiple months. The experimental results illustrate that ARES achieves optimal performance in several realistic scenarios. Further, ARES remains robust even against various WF defenses.

Serverless computing, or Function-as-a-Service, continues to gain popularity due to its pay-as-you-go billing model, flexibility, and cost efficiency. However, these same features introduce significant security risks, such as the Denial-of-Wallet (DoW) attack. In this paper, we conduct real-world DoW attacks on commercial serverless platforms to evaluate their severity. To detect such attacks, we design, implement, and evaluate Clover, an accurate and user-friendly DoW detection system with negligible performance overhead. Clover addresses information ambiguity in serverless environments by deploying a request-oriented metric collection agent. At its core, Clover proposes a workload verification approach to bridge performance metrics and execution duration. Specifically, Clover uses a multivariate linear model to learn the benign relationship between metrics and execution duration, effectively characterizing normal workload behavior. It then continuously monitors runtime workloads by calculating their Mahalanobis distance from this learned benign model. Deviations identified through this distance indicate potential DoW attacks. Implemented as a practical system, Clover introduces performance overhead of less than 3.2%, maintains an average model execution time of only 0.84 microseconds, and achieves an accuracy of 92.7% under the most challenging scenario.

Resource Public Key Infrastructure (RPKI) aims to prevent prefix hijacking by providing secure mappings between IP prefixes and their authorized origin Autonomous Systems (ASes). In recent years, there has been notable growth in the deployment of RPKI and Route Origin Validation (ROV). Nonetheless, over 40% of the routes in the global routing table still lack the protection of RPKI. One of the critical reasons some networks are reluctant to deploy RPKI is the concern that some ROV-invalid routes may be legitimate, and filtering these routes will harm network service quality, especially affecting network connectivity.

Collaborative graph processing refers to the joint analysis of inter-connected graphs held by multiple graph owners. To honor data privacy and support various graph processing algorithms, existing approaches employ secure multi-party computation (MPC) protocols to express the vertex-centric abstraction. Yet, due to certain computation-intensive cryptography constructions, state-of-the-art (SOTA) approaches are asymptotically suboptimal, imposing significant overheads in terms of computation and communication. In this paper, we present RingSG, the first system to attain optimal communication/computation complexity within the MPC-based vertex-centric abstraction for collaborative graph processing. This optimal complexity is attributed to Ring-ScatterGather, a novel computation paradigm that can avoid exceedingly expensive cryptography operations (e.g., oblivious sort), and simultaneously ensure the overall workload can be optimally decomposed into parallelizable and mutually exclusive MPC tasks. Within Ring-ScatterGather, RingSG improves the concrete runtime efficiency by incorporating 3-party secure computation via share conversion, and optimizing the most cost-heavy part using a novel oblivious group aggregation protocol. Finally, unlike prior approaches, we instantiate RingSG into two end-to-end applications to effectively obtain application-specific results from the protocol outputs in a privacy-preserving manner. We developed a prototype of RingSG and extensively evaluated it across various graph collaboration settings, including different graph sizes, numbers of parties, and average vertex degrees. The results show RingSG reduces the system running time of SOTA approaches by up to 15.34× and per-party communication by up to 10.36×. Notably, RingSG excels in processing sparse global graphs collectively held by more parties, consistent with our theoretical cost analysis.

The feature extractor component in today's ML-based traffic analysis applications is becoming a key bottleneck. While mainstream software-based approaches can support flexible feature extraction, they fail to scale to multi-100Gbps network speed easily. Meanwhile, hardware-accelerated solutions can scale to high throughput, but cannot flexibly support generic traffic analysis applications. In this paper, we propose SuperFE, a feature extraction framework that allows users to extract traffic features efficiently and flexibly. SuperFE leverages the capabilities of both new-generation programmable switches and SmartNICs, with three key designs. First, SuperFE presents a user-friendly and extensible interface to support customized feature extraction policies, shielding underlying hardware implementation details and complexities. Second, SuperFE introduces a high-performance multi-granularity key-vector cache system in the programmable switches to batch necessary feature metadata for massive amounts of packets. Third, SuperFE exploits the multi-core parallel and hierarchical memory of SoC-based SmartNICs to achieve efficient feature computation with diverse streaming algorithms. Evaluations using our prototype demonstrate that SuperFE enables various state-of-the-art traffic analysis applications to efficiently extract features from multi-100Gbps raw traffic without compromising detection accuracy, and achieves nearly two orders of magnitude higher throughput than the software-based counterparts.

As model sizes continue to grow and the capacity of a single data center becomes insufficient, training models across multiple data centers efficiently is becoming increasingly important. In this paper, we first show that existing parallelism strategies perform poorly under limited bandwidth and high latency of cross-DC links. To address this, we propose JEEVES, a framework that extends the pipeline parallelism across DCs to minimize iteration time under memory constraints. We identify that the key lies in a good schedule of computation and communication, and propose communication-aware schedule, memory-aware stage division and inter-replica coordinated schedule. Simulations show that JEEVES improves iteration time by up to 43% when training a 175B-parameter model.

Efficient data stream processing, particularly for persistence estimation, is crucial in handling high-velocity data streams characterized by skewed distributions of item frequencies. Unlike more straightforward frequency metrics, persistence captures items' recurrence across multiple time windows, requiring nuanced processing approaches. In response, we introduce the Hypersistent Sketch, an algorithm that significantly enhances persistence estimation through innovative filtering techniques. Our design incorporates a Cold Filter to address the skewed nature of data streams where a few high-frequency (hot) items dominate. This filter allows for differential treatment by using smaller counters for most low-frequency (cold) items, thus conservatively allocating memory resources that would otherwise be sized uniformly based on hot items. However, the Cold Filter can reduce throughput due to its segregative processing. To mitigate this, we implement a Burst Filter, which optimizes the processing of hot items. The Burst Filter significantly improves throughput by preventing repeated insertions within a single window—where persistence increases by at most one—and deferring the insertion until the window's end. Comparative evaluations demonstrate that the Hypersistent Sketch outperforms existing solutions like the On-Off Sketch, offering up to 3 times improved throughput while maintaining competitive accuracy and substantially reducing memory usage in handling large-scale data streams.

BGP, the Internet’s inter-domain routing protocol, is vulnerable to prefix hijacks due to tamperable prefix–origin bindings. RPKI addresses this by cryptographically binding prefixes to authorized ASes, enabling Route Origin Validation (ROV). Given RPKI’s critical role in Internet security, identifying the proportion of ASes that deploy ROV is a key research question. However, measuring ROV deployment is difficult due to limited visibility into private AS configurations. Existing methods suffer from low accuracy, restricted coverage, and the inability to detect hidden ASes whose behavior is masked by upstream ROV deployment. To address these limitations, we propose RIFT, a novel inference method based on temporal fingerprinting. RIFT leverages the insight that periodic ROA retrieval creates distinctive temporal patterns in the routing behavior of ROV-deployed ASes. Experiments show that RIFT achieves 94% accuracy and an F1 score of 0.88 in identifying ROV deployment.

QUIC gains significant attention due to its superior transmission performance, achieving widespread adoption in both academia and industry. To improve round-trip time (RTT) estimation, QUIC introduces the Host Delay field, enabling senders to exclude receiver-induced delays. Many delay-based congestion control algorithms (CCAs) rely on these RTT estimates to detect congestion and regulate sending rates. However, we find that malicious Host Delay values can distort RTT measurements, causing inappropriate rate adjustments by CCAs.In this paper, we investigate a new class of attacks leveraging maliciously crafted Host Delay values. To our knowledge, we are the first to analyze the vulnerability of Host Delay and present QUDIT, a universal receiver-driven attack targeting delay-based QUIC CCAs. Unlike prior attacks that presume full network queuing delays visibility and undetected injection capabilities, our attacker model only grants the adversary access as a standard QUIC receiver with limited knowledge of bottleneck conditions. We minimally modify the QUIC receiver to infer bottleneck queuing behavior in real time. Based on these inferences, we design dynamic Host Delay crafting strategies tailored to the specific behavior of various delay-based CCAs and accounting for random network fluctuations. Our attack prompts the sender to overshoot its rate, leading to excessive bandwidth consumption at the bottleneck and degradation of competing flows. Results demonstrate the throughput degradation of victim flow achieves up to 60% within 0.3 s and amplification gains between 200× and 600×. We propose defenses mitigating QUDIT, with vulnerabilities reported to IETF and QUIC maintainers.

The detection of Heavy Hitters (HH) of flows in a network plays a crucial role in a variety of critical applications, including network topology optimization, congestion control, and network security (e.g., DDoS mitigation). In high-performance data centers, tasks such as optimizing model training and detecting anomalies require microsecond-level granularity for burst and congestion detection, demanding higher accuracy and fine granularity in HH detection. However, existing HH detection schemes primarily focus on traffic accumulation over longer periods and ignore instantaneous flow rates, making them incapable of detecting short-duration heavy hitters (at the granularity of milliseconds to microseconds) that can significantly affect network performance. This paper proposes a rate-sensitive definition of HHs and introduces HeavyFinder, a framework for enabling efficient HH detection of flows at microsecond granularity and accurately describing their traffic changes. It detects HHs based on inherent characteristics of both traffic volume and instantaneous flow rates, and improves the existing elephant flow filtering mechanism. Furthermore, this framework provides an efficient information aggregation method for reporting HH information, which can reduce overhead further. We deployed and tested HeavyFinder on x86 CPUs and evaluated its performance by using real network trace data. Results show that HeavyFinder achieves sub-$\mathbf{1 0}$-microsecond accuracy in detection for the start and end times of HHs, with$3-10 \times$lower reporting overhead compared to existing frameworks.

Quantile estimation is critical for diverse applications, including database management and network traffic monitoring. Probabilistic quantile sketches are widely employed in practice, with the KLL sketch (introduced in 2016) being particularly notable for its theoretically space-optimal properties. However, KLL overlooks the inherent repetition of elements often present in real-world data streams. Such streams are frequently highly skewed, characterized by ''hot items''-items that appear with high frequency. The KLL sketch processes these hot items without accounting for their prevalence, resulting in suboptimal space utilization due to redundant insertions and storage. To overcome this limitation, we propose Cooled-KLL, an enhanced KLL sketch. Cooled-KLL introduces a novel ''Hot Filter'' structure that efficiently identifies and stores hot items as compact key-value pairs. This mechanism ensures that only ''cold'' (less frequent) items are subsequently processed by the core KLL sketch. Our approach significantly reduces memory consumption without compromising processing speed. Extensive experiments demonstrate that Cooled-KLL consistently outperforms five other state-of-the-art algorithms, achieving up to 2.5 orders of magnitude higher accuracy compared to the standard KLL sketch.

In recent years, sketching has emerged as a pivotal technique for identifying heavy hitters (items with high frequency) in large-scale data streams. Despite this progress, the majority of existing sketch algorithms are tailored primarily for detecting local heavy hitters within a single data stream, with only a few capable of extending their application to global heavy hitters across distributed data streams. A common challenge encountered by these algorithms is balancing performance with accuracy. To address this challenge, we introduce HeavyLocker, a novel sketch algorithm that takes advantage of a distinct feature of real data streams: the separability of heavy hitters. By leveraging this attribute, HeavyLocker precisely locks and protects potential heavy hitters during the data stream processing, ensuring accuracy in local heavy hitter detection without compromising on speed. This unique capability also facilitates its application to global detection tasks. Through theoretical analysis, we validate the efficacy of HeavyLocker's locking mechanism. Our extensive experiments show that HeavyLocker outperforms five benchmarked algorithms in accuracy and maintains fast speed for both local and global heavy hitter detection, significantly reducing errors by up to an order of magnitude compared to the renowned Double-Anonymous Sketch.

Serverless computing has become a promising paradigm for video processing workflows, offering simplified deployment and flexible management of business logic. However, the dynamic, multi-stage nature of video processing pipelines poses significant challenges for traditional serverless resource management, particularly in efficiently modeling optimal configurations and adapting to rapidly evolving pipeline structures. To address this challenge, we propose ConfigNavigator, a video pipeline resource tuning framework capable of adapting to dynamic inputs and pipeline structures with minimal overhead. In the offline phase, ConfigNavigator models function execution time distributions at the fundamental operation level and leverages graph theory to decompose complex video processing pipelines, thereby obtaining optimal configurations with minimal overhead. In the online phase, it dynamically adjusts function configurations on critical paths through real-time performance feedback, ensuring pipeline performance stability across varying workloads. We evaluate ConfigNavigator using real video streams on the commercial serverless platform AWS Lambda. Compared to state-of-the-art baselines, ConfigNavigator reduces configuration search time by 94.11% while decreasing end-to-end pipeline processing time by 13.97%.

Today's real-time communication (RTC) application requires consistent low latency to ensure the user experience. Many end-to-end rate control, as well as in-network active queue management (AQM) methods, have been designed to improve transport latency. However, most of previous work can only address the network issues in a reactive way - packets during the reaction time are still stuck on the way. No matter how fast the sender reacts to network changes in existing schemes, there will still be packets jammed in the network and increases the latency. To enhance the transport performance in wireless network and improve the user experience of RTC application, we propose Gecko, a practical application-oriented end-to-network collaboration scheme. Gecko can efficiently detect and process the congestion signal, early and proactively draining the jammed packets in the bottleneck queue. We conduct both trace-driven simulations and real-world experiments to evaluate the performance of our scheme. Gecko can reduce the overall frame delay by 21.8 % and reduce tail-delay frame ratio by 25% to 91% in our experiments.

The performance of collective communication schedules is crucial for the efficiency of machine learning jobs and GPU cluster utilization. Existing open-source collective communication libraries (such as NCCL and RCCL) rely on fixed schedules and cannot adjust to varying topology and model requirements. State-of-the-art collective schedule synthesizers (such as TECCL and TACCL) utilize Mixed Integer Linear Program for modeling but encounter search space explosion and scalability challenges. In this paper, we propose SyCCL, a scalable collective schedule synthesizer that aims to synthesize near-optimal schedules in tens of minutes for production-scale machine-learning jobs. SyCCL leverages collective and topology symmetries to decompose the original collective communication demand into smaller sub-demands within smaller topology subsets. SyCCL proposes efficient search strategies to quickly explore potential sub-demands, synthesizes corresponding sub-schedules, and integrates these sub-schedules into complete schedules. Our 32-A100 testbed and production-scale simulation experiments show that SyCCL improves collective performance by up to 127% while reducing synthesis time by 2 to 4 orders of magnitude compared to state-of-the-art efforts.

RDMA is becoming increasingly prevalent from private data centers to public multi-tenant clouds, due to its remarkable performance improvement. However, its lossless traffic control, i.e., PFC, introduces new complexities in network performance anomalies (NPAs) due to its cascading congestion spreading property, which usually incurs complaints from customers/applications about certain flows' performance degradation. Existing studies fall short in fine-grained visibility of PFC impact and traceability of PFC causality, and are thus ineffective in diagnosing the root causes for RDMA NPAs. In this paper, we propose Hawkeye, an accurate and efficient RDMA NPA diagnosis system based on PFC provenance. Hawkeye comprises 1) a fine-grained PFC-aware telemetry mechanism to record the PFC impact on flows; 2) an in-network PFC causality analysis and tracing mechanism to quickly and efficiently collect causal telemetry for diagnosis; and 3) a provenance-based diagnosis algorithm to comprehensively present the anomaly breakdown, identifying the anomaly type and root causes accurately. Through extensive evaluations on both NS-3 simulations and a Tofino testbed, Hawkeye can quickly and accurately diagnose multiple RDMA NPAs with over 90% precision and 1–4 orders of magnitude lower overhead than baselines.

Traffic engineering (TE) has attracted extensive attention over the years. Operators expect to design a TE scheme that accommodates traffic dynamics well and achieves good TE performance with little overhead. Some approaches like oblivious routing compute an optimal static routing based on a large traffic matrix (TM) range, which usually leads to much performance loss. Many approaches compute routing solutions based on one or a few representative TMs obtained from observed historical TMs. However, they may suffer from performance degradation for unexpected TMs and usually induce much overhead of system operating. In this paper, we propose ALTE, an adaptive and low-cost TE scheme based on TM classification. We develop a novel clustering algorithm to properly group a set of historical TMs into several clusters and compute a candidate routing solution for each TM cluster. A machine learning classifier is trained to infer the proper candidate routing solution online based on the features extracted from some easily measured statistics. We implement a system prototype of ALTE and do extensive simulations and experiments using both real and synthetic traffic traces. The results show that ALTE achieves near-optimal performance for dynamic traffic and introduces little overhead of routing updates.

With the rapid growth of low earth orbit (LEO) satellites, enabling LEO AI inference becomes a fast-increasing trend. However, due to resource heterogeneity, scheduling complexity, and fast movement, how to decide the place of executing each AI inference task is nontrivial in LEO systems. In this paper, we propose LEOEdge, an edge-assisted AI inference system for LEO satellites. We first introduce the adaptive modeling technologies that automatically generate the model for each satellite according to its computation resources. We then propose a layered scheduling optimization scheme to schedule the AI inference task in a distributed manner. LEOEdge also designs a seamless data transmission scheme to avoid transmission failure due to the LEO satellite movement. We conduct a series of simulation tests to validate the performance of the proposed LEOEdge, in terms of the neural network searching efficiency, average time execution latency, and delivery latency.

The Domain Name System (DNS) is a growing center of cyber attacks, including both volumetric and non-volumetric attacks. Programmable switches provide a new opportunity for more efficient defense against DNS attacks since they can offer better cost, performance, and flexibility trade-offs compared to traditional defense systems. However, programmable switches have strict limitations on the operations and storage space supported to ensure line-speed packet processing. In this paper, we propose DNSGuard, an intelligent in-network defense framework that can handle volumetric and non-volumetric DNS attacks on programmable switches. We propose a recursive incremental parsing algorithm that can effectively extract variable-length domain names. To achieve real-time and accurate detection against two types of DNS attacks, we design a switch-optimized and resource-efficient algorithm to extract both independent features of each packet and domain-based cumulative features. Then, we propose a multi-phase hybrid model architecture to perform dynamic packet analysis at different time phases of a domain. Further, we design efficient model representation mechanisms to deploy tree-based ensemble models in the data plane. Experimental results show that DNSGuard can defend against diverse DNS attacks at the line rate. In addition, DNSGuard introduces a minimal nanosecond latency to normal traffic in heavily loaded networks.

Fuzzing is a prevalent technology for identifying software vulnerabilities. Existing fuzzing techniques predominantly focus on maximizing code coverage to unearth potential security issues. However, the mere expansion of explored code does not necessarily correlate with an increased discovery of vulnerabilities. Additionally, existing fuzzers often neglect comprehensive execution path information in code exploration. Consequently, potential vulnerabilities may be delayed or overlooked in the fuzzing process. To address this, we propose VPGFUZZ, a vulnerable path-guided fuzzer that can not only explore new code but also exploit known vulnerability path knowledge for vulnerability discovery. It employs a vulnerable path recognition model to identify test cases with potentially vulnerable paths. This model is trained with various execution paths derived from real-world vulnerability PoCs (Proof of Concepts). Based on this model, VPGFUZZ applies an explore-exploit seed selection strategy to effectively choose test cases for testing. Unlike traditional seed selection methods that maintain a single queue for exploring new code, this strategy includes a separate queue for retaining test cases identified as potentially vulnerable, allowing for more thorough testing. Experimental results demonstrate that VPGFUZZ discovers 24 zero-day vulnerabilities, with 18 receiving vulnerability identifiers from third-party organizations such as CVE. Our evaluation also shows VPGFUZZ’s superior efficiency by uncovering the first vulnerability approximately 1.2 to 70 times faster than popular fuzzers in most programs.

The Crowd-edge (CE) computing paradigm facilitates the utilization of the computational resources through simultaneously relying the edge computing and the collaboration among various mobile devices (MDs). Most existing works, focusing on offloading tasks from device to edge servers by centralized solutions, are unable to distribute tasks to massive MDs in CE. Meanwhile, designing a decentralized task offloading solution enabling task subscribers to individually make offloading decisions can be challenging given the randomness of crowd resource provisioning and limited knowledge of global status variations. In this paper, we propose a decentralized crowd-edge task offloading solution that enables users to optimally offload tasks to the CE in a distributed manner. Specifically, we formulate the corresponding problem as a stochastic optimization with partially observable status. By observing network and process delays at the crowd side, we further reform the optimization forms and provide a novel approximation policy, enabling users to optimize their offloading strategy based on local observations without interaction with each other. We then solve this task offloading problem by developing a Mixed Multi-Agent Proxy Policy Optimization algorithm (mixed MAPPO). Extensive testing, including numerical and system-level simulations, was conducted to validate the performance of the proposed algorithm in terms of task delay (including the processing delay and transmission delay), load rate, and resource utilization.

Real-time communication (RTC) applications demand consistent low latency to ensure a smooth and interactive user experience. However, wireless networks, including WiFi and cellular, although they provide satisfactory median latency, often suffer from significant tail latency due to the highly variable network bandwidth. We observe that the control loop for managing the sending rate of RTC applications becomes inflated when congestion occurs at the wireless access point (AP), leading to untimely rate adaptation in response to wireless dynamics. Existing solutions fail to quickly adapt to bandwidth fluctuations due to the inflated control loop. In this paper, we propose Zhuge, a purely wireless AP-based solution that addresses these issues by separating congestion feedback from congested queues. Our approach involves the design of a Fortune Teller, which accurately estimates the wireless latency for each packet upon its arrival at the wireless AP. To ensure scalability, we also develop a Feedback Updater that translates the estimated latency into understandable feedback messages for various end-to-end protocols, delivering them back to the senders immediately for rate adaptation. Our evaluation, based on both trace-driven simulations and real-world scenarios, demonstrates that Zhuge significantly reduces the occurrence of large tail latency and alleviates RTC performance degradation by 22% to 95%.

Border Gateway Protocol (BGP) plays a pivotal role as the de facto inter-domain routing protocol on the Internet. However, BGP threats continually emerge and undermine the Internet reliability. Existing BGP threat detection methods based on machine learning require substantial labeled data and expert involvement, making them costly and labor-intensive. Moreover, they fail to learn rich information from massive unlabeled BGP data consistently generated on the Internet. In this paper, we propose FIRE that enables few-shot inter-domain routing threat detection with large-scale multi-modal pre-training. FIRE conducts domain-specific pre-training tasks to acquire rich BGP implicit knowledge from massive unlabeled BGP data for few-shot learning. Our experiments show that FIRE can be fine-tuned to precisely identify BGP threats with only a few labeled samples, e.g., a 93.2% precision in route leak detection with merely 8 events for fine-tuning.

Collaborative graph learning represents a learning paradigm where multiple parties jointly train a graph neural network (GNN) using their own proprietary graph data. To honor the data privacy of all parties, existing solutions for collaborative graph learning are either based on federated learning (FL) or secure machine learning (SML). Although promising in terms of efficiency and scalability due to their distributed training scheme, FL-based approaches fall short in providing provable security guarantees and achieving good model performance. Conversely, SML-based solutions, while offering provable privacy guarantees, are hindered by their high computational and communication overhead, as well as poor scalability as more parties participate.

Sketch algorithms are crucial for identifying top-k items in large-scale data streams. Existing methods often compromise between performance and accuracy, unable to efficiently handle increasing data volumes with limited memory. We present Bubble Sketch, a compact algorithm that excels in both performance and accuracy. Bubble Sketch achieves this by (1) Recording only full keys of hot items, significantly reducing memory usage, and (2) Using threshold relocation to resolve conflicts, enhancing detection accuracy. Unlike traditional methods, Bubble Sketch eliminates the need for a Min-Heap, ensuring fast processing speeds. Experiments show Bubble Sketch outperforms the other seven algorithms compared, with the highest throughput and precision, and surpasses HeavyKeeper in accuracy by up to two orders of magnitude.

Data parallelism has become a cornerstone in scaling up the training of deep neural networks (DNNs). However, the communication overhead associated with synchronizing gradients across multiple nodes has emerged as a significant bottleneck, adversely affecting training efficiency and leading to a surge in large-scale distributed model training costs. By leveraging insights into the statistical characteristics of gradients, we present GComp, a near-lossless gradient compression scheme designed to reduce the communication burden during data-parallel training significantly. GComp develops an optimized Huffman encoding/decoding strategy to compress gradient exponents effectively. Additionally, it introduces an innovative multi-level quantization method for mantissa, complemented by a pruning strategy that eliminates zero-valued gradients. These integrated approaches significantly reduce the volume of data for synchronization, while virtually not affecting the DNN model's training accuracy. We conduct comprehensive evaluations of GComp, demonstrating that our method can decrease the communication volume by as much as 67.1%, and enhance training speed by up to 1.9×.

Active queue management (AQM) algorithms, widely deployed in the internet, are designed to signal end hosts with network conditions in the format of packet losses. However, real-time communication (RTC) applications adopt delay-sensitive congestion control algorithms (CCAs), which are no longer responsive to losses or explicit notifications from AQMs. Moreover, packet losses introduced by different AQMs will further degrade the performance of RTC applications due to unexpected and unnecessary loss recovery. We are therefore motivated to understand the behaviors of AQMs and take necessary countermeasures for RTC applications proactively. For example, with the help of AQM inference, RTC applications will benefit by using loss recovery mechanisms that adapt to various kinds of AQMs to deal with packet losses. However, it is challenging to infer the AQM from end hosts since numerous AQMs have different configurations after decades of evolution. We analyze the temporal behaviors of loss series, extract the inherent invariant features of different AQMs, and categorize them into three types. Our simulation shows that AQM inference can classify AQMs with an accuracy of 96%. We also evaluate a use case on using the AQM inference to improve the loss recovery mechanism (forward error correction, FEC). Our FEC method based on AQM inference improves the recovery rate by at least 56%, and finally reduces the end-to-end delay by 13%.

Video-sharing websites need to process the uploaded videos (e.g., face recognition) before distributing them to users. The timely processing of videos is critical for users to always enjoy the latest content. However, videos uploaded by different users are diverse in content, with the volume fluctuating at different times in one day. The static resource allocations will result in frequent overutilization and underutilization when the demands and contents change, while container and virtual machine(VM)-based solutions will incur significant additional overhead. Moreover, it is also challenging to predict the required resources in the future due to the complicated relationship between resources, contents, demands, etc. This paper introduces Beimin, an adaptive video processing framework designed for heterogeneous video processing with flexible demands in real-time. Beimin adopts a serverless framework to efficiently allocate resources, and a deep reinforcement learning (DRL) model to predict the resources to allocate with multi-dimensional inputs (contents, demands, etc.). We conducted tests with Amazon Lambda using a synthetic dataset from Imagenet VID, and the results demonstrate that Beimin reduces cost by 1.61% and processing time by 33.17% compared to existing solutions without harm to accuracy.

Many video streaming applications will simultaneously transfer data in both directions, from the user to the Internet (uplink) and from the Internet to users (downlink). However, for wireless local area networks (WLANs), the dominant scenarios, the uplink and downlink flows share the same half-duplex physical channel and compete for bandwidth resources. Their bandwidths would be fairly apportioned under the existing link layer access method, but a fair share might be suboptimal for applications. For better application performance, we propose Plum, to coordinate the bitrate of uplink and downlink flows, and allocate the bandwidth in both directions to cater to the application's demands. To make the deployment of Plum practical, we aim at not modifying the link layer but optimizing the transport layers and above. We evaluate our mechanisms with simulations based on real-world traces and testbed experiments, and results show that Plum could improve the video bitrate of streaming applications by up to 48-59%.

RDMA is a kernel-bypass and transport-offload technology that provides high throughput and low delay for datacenter networks, and DCQCN is the default and most widely used congestion control algorithm in large-scale RDMA networks. DCQCN involves over 10 parameters at RNICs and switches, and their settings significantly affect network performance, currently relying heavily on exhaustive manual tuning. Although some automatic methods are proposed to tune a subset of DCQCN parameters, none of them comprehensively address all parameters at both RNICs and switches, resulting in compromised network performance. In this paper, we propose Paraleon, an automatic and adaptive system to tune DCQCN parameters comprehensively. We design a millisecond-level sketch-based monitoring mechanism for accurate network-wide measurement, which collects runtime metrics as feedback to guide the tuning process. We also analyze the complicated parameter impacts on network performance, and leverage an improved heuristic searching algorithm for timely performance optimization with better efficiency and convergence. We implement Paraleon and conduct extensive experiments in both NS3 simulations and a real-world testbed. The results show that Paraleon achieves$3.8 \% \sim 61.4 \%$higher performance than existing tuning schemes.

Network protocol fingerprinting is a critical technique for identifying various implementations of network protocols, which is essential for vulnerability assessment and security management. However, current fingerprinting methods such as Nmap still heavily rely on manual probe crafting, requiring experts with domain knowledge and leading to inefficiencies and potential oversights. This paper introduces pFuzz, an automatic network protocol fingerprint discovery system utilizing difference-guided fuzzing, to address the challenge of the vast search space inherent in fingerprinting. We propose a difference tree to model the nested recursive condition structure of network protocols and a packet oracle map to capture and utilize multifield relationships revealed by value co-occurrence. Our evaluation of pFuzz on the widely used TCP/IP protocol demonstrates its effectiveness and efficiency on discovering fingerprints.

Mobile web services value a quick loading of contents in the first page, which is quantified by the above-the-fold time of the first page (first AFT) and is likely to fall into the slow start phase in congestion control. However, the widely deployed slow start mechanism is "cold start", which manually hardcodes the parameters and is not suitable for the first AFT of heterogeneous mobile web services. We revisit the slow start mechanism and find that it could be optimized with a priori knowledge. However, blindly relying on a priori knowledge is not robust enough to handle the fluctuating mobile networks and unpredictable application traffic. In this paper, we propose WiseStart, a "hot-start-based" slow start mechanism. WiseStart utilizes the priori knowledge to set the initial parameters, continuously probes the new connection to handle the fluctuating network conditions, and carefully adapts to the application-limit scenarios. We implement WiseStart in a popular mobile web service online in production. Comprehensive experiments demonstrate that WiseStart reduces the First AFT by 25.43% and the average RCT at connection establishment by 16.15% compared to the default slow start mechanism and other state-of-the-art baselines.

Neural networks (NNs) are widely used in classification-based networking analysis to help traffic transmission and system security. However, there are heterogeneous network devices (e.g., switches and routers) in a network. Manually customizing NNs with specific device requirements (e.g., max allowed running latency) can be time-consuming and labor-intensive. Furthermore, the diverse data characteristics of different networking classification tasks add to the burden of NN customization. This paper introduces Loong, a neural architecture search (NAS) based system that automatically generates NNs for various networking tasks and devices. Loong includes a neural operation embedding module, which embeds candidate neural operations into the layer to be designed. Then, the layer-wise training is used to generate a task-specific NN layer by layer. This layer-wise scheme simultaneously trains and selects candidate neural operations using gradient feedback. Finally, only the important operations are selected to form the layer, maximizing accuracy. By incorporating multiple objectives, including deployment memory and running latency of devices, into the training and selection of NNs, Loong is able to customize NNs for heterogeneous network devices. Experiments show that Loong's NNs outperform 13 manual-designed and NAS-based NNs, with a 4.11% improvement in F1-score. Additionally, Loong's NNs achieve faster (7.92X) speeds on commodity devices.

As the mainstream encrypted protocols adopt TCP protocol to ensure lossless data transmissions, the privacy of encrypted TCP traffic becomes a significant focus for adversaries. They can leverage Deep Learning (DL) models to infer the sensitive information from encrypted TCP traffic by analyzing its packet size, direction, and timing information. To defend against such DL-based traffic analysis attacks, recent advances reshape the encrypted traffic and achieve desired results. However, they typically require deploying cooperative modules on both communication endpoints and only support specific applications, such as browsers. In this paper, we propose Cactus, a client-side plug-in to obfuscate bidirectional encrypted TCP traffic for a wide range of applications transparently using the inherent TCP semantics and the emerging eBPF technique. In particular, Cactus provides four effective operations to enable bidirectional traffic obfuscation while preserving communication semantics of applications. Besides, Cactus empowers users to specify which applications to conduct traffic obfuscation and what obfuscation level for each application. We conduct comprehensive experiments to demonstrate that Cactus can effectively obfuscate encrypted TCP traffic with low overhead to hinder the traffic analysis efforts in website fingerprinting and application identification.

Network scanning has been a standard measurement technique to understand a network’s security situations, e.g., revealing security vulnerabilities, monitoring service deployments. However, probing a large-scale scanning space with existing network scanners is both difficult and slow, since they are all implemented on commodity servers and deployed at the network edge. To address this, we introduce IMap, a fast, scalable and reconfigurable in-network scanner based on programmable switches. In designing IMap, we overcome key restrictions posed by computation models and memory resources of programmable switches, and devise numerous techniques and optimizations, including an address-random and rate-adaptive probe packet generation mechanism, and a correct and efficient response packet processing scheme, to turn a switch into a practical runtime-reconfigurable high-speed network scanner. We implement an open-source prototype of IMap, and evaluate it with extensive testbed experiments and real-world deployments in our campus network. Evaluation results show that even with one switch port enabled, IMap can survey all ports of our campus network (i.e., a total of up to 25 billion scanning space) in 8 minutes. This demonstrates a nearly 4 times faster scanning speed and 1.5 times higher scanning accuracy than the state of the art, which shows that IMap has great potentials to be the next-generation terabit network scanner with all switch ports enabled. Besides, our experiments also show that IMap supports the reconfiguration of scanning tasks at runtime, without incurring switch downtime. Leveraging IMap, we also discover several potential security threats in our campus network, and report them to our network administrators responsibly.

The exceptionally high bandwidth requirement for delivering high-quality live 360$^\circ$video poses a significant challenge to current network capacity. Mitigating such bandwidth starvation necessitates accurate field-of-view (FoV) prediction to focus limited resources on the viewer's area of interest. However, FoV prediction for live 360$^\circ$streaming can be complex due to the time-sensitive nature of live content and the limited knowledge available for model training. Our paper introduces a novel framework,CoLive, for predicting the FoV in 360$^\circ$live streaming.CoLiveaccelerates FoV prediction by offloading model training from viewers to the edge and migrating saliency feature detection to the server side. Observations on user clustering of viewing behaviors further motivate us to propose a novel dynamic clustered learning algorithm. The algorithm dynamically groups users according to their model update gradients and enables them to train a shared model that better suits their viewing preferences. We conduct extensive experiments on the public 360$^\circ$video datasets and demonstrate thatCoLiveoutperforms state-of-the-art solutions in terms of prediction performance and bandwidth savings.

Ternary Content Addressable Memory (TCAM) enables fast lookup and is widely used by routers and switches to support policy-based forwarding. Due to high cost and small capacity, only a small subset of important rules can be cached in TCAM, so determining it is critical to increasing the hit ratio. This is more challenging than traditional caching problems because of complicated rule dependency relationships. Existing works are based on heuristics and they don’t work well under all practical scenarios. Worse still, the lack of fundamental understanding of the design space, complexity, and optimality makes all explorations in mystery. In this paper, we use a modeling-based method to formulate the problem, prove its complexity, and propose DROPS, a dynamic rule caching framework with a much higher hit ratio. In particular, we deduce the rule selection problem into a multi-dimensional rule space transformation problem. Thus, we are no longer limited by using the intrinsic rules; rather, we can transform original rules into “new rules” equivalently without rule dependency. We design non-trivial rule placement and update algorithms and implement them in programmable switches. In the experimental evaluation, we show that our method outperforms all existing methods.

Border Gateway Protocol (BGP) is the only inter-domain routing protocol that plays an important role on the Internet. However, BGP suffers from route leaks, which can cause serious security threats. To mitigate the effects of route leaks, accurate and timely route leak locating is of great importance. Prior studies leverage AS business relationships to locate route leaks in real time. However, they fail to achieve high locating accuracy. Recent studies apply machine learning to accurately detect route leaks from statistical features of massive BGP messages. Nevertheless, they have high detection latency and cannot further locate route leaks. In this paper, we propose a real-time and accurate route leak locating system named RoLL+. It leverages distinctive AS triplet features to accurately locate AS triplets with route leaks from each BGP message in real time. Considering that RoLL+ may receive a substantial volume of BGP update messages per second, we integrate a cache-like design and a lazy update mechanism into the system to effectively identify route leaks at scale. Our experimental results on real-world BGP route leak data demonstrate that it can achieve 92% locating accuracy with less than 1 ms locating latency. Furthermore, the results show that RoLL+ can process over 7,000 AS triplets per second, meeting real-world throughput requirements.

Robust network design, which aims to guarantee network availability under various failure scenarios while optimizing performance/cost objectives, has received significant attention. Existing approaches often rely on model-based mixed-integer optimization that is hard to scale or employ deep learning to solve specific engineering problems yet with limited generalizability. In this paper, we show that failure evaluation provides a common kernel to improve the tractability and scalability of existing solutions. By providing a neural network function approximation of this common kernel using graph attention networks, we develop a unified learning-based framework, FERN, for scalable Failure Evaluation and Robust Network design. FERN represents rich problem inputs as a graph and captures both local and global views by attentively performing feature extraction from the graph. It enables a broad range of robust network design problems, including robust network validation, network upgrade optimization, and fault-tolerant traffic engineering that are discussed in this paper, to be recasted with respect to the common kernel and thus computed efficiently using neural networks and over a small set of critical failure scenarios. Extensive experiments on real-world network topologies show that FERN can efficiently and accurately identify key failure scenarios for both OSPF and optimal routing scheme, and generalizes well to different topologies and input traffic patterns. It can speed up multiple robust network design problems by more than 80x, 200x, 10x, respectively with negligible performance gap.

To ensure high performance for HTTP adaptive streaming (HAS), it is critical to provide accurate prediction of end-to-end network bandwidth. Low Latency Live Streaming (LLLS), which has been gaining popularity, faces even greater challenges in this regard. Unlike Video-on-Demand (VOD) streaming, which only needs long-term bandwidth prediction and can tolerate some prediction errors, LLLS demands precise short-term bandwidth predictions. These challenges are amplified by the fact that short-term bandwidth experiences both large abrupt changes and uncertain fluctuations. Furthermore, obtaining valid bandwidth measurement samples in LLLS poses difficulties due to the on-off traffic pattern. In this work, we present DeeProphet, a system designed to enhance the performance of LLLS by achieving accurate bandwidth prediction. DeeProphet collects valid bandwidth samples by identifying intervals of packet continuous sending leveraging TCP state information, estimates the segment-level bandwidth robustly by filtering out noisy samples, and predicts both significant changes and uncertain fluctuations in future bandwidth by combining both time series and learning-based models. Experimental results demonstrate that DeeProphet effectively enhances the overall Quality of Experience (QoE) by 39.5% to 464.6% compared to state-of-the-art LLLS Adaptive Bitrate (ABR) algorithms.

IPv6 has shown notable growth in recent years, imposing the need for high-speed IPv6 lookup. As the forwarding rate of virtual switches continues increasing, software-based IPv6 lookup without using special hardware such as TCAM, GPU, and FPGA is of academic interest and industrial importance. Existing studies achieve fast software IPv4 lookup by reducing the operation number, as well as reducing the memory footprint to benefit from CPU cache. However, in the situation of 128-bit IPv6 addresses, it is challenging to keep both operation numbers and memory footprints small. To address the issue, we propose the Neurotrie data structure, which supports fast lookup and arbitrary strides. Thus, a good balance can be made between trie depth and memory footprint by computing the proper stride for each Neurotrie node. We model the optimal Neurotrie problem which minimizes the depth with limited memory footprint and develop a pseudo-polynomial time baseline algorithm to construct Neurotrie using dynamic programming. To improve the performance and reduce the computation complexity, we develop a deep reinforcement learning-based approach, which leverages a deep neural network to construct Neurotrie efficiently, based on characteristics captured from real IPv6 prefixes. We further refine the data structure called Neurotrie-S and develop an efficient mechanism for routing updates. Experiments on real routing tables show that Neurotrie-S achieves a lookup rate 34% higher than that of state-of-the-art approaches. We implement a Neurotrie-based software switch, and the forwarding rate of Neurotrie-S is about 10% to 345% higher than other algorithms.

Machine learning based network traffic analysis has been widely used to combat malicious behaviors in various network scenarios. However, most of the applications are specialized for a single task and cannot cover a wide spectrum of security threats. Building a machine learning pipeline from scratch for each traffic analysis task is painstaking and time-consuming. And it is not practical to deploy several traffic analysis tasks together due to the high runtime overhead. In this paper, we propose Multa to enhance the deployability of traffic analysis applications. Multa is a framework that leverages Multi-Task Learning (MTL) - an emerging paradigm in machine learning - to enable the efficient parallel deployment of multiple traffic analysis tasks. Specifically, we devise a sequence-based traffic feature representation that is informative and general enough to serve a diverse range of tasks. Then we use the LSTM-based Multi-gate Mixture-of-Experts (LMMoE) model to learn task characteristics and propose a size tuning algorithm to optimize its performance. Considering different data curating methods, we also present two different training paradigms to construct Multa. Our experiments show that Multa can reduce the space occupancy of the model by up to 50% and accelerate the inference process by more than 100% in multi-task scenarios, which indicates better deployability in real-world networks.

BGP is the only inter-domain routing protocol that plays an important role on the Internet. However, BGP suffers from route leak, which can cause serious security threats. To mitigate the effects of route leak, accurate and timely route leak location is of great importance. Prior studies leverage AS business relationships to locate route leak in real time. However, they fail to achieve high location accuracy. Recent studies apply machine learning to accurately detect route leak from statistical features of massive BGP messages. Nevertheless, they have high detection latency and cannot further locate route leak. In this paper, we propose a real-time and accurate route leak location system named RoLL. It leverages distinctive AS triplet features to accurately locate AS triplets with route leak from each BGP update message in real time. Our experimental results on real-world BGP route leak data demonstrate that RoLL can achieve 91% location accuracy with less than 10 ms location latency.

Traffic classification provides substantial benefits for service differentiation, security policy enforcement, and traffic engineering. However, accurately classifying large volumes of network traffic using existing solutions is pretty challenging, as they are typically implemented on commodity servers with slow CPUs for packet processing. To address this, we leverage the opportunity provided by emerging programmable switches and propose HyperClassifier as a solution to achieve accurate, extensible, and scalable traffic classification. HyperClassifier designs an efficient classifying table with an effective flow expiration mechanism that enables lightweight packet inspection on resource-limited switches. We implement an open-source prototype of HyperClassifier on a hardware Tofino switch and conduct extensive evaluations. The results of our evaluation demonstrate that, compared to existing solutions, HyperClassifier can provide orders of magnitude higher classification throughput with comparable classification accuracy.

The In-band Network Telemetry (INT) provides unprecedented network visibility by encapsulating fine-grained device-internal status into packet headers. Existing efforts proposed to reduce the telemetry cost can either monitor a small part of flows and links, or require complex calculation supported by programmable switches. In this paper, we propose SD-INT (Self-Driving INT), a lightweight network-wide passive INT system, which can be readily deployed based on commodity switches. The key idea of SD-INT is to reduce two dimensions of redundancy in the INT data which we have observed. Furthermore, the optimized INT is conducted in a self-driving system, adjusting the INT strategy according to the feedback of INT result history. In addition to the mechanism, we design the latency-hiding technology and a suite of efficient algorithms for flow selection and sampling ratio adaptation. These designs enable us to keep the monitoring overhead under a reasonable level, while still collecting network-wide fine-grained telemetry data. Further, we prototype and evaluate SD-INT with both large-scale simulations and testbed deployment. Experiments for both TCP(Transmission Control Protocol) and RDMA(Remote Direct Memory Access) flows show that SD-INT reduces orders of magnitude data volume while achieves similar link coverage compared with INT. Besides, compared with the relevant technologies based on programmable switches, SD-INT is competitive in reducing the data volume.

Multicast traffic is growing rapidly due to the development of multimedia streaming. Lately, stateless multicast protocols, such as BIER, have been proposed to solve the excessive routing states problem of traditional multicast protocols. However, the high complexity of multicast tree computation and the limited scalability for concurrent requests still pose daunting challenges, especially under dynamic group membership. In this paper, we propose Hawkeye, a dynamic and stateless multicast mechanism with deep reinforcement learning (DRL) approach. For real-time responses to multicast requests, we leverage DRL enhanced by a temporal convolutional network (TCN) to model the sequential feature of dynamic group membership and thus is able to build multicast trees proactively for upcoming requests. Moreover, an innovative source aggregation mechanism is designed to help the DRL agent converge when faced with a large amount of multicast requests, and relieve ingress routers from excessive routing states. Evaluation with real-world topologies and multicast requests demonstrates that Hawkeye adapts well to dynamic multicast: it reduces the variation of path latency by up to 89.5% with less than 12% additional bandwidth consumption compared with the theoretical optimum.

Multi-site Parallel Downloading is a technique that uses multiple low-cost edge nodes in the Internet to transfer short video content. Traditional multi-path congestion control fails to achieve fast convergence and high bandwidth utilization in MPD scenarios due to the over-coupling of subflows. In this paper, we propose a semi-coupled congestion control design for the MPD scenario by reallocating traffic between independent subflows. In simulation experiments, our design outperforms baseline models of traditional MPTCP.

Datacenter Quantized Congestion Notification (DCQCN) [12] is the default congestion control algorithm for Mellanox RDMA (Remote Direct Memory Access) NICs [2] in RoCEv2 (RDMA over Converged Ethernet v2) networks, one of the most widely used NICs in leading industry companies [4, 5, 7, 9]. In DCQCN, firstly switches mark packets with ECN (Explicit Congestion Notification) when the queue length exceeds ECN thresholds, then receivers respond to ECN-marked packets with CNPs (Congestion Notification Packets), and finally senders reduce transmission rate when receiving CNPs. DCQCN has 10+ parameters at both NICs and switches, including Alpha Update, Rate Increase & Decrease, Notification Point and ECN thresholds [3], and these parameters have a non-negligible impact on the network performance. Our experiments also verify the network performance of common AI (Artificial Intelligence) training workloads in RoCEv2 networks (e.g., all-to-all collective communication) is greatly influenced by different DCQCN parameter settings (§3). Therefore, when deploying applications in practice, the DCQCN parameters need to be carefully tested and tuned to improve the network performance.

Microservices are becoming more complicated, posing new challenges for traditional performance monitoring solutions. On the one hand, the rapid evolution of microservices places a significant burden on the utilization and maintenance of existing distributed tracing frameworks. On the other hand, complex infrastructure increases the probability of network performance problems and creates more blind spots on the network side. In this paper, we present DeepFlow, a network-centric distributed tracing framework for troubleshooting microservices. DeepFlow provides out-of-the-box tracing via a network-centric tracing plane and implicit context propagation. In addition, it eliminates blind spots in network infrastructure, captures network metrics in a low-cost way, and enhances correlation between different components and layers. We demonstrate analytically and empirically that DeepFlow is capable of locating microservice performance anomalies with negligible overhead. DeepFlow has already identified over 71 critical performance anomalies for more than 26 companies and has been utilized by hundreds of individual developers. Our production evaluations demonstrate that DeepFlow is able to save users hours of instrumentation efforts and reduce troubleshooting time from several hours to just a few minutes.

Website fingerprinting enables an eavesdropper to determine which websites a user is visiting over an encrypted connection. State-of-the-art website fingerprinting (WF) attacks have demonstrated effectiveness even against Tor-protected network traffic. However, existing WF attacks have critical limitations on accurately identifying websites in multi-tab browsing sessions, where the holistic pattern of individual websites is no longer preserved, and the number of tabs opened by a client is unknown a priori. In this paper, we propose ARES, a novel WF framework natively designed for multi-tab WF attacks. ARES formulates the multi-tab attack as a multi-label classification problem and solves it using a multi-classifier framework. Each classifier, designed based on a novel transformer model, identifies a specific website using its local patterns extracted from multiple traffic segments. We implement a prototype of ARES and extensively evaluate its effectiveness using our large-scale dataset collected over multiple months (by far the largest multi-tab WF dataset studied in academic papers.) The experimental results illustrate that ARES effectively achieves the multi-tab WF attack with the best F1-score of 0.907. Further, ARES remains robust even against various WF defenses.

In this paper, we identify the opportunity of using programmable switches to improve the state of the art in spoofed IP traffic filtering, and proposeNetHCF, a line-rate in-network system to filter spoofed traffic. One key challenge in the design ofNetHCFis to handle the restrictions stemmed from the limited computational model and memory resources of programmable switches. We address this by decomposing the HCF scheme into two complementary parts, by aggregating the IP-to-Hop-Count (IP2HC) mapping table for efficient memory usage, and by designing adaptive mechanisms to handle routing changes, IP popularity changes, and network activity dynamics. We implement an open-source prototype ofNetHCF, and conduct extensive evaluations. The evaluation results demonstrate thatNetHCFis able to process most legitimate traffic in 1$\mu$s, filter spoofed IP traffic effectively under network dynamics, with less than 30% of switch resource occupation.

The emerging Software-Defined Networking (SDN) is being adopted by data centers and cloud service providers to enable flexible control. Meanwhile, the current SDN design brings new vulnerabilities. In this paper, we explore a stealthy attack that uses a minimum rate of attack packets to disrupt SDN data plane. To achieve this, we propose the LOFT attack that computes the lower bound of attack rate to overflow flow tables based on the inferred network configurations. Particularly, each attack packet always triggers or maintains consumption of one flow rule. LOFT can ensure the attack effect under various network configurations while reducing the possibility of being captured. We demonstrate its feasibility and effectiveness in a real SDN testbed consisting of commercial hardware switches. The experimental results show that LOFT incurs significant network performance degradation and potential network DoS at an attack rate of only tens of Kbps. To defeat the attack, we develop a data-to-control plane collaborative defense system named LOFTGuard, which is lightweight and transparent to SDN applications. Evaluations show that LOFTGuard effectively protects SDN against the attack and introduces a small overhead.

Despite the bandwidth scaling limit of electrical switching and the high cost of building Clos data center networks (DCNs), the adoption of optical DCNs is still limited. There are two reasons. First, existing optical DCN designs usually face high deployment complexity. Second, these designs are not full-optical and the performance benefit over the non-blocking Clos DCN is not clear. After exploring the design tradeoffs of the existing optical DCN designs, we propose TROD (ThresholdRouting basedOpticalDatacenter), a low-complexity optical DCN with superior performance than other optical DCNs. There are two novel designs in TROD that contribute to its success. First, TROD performs robust topology optimization based on the recurring traffic patterns and thus does not need to react to every traffic change, which lowers deployment and management complexity. Second, TROD introduces tVLB (threshold-based Valiant Load Balance), which can avoid network congestion as much as possible even under unexpected traffic bursts. We conduct simulation based on both Facebook’s real DCN traces and our synthesized highly bursty DCN traces. TROD reduces flow completion time (FCT) by about 1.15-2.16$\times$compared to Google’s Jupiter DCN, at least 2$\times$compared to other optical DCN designs, and about 2.4-3.2$\times$compared to expander graph DCN. Compared with the non-blocking Clos, TROD reduces the hop count of the majority packets by one, and could even outperform the non-blocking Clos with proper bandwidth over-provision at the optical layer. Note that TROD can be built with commercially available hardware and does not require host modifications.

Multi-string pattern matching is a crucial building block for many network security applications and thus of great importance. Since every byte of a packet has to be inspected by a large set of patterns, it often becomes a bottleneck of these applications and dominates the performance of an entire system. Many existing studies have been devoted to alleviating this performance bottleneck either by algorithm optimization or hardware acceleration. However, neither one provides the desired scalability and costs that keep pace with the drastic increase in network bandwidth and traffic today. To address these issues, in this paper, we present BOLT, a scalable and cost-efficient multi-string pattern matching system leveraging the capability of emerging programmable switches. BOLT combines the following techniques: (1) an efficient state encoding scheme to fit a large number of strings into the limited memory on a programmable switch; (2) a variable$k$-stride transition mechanism to increase the throughput significantly with the same level of memory cost; and(3)a compactpattern2rulemapping method to accommodate multiple co-existing strings in one rule. We implement a prototype of BOLT and make its source code publicly available. Extensive evaluations demonstrate that BOLT can provide multi-hundred Gbps throughput and scales well with various pattern sets and workloads.

To improve the performance of mobile web services, a new transport protocol, QUIC, has been recently proposed as a substitute for TCP. However, with pros and cons of QUIC, it is challenging to decide whether and when to use QUIC in large-scale real-world mobile web services. Complex temporal correlation of network conditions, high user heterogeneity in a nationwide deployment, implementation diversity of QUIC variants limited, and resources on mobile devices all affect the selection of transport protocols. In this paper, we present WiseTrans, an adaptive transport protocol selection mechanism, to switch transport protocols for mobile web services online and improve the completion time of web requests. WiseTrans introduces machine learning techniques to deal with temporal heterogeneity, makes decisions with historical information to handle spatial heterogeneity, adopts an online learning method to keep pace with implementation variation, and switches transport protocols at the request level to reach high performance with acceptable overhead. We implement WiseTrans on two platforms (Android and iOS) in a popular mobile web service application of Baidu. Comprehensive experiments demonstrate that WiseTrans can reduce request completion time by up to 25.8% on average compared to the usage of a single protocol.

Emerging applications raise critical QoS requirements for the Internet. The improvements in flow classification technologies, software-defined networks (SDN), and programmable network devices make it possible to fast identify users’ requirements and control the routing for fine-grained traffic flows. Meanwhile, the problem of optimizing the forwarding paths for traffic flows with multiple QoS requirements in an online fashion is not addressed sufficiently. To address the problem, we propose DRL-OR-S, a highly scalable online routing algorithm using multi-agent deep reinforcement learning. DRL-OR-S adopts a comprehensive reward function, an efficient learning algorithm, and a novel deep neural network structure to learn appropriate routing strategies for different types of flow requirements. In order to enhance the generalization and scalability, we propose a novel graph-based actor-critic network architecture and a carefully designed input state for DRL-OR-S. To accelerate the training process and guarantee reliability, we further introduce an NN-simulator for efficient offline training and a safe learning mechanism to avoid unsafe routes during the online routing process. We implement DRL-OR-S under SDN architecture and conduct Mininet-based experiments using real network topologies and traffic traces. The results validate that DRL-OR-S can well satisfy the requirements of latency-sensitive, throughput-sensitive, latency-throughput-sensitive, and latency-loss-sensitive flows at the same time, while exhibiting great adaptiveness and reliability under the scenarios of link failure, traffic change, unseen large topology and partial deployment.

More and more enterprises deploy applications on Function-as-a-Service (FaaS) platforms to improve resource efficiency and save monetary costs. Network Functions (NFs) suffer from staggered peaks of traffic patterns and could benefit from fine-grained resource multiplexing in FaaS platform. However, naively exploring existing FaaS platforms to support NFs can introduce significant performance overheads in three aspects, including slow instance startup, remote state access for NFs, and costly packet delivery between NFs. To address these problems, we propose${\sf Serpens}$, a high performance FaaS platform for NFs. First,${\sf Serpens}$proposes a reusable NF runtime design to slash instance startup overhead. Second,${\sf Serpens}$designs a novel state management mechanism to support local state access. Third,${\sf Serpens}$introduces an advanced service chaining approach to avoid extra packet delivery. Besides,${\sf Serpens}$designs an NF scaling mechanism to minimize performance fluctuation. We have implemented a prototype of${\sf Serpens}$and conducted comprehensive experiments. Compared with the NFs and Service Function Chains (SFCs) that run on existing FaaS platforms,${\sf Serpens}$can improve the throughput by more than 10× and reduce the latency by more than 90%.

Serverless computing, or Function-as-a-Service, is gaining continuous popularity due to its pay-as-you-go billing model, flexibility, and low costs. These characteristics, however, bring additional security risks, such as the Denial-of-Wallet (DoW) attack, to serverless tenants. In this paper, we perform a real-world DoW attack on commodity serverless platforms to evaluate its severity. To identify such attacks, we design, implement, and evaluate Gringotts, an accurate, easy-to-use DoW detection system with a negligible performance overhead. Gringotts addresses the information ambiguity inherent in serverless functions by introducing a well-designed performance metrics collection agent. Then, Gringotts uses the Mahalanobis distance to discover anomalies in the distribution of the metrics. We implement Gringotts as a real system and conduct extensive experiments using a testbed to evaluate the performance of Gringotts. Our results indicate that Gringotts has a performance overhead of less than 1.1%, with an average detection delay of 1.86 seconds and an average accuracy of over 95.75%.

IPv6 has shown notable growth in recent years, imposing the need for high-speed IPv6 lookup. As the forwarding rate of virtual switches continues increasing, software-based IPv6 lookup without using special hardware such as TCAM, GPU, and FPGA is of academic interest and industrial importance. Existing studies achieve fast software IPv4 lookup by reducing the operation number, as well as reducing the memory footprint so as to benefit from CPU cache. However, in the situation of 128-bit IPv6 addresses, it is challenging to keep both operation numbers and memory footprints small. To address the issue, we propose the Neurotrie data structure, which supports fast lookup and arbitrary strides. Thus, a good balance can be made between trie depth and memory footprint by computing the proper stride for each Neurotrie node. We model the optimal Neurotrie problem which minimizes the depth with limited memory footprint and develop a pseudo-polynomial time baseline algorithm to construct Neurotrie using dynamic programming. To improve the performance and reduce the computation complexity, we develop a deep reinforcement learning-based approach, which leverages a deep neural network to construct Neurotrie efficiently, based on characteristics captured from real IPv6 prefixes. We further refine the data structure and develop an efficient mechanism for routing updates. Experiments on real routing tables show that Neurotrie achieves a lookup rate 34% higher than that of state-of-the-art approaches.

The ever-increasing demand for bandwidth resources when delivering premium quality 360° video challenges the current network capacity. To alleviate such bandwidth pressure, it is imperative to predict the viewport via observing the content visual feature and historical viewing behaviors, which thereby allows the system to concentrate the limited resource on viewer's region of interest in 360° content. However, enabling accurate viewport prediction for 360° live streaming is non-trivial given the time-sensitive of live content and shortage of pre-knowledge on the visual features and viewing behaviors. In this paper, we propose CoLive, an edge-assisted online viewport prediction framework. CoLive incorporates edge computing to offload the prediction model training from viewers and migrates the saliency feature detection to the server side for reducing the processing delay. Viewers can also collaboratively train a central predicting model via sharing their loss gradients. This central model, together with the saliency feature detection, further prompts accuracy prediction and learning acceleration, especially for new incoming viewers. A series of experiments on the public 360° video dataset show how our solution achieves better performance compared with state-of-the-art solutions.

Massive enterprises deploy their applications on public clouds to relieve infrastructure management burden. However, applications are faced with highly fluctuating workloads, while clouds provision exclusive resources at coarse time granularity, resulting in severely low resource efficiency. Function-as-a-Service (FaaS) platform enables fine-grained resource multiplexing, which has the potential to improve efficiency. However, FaaS platforms could consume several seconds to start functions and the long startup latency can severely hurt the performance of applications. In this paper, we measure the FaaS platforms and find that most startup latency is occupied by code preparation. To reduce the code preparation latency with little resource overhead, we propose Scorpius, a FaaS platform that proactively prepares code based on the historical data of functions. It combines two optimization categories: (1) To reduce the code size, Scorpius proposes to proactively prepare partial libraries over servers and run functions on the server with most library sharing. (2) To advance the start time, Scorpius proposes to predict the function overload with a simple model and proactively scale code to more servers. We have implemented a prototype of Scorpius and conducted extensive experiments. Evaluation results demonstrate that compared with state-of-the-art methods, Scorpius can reduce the code preparation latency by 87.6% with only 9.3% storage overhead.

When diagnosing performance anomalies, it is often useful to reason about why a packet experienced the queuing that it did. To that end, we observe that queuing is both a result of historical effects and the current state of the network. Further, both factors involve short and long timescales by nature. Existing work fails to provide insight that satisfies all of these needs.

Real-time communication (RTC) applications like video conferencing or cloud gaming require consistent low latency to provide a seamless interactive experience. However, wireless networks including WiFi and cellular, albeit providing a satisfactory median latency, drastically degrade at the tail due to frequent and substantial wireless bandwidth fluctuations. We observe that the control loop for the sending rate of RTC applications is inflated when congestion happens at the wireless access point (AP), resulting in untimely rate adaption to wireless dynamics. Existing solutions, however, suffer from the inflated control loop and fail to quickly adapt to bandwidth fluctuations. In this paper, we propose Zhuge, a pure wireless AP based solution that reduces the control loop of RTC applications by separating congestion feedback from congested queues. We design a Fortune Teller to precisely estimate per-packet wireless latency upon its arrival at the wireless AP. To make Zhuge deployable at scale, we also design a Feedback Updater that translates the estimated latency to comprehensible feedback messages for various protocols and immediately delivers them back to senders for rate adaption. Trace-driven and real-world evaluation shows that Zhuge reduces the ratio of large tail latency and RTC performance degradation by 17% to 95%.

How to enable high-performance task offloading and preserve the trust between participants is imperative yet nontrivial to the Cloud-Edge-Device (CED) computing, mainly because the resources are geo-distributed and operated by different parties. Also, the CED participants are highly dynamic and heterogeneous in resource provision and may conflict in interest. This paper proposes BlockChain-empowered CED (BC-CED), a blockchain-empowered collaborative task offloading for CED computing. In BC-CED, blockchain plays a central role in the main functionality of CED, including task offloading, brokerage of resource usage, and incentives. We distinguish the BC-CED from the existing solutions by modifying the blockchain consensus process, enabling the participants to reach an agreement via solving the task offloading problem. For this purpose, we formulate the offloading problem by considering the computation capabilities of candidate nodes and the network performance. BC-CED allows each participant to apply reinforcement learning-based methods to solve this problem and compete for the right of block output by comparing the offloading policy performance and accepting the best policy as the offloading scheme within the next period. We also propose a truthful incentive mechanism to encourage resource contributions in BC-CED and force them to be honest. Extensive tests by implementing our solutions in a commercialized blockchain platform have shown how BC-CED achieves a superior performance in task offloading and blockchain maintenance.

Network Function Virtualization (NFV) is a new networking paradigm to enable dynamic network function deployment in networks. Existing studies focused on optimized function deployment and management in NFV. Unfortunately, these studies did not well address the problem of efficient security function enforcement in networks, which is the goal of deploying network functions (NFs), i.e., for real-time security function enforcement on the traffic, since optimal function deployment does not mean efficient security function enforcement on network traffic. In particular, they incurred significant NF enforcement cost. In order to address this issue, in this paper, we propose${\textsf {FuncE}}$that aims to solve the efficient real-time security function enforcement problem by developing unified dynamic flow and function scheduling. We formulate the problem as an integer linear programming problem and prove that it is NP-hard. We tackle the problem by decomposing it and developing heuristics to achieve near-optimal solutions. We conduct comprehensive experiments by using real topologies to demonstrate the effectiveness of the${\textsf {FuncE}}$design. The experimental results demonstrate that${\textsf {FuncE}}$achieves near-optimal network function enforcement, which incurs over 100 times less latency than the existing the optimal solver. In particular, compared to the state-of-art defenses,${\textsf {FuncE}}$processes the same number of candidate flows using over 50% less VNFs, while ensuring the same level of function enforcement.

Live video applications are getting popular, and content providers widely use adaptive bitrate (ABR) streaming to improve QoE while maintaining low latency. However, users’ increasing preference to watch videos on mobile devices poses great challenges for ABR algorithm due to the dramatically varying cellular network. Existing learn-based ABR algorithms face difficulties to generalize to various network conditions because of their reliance on training traces, and model/rule-based ABR schemes suffer from rebuffering under low latency constraint since they cannot robustly control the buffer occupancy within a small range. To address it, this work proposes Cratus, a lightweight and robust ABR algorithm for mobile live streaming, which achieves high QoE and low latency by accurately regulating the buffer at a small level. To enhance the control ability, Cratus controls the buffer dynamic behavior rather than the buffer occupancy. By using sliding mode control approach, Cratus robustly controls the buffer dynamic and ensures that the buffer occupancy is bounded around the target level regardless of network uncertainties. Trace-driven experiments show that Cratus outperforms existing ABRs: average QoE is increased by 12.3 to 28.6 percent, and rebuffering time is limited within 0.8$s$on average, which is reduced by 53.5 to 92.3 percent.

Most video players use adaptive bitrate (ABR) algorithms to provide good quality-of-experience (QoE) in dynamic network conditions. To deal with the adaptation challenges, many ABR algorithms select bitrate by optimizing a defined QoE function. Within the framework, various algorithms mainly differ in how the optimization problem is solved, including prediction-based approaches and learn-based approaches. However, these algorithms suffer from limited performance in the current popular mobile streaming which has limited resources and rapidly changing link rates. Existing machine-learning approaches face deployment difficulties on mobile devices, and prediction-based approaches that rely on throughput prediction experience large buffer occupancy variations in cellular networks, resulting in rebuffering frequently. To provide a robust and lightweight ABR algorithm for mobile streaming, this work improves the robustness of prediction-based scheme against unpredictable network variations and develops RBC (Robust Bitrate Controller) algorithm. Rather than optimizing QoE over the entire buffer capacity, RBC creates buffer margins to absorb the impact of throughput jitters and solves QoE maximization on the narrowed buffer range. The amount of buffer margin is dynamically adjusted based on the real-time throughput fluctuation to ensure sufficient de-jitter space. For online lightweight deployment, RBC provides a closed-form solution of the desired bitrate with small computation complexity by using adaptive control approach. Trace-driven experiments and real-world tests show that RBC effectively reduces the playback freezing and gains an improvement in overall QoE.

Faithfully emulating networks is critical for verifying the correctness and effectiveness of new networking-related designs. Existing network experiment platforms either cannot faithfully emulate the functionality and performance of production networks or cannot scale well due to cost constraints. In this paper, we proposeTurboNet, a new network emulator that utilizes one or more programmable switches to achieve faithful emulation of the network data plane and control plane. For data plane emulation, we propose a series of key designs, such as port mapper, queue mapper, and delayed queue, to emulate network topologies and performance metrics with high flexibility and accuracy. For control plane emulation, we support static routing configurations, distributed routing agents, and the centralized routing controllers. Meanwhile, we provide APIs for operators to simplify network emulation tasks. We implementTurboNeton Tofino switches. Evaluation results show that: (1) On the data plane,TurboNetcan flexibly emulate various topologies, such as an 8-ary fat-tree with only one programmable switch and a 10-ary fat-tree with four programmable switches; (2) On the control plane,TurboNetsupports about 200 BGP agents on a single programmable switch with a CPU usage of 25%; (3)TurboNetcan accurately emulate different network performance metrics such as 10−8link loss, and microsecond to millisecond link delay.

Network monitoring systems are designed to fulfill operators’ intents and serve as essential tools to modern networks. As a result of rapidly increasing network bandwidth and scale nowadays, network monitors should satisfy on-demand network monitoring for continuously growing traffic volumes. However, existing monitoring systems either cannot satisfy flexible intents on demand or produce significant overheads. In this paper, we presentNewton, an intent-driven traffic monitor that is able to specify operators’ intents with traffic monitoring queries and conduct dynamic and scalable network-wide queries deployment.Newtonenables operators to customize and modify queries dynamically without interrupting the network workflow. Besides,Newtonproposes systematic optimizations at device level and network-wide level to reduce resource consumption while deploying queries.Newtoncan combine the resources across switches to deploy complex queries with high resilience to dynamic network status. Evaluations prove thatNewtonis of high flexibility, scalability, and resource efficiency, which demonstratesNewtonis promising to be deployed in large-scale programmable networks.

Software-Defined Networking (SDN). SDN enables network innovations with a centralized controller controlling the whole network through the control channel. Because the control channel delivers all network control traffic, its security and reliability are of great importance. For the first time in the literature, we propose the CrossPath attack that disrupts the SDN control channel by exploiting the shared links in paths of control traffic and data traffic. In this attack, crafted data traffic can implicitly disrupt the forwarding of control traffic in the shared links. As the data traffic does not enter the control channel, the attack is stealthy and cannot be easily perceived by the controller. In order to identify the target paths containing the shared links to attack, we develop a novel technique called adversarial path reconnaissance. Our experimental results show its feasibility and efficiency of identifying the target path. We systematically study the impacts of the attack on various network applications in a real SDN testbed. Experiments show the attack significantly degrades the performance of existing network applications and causes serious network anomalies, e.g., routing blackhole, flow table resetting, and even network-wide DoS. To defeat the CrossPath attack, we design a lightweight defense system named CrossGuard. Experiments demonstrate that it can effectively protect the control channel and quickly locate the attack flow with 98% accuracy while introducing a small overhead.

As one of the most critical cloud services, Bare-Metal Servers (BMS) introduce stringent performance requirements on data center networks (DCN). Stateful packet filter is an integral DCN component of ensuring connection security for BMS. However, the off-the-shelf stateful packet filters either are costly for cloud DCNs or introduce significant performance bottlenecks. In this article, we presentCoFilter, which leverages low-cost programmable switches to accelerate the stateful packet filter for BMS.CoFilteruses (1)stateful process partitionto enable complex stateful packet filtering logic on programmability-limited switching ASICs, (2)state compressionto track tens of millions of connections with constrained hardware memory, and (3)per-tenant packet rate limit and tenant-aware flow migrationto achieve efficient performance isolation among different tenants. Overall,CoFilterimplements a high-performance stateful packet filter via the co-design of programmable switching ASIC and CPU. We evaluateCoFilterunder various data center traffic traces with real-world flow distributions. The evaluation results show thatCoFilterremarkably outperforms NetFilter, i.e., forwarding packets at line rate (13x throughput of NetFilter), keeping packet delay within 1us, and freeing a significant quantity of CPU cores, with rather small memory usage, i.e., accommodating over$10^7$connections with only 16MB SRAM.

In distributed storage systems, Erasure Coding (EC) is a crucial technology to enable high data availability. By downloading parity data from survived machines, EC can reconstruct lost data with much lower storage overheads than data replication. However, this reduction in storage cost comes at the expense of extra performance problems:low reconstruction rate,high degraded read latency, andhigh host CPU utilization. Our analysis shows that these performance problems are deeply rooted in thehost-basedEC processing. To resolve these problems, we present NetEC, an in-network accelerating framework that fully offloads EC to the new generation programmable switching ASICs. We propose Explicit Buffer Size Notification (EBSN) to constrain decoding buffer usage, and design an on-switch one-to-many TCP proxy to integrate EBSN with TCP. We also design two parallel Galois Field (GF) offloading methods—table lookup and bitmatrix methods—to maximize parsable bytes. We implement NetEC on programmable switches and integrate it with HDFS. Extensive evaluations show that NetEC improves the reconstruction rate by 2.7x-6.8x, reduces the degraded read latency significantly, and removes the host CPU overhead completely. We also emulate multi-rack scenarios and show that NetEC is able to support$\sim$∼GB/s reconstruction rate and tens of concurrent tasks.

No abstract available.

No abstract available.

Graph Neural Networks (GNNs) have achieved state-of-the-art performance in various graph structure related tasks such as node classification and graph classification. However, GNNs are vulnerable to adversarial attacks. Existing works mainly focus on attacking GNNs for node classification; nevertheless, the attacks against GNNs for graph classification have not been well explored.

Satellite Internet is a critical part of future Internet infrastructure. Many existing studies focus on leveraging limited satellite resources to provide high quality of service (QoS), under the assumption that each satellite node has identical capacity. We propose to use customized satellite capacity based on traffic demands, and improve QoS from the network deployment point of view. In this paper, we tackle the problem of satellite resource allocation for civil aviation, which is an important application scenario of satellite Internet. We make analysis on real flight traces, model the access capacity allocation problem formally, which is most significant since it will subsequently influence the routing capacity and the satellite-to-ground-station (S2GS) capacity allocation, and prove that the problem is NP-hard. We propose the SARACA scheme and develop several algorithms to solve the access part, the routing part, and the S2GS part of the resource allocation problem and guarantee to meet the maximum traffic demand under dynamic circumstances. Simulation results show that SARACA achieves the least total deployment cost with good QoS compared with current approaches.

Service-level objectives (SLOs), as network performance requirements for delay and packet loss typically, should be guaranteed for increasing high-performance applications, e.g., telesurgery and cloud gaming. However, SLO violations are common and destructive in today’s network operation. Detection and diagnosis, meaning monitoring performance to discover anomalies and analyzing causality of SLO violations respectively, are crucial for fast recovery. Unfortunately, existing diagnosis approaches require exhaustive causal information to function. Meanwhile, existing detection tools incur large overhead or are only able to provide limited information for diagnosis. This paper presents DOVE, a diagnosis-driven SLO detection system with high accuracy and low overhead. The key idea is to identify and report the information needed by diagnosis along with SLO violation alerts from the data plane selectively and efficiently. Network segmentation is introduced to balance scalability and accuracy. Novel algorithms to measure packet loss and percentile delay are implemented completely on the data plane without the involvement of the control plane for fine-grained SLO detection. We implement and deploy DOVE on Tofino and P4 software switch (BMv2) and show the effectiveness of DOVE with a use case. The reported SLO violation alerts and diagnosis-needing information are compared with ground truth and show high accuracy (>97%). Our evaluation also shows that DOVE introduces up to two orders of magnitude less traffic overhead than NetSight. In addition, memory utilization and required processing ability are low to be deployable in real network topologies.

Erasure-coded redundancy is a fault-tolerant method with low-cost storage overhead. It only stores data fragments and parity fragments rather than full data across the cluster. The write process of erasure-coded data can be asynchronous or synchronous. For synchronous write process, data are encoded when written to servers. The common method doing the process needs to confirm that each coded-fragment of the data is stored in a different server to maintain the best fault tolerance. This method underperforms in terms of availability, and also fails to achieve good performance because any failure of servers will shortly disturb the write process. Some consensus protocols such as RS- Paxos and CRaft, which are based on Paxos and Raft, can solve above problems by providing fault-tolerant ability for systems. However, RS-Paxos cannot achieve the same liveness as Paxos. CRaft still adopts full data redundancy to keep the same liveness as Raft when there are not enough healthy servers. Therefore, to solve the availability problem during synchronous erasure-coded data write process, we present a novel protocol ECRaft based on Raft. It always uses erasure-coded redundancy when the ratio of erasure-coded data fragments to parity fragments is bigger than 1. It also can reach the same liveness as Raft. With state machine purge, storage redundancy can be reduced to the extent that typical erasure-coded storage systems can achieve. We build a key-value store based on ECRaft to evaluate it. In our experiments, compared with CRaft using complete-entry replication, ECRaft can save 63 % of storage, increase write throughput by 28.2 %, and reduce write latency by 19 %.

Emerging applications raise critical QoS requirements for the Internet. The improvements of flow classification technologies, software defined networks (SDN), and programmable network devices make it possible to fast identify users' requirements and control the routing for fine-grained traffic flows. Meanwhile, the problem of optimizing the forwarding paths for traffic flows with multiple QoS requirements in an online fashion is not addressed sufficiently. To address the problem, we propose DRL-OR, an online routing algorithm using multi-agent deep reinforcement learning. DRL-OR organizes the agents to generate routes in a hop-by-hop manner, which inherently has good scalability. It adopts a comprehensive reward function, an efficient learning algorithm, and a novel deep neural network structure to learn an appropriate routing policy for different types of flow requirements. To guarantee the reliability and accelerate the online learning process, we further introduce safe learning mechanism to DRL-OR. We implement DRL-OR under SDN architecture and conduct Mininet-based experiments by using real network topologies and traffic traces. The results validate that DRL-OR can well satisfy the requirements of latency-sensitive, throughput-sensitive, latency-throughput-sensitive, and latency-loss-sensitive flows at the same time, while exhibiting great adaptiveness and reliability under the scenarios of link failure, traffic change, and partial deployment.

Multi-string pattern matching is a crucial building block for many network security applications, and thus of great importance. Since every byte of a packet has to be inspected by a large set of patterns, it often becomes a bottleneck of these applications and dominates the performance of an entire system. Many existing works have been devoted to alleviate this performance bottleneck either by algorithm optimization or hardware acceleration. However, neither one provides the desired scalability and costs that keep pace with the dramatic increase of the network bandwidth and network traffic today. In this paper, we present BOLT, a scalable and cost-efficient multi-string pattern matching system leveraging the capability of emerging programmable switches. BOLT combines the following two techniques, a smart state encoding scheme to fit a large number of strings into the limited memory on the programmable switch, and a variable k-stride transition mechanism to increase the throughput significantly with the same level of memory costs. We implement a prototype of BOLT and make its source code publicly available. Extensive evaluations demonstrate that BOLT could provide orders of magnitude improvement in throughput which is scalable with pattern sets and workloads, and could also significantly decrease the number of entries and memory requirement.

Dynamic networks have enabled dynamically adapting the network topology to meet the need of real-time traffic demands. However, due to the complexity of topology optimization, existing solutions suffer from a trade-off between performance and efficiency, which either have large optimality gaps or excessive optimization overhead. To break through this trade-off, our key observation is that we could offload the optimization procedure to every network node to handle the complexity. Thus, we propose HierTopo, a hierarchical topology optimization method for dynamic networks that achieves both high performance and efficiency. HierTopo firstly runs a local policy on each network node to aggregate network information into low-dimension features, then uses these features to make global topology decisions. Evaluation on real-world network traces shows that HierTopo outperforms the state-of-the-art solutions by 11.52-38.91% with only milliseconds of decision latency, and is also superior in generalization ability.

Lots of studies focus on distributed traffic engineering (TE) where routers make routing decisions independently. Existing approaches usually tackle distributed TE problems through traditional optimization methods. However, due to the intrinsic complexity of the distributed TE problems, routing decisions cannot be obtained efficiently, which leads to significant performance degradation, especially for highly dynamic traffic. Emerging machine learning technologies like deep reinforcement learning (DRL) provide a new choice to address TE problems in an experience-driven method. In this paper, we propose DATE, a distributed and adaptive TE framework with DRL. DATE distributes well-trained agents to the routers in the located network. Each agent makes local routing decisions independently based on link utilization ratios flooded by each router periodically. To coordinate the distributed agents to achieve the global optimization in different traffic conditions, we construct candidate paths, develop the agents carefully, and realize a virtual environment to train the agents with a DRL algorithm. We do extensive simulations and experiments using real-world network topologies with both real and synthetic traffic traces. The results show that DATE outperforms some existing approaches and yields near-optimal performance with superior robustness.

Low earth orbit (LEO) satellite networks are promising at constructing the satellite Internet. Dynamics of a large-scale LEO network topology induces critical problems on routing efficiency and scalability. Existing approaches either suffer from such routing problems, or have limited resilience against unpredictable link/node failures. We propose Area-based SatellitE Routing (ASER), a fully distributed routing protocol for LEO networks with high efficiency and scalability. ASER uses a hierarchical routing mechanism, which groups satellites into areas, in such a way that the inter-area routing never changes due to handovers of inter-satellite links. Routing can be quickly reconstructed with little overhead when either regular or unpredictable topology changes occur. We develop ASER based on OSPF, and propose an efficient algorithm to construct the forwarding table, enabling standard packet forwarding. Simulations validate that ASER can reduce the convergence time by more than 50%, and reduce computation and control overhead by orders of magnitude.

To improve the performance of mobile web service, a new transport protocol, QUIC, has been recently proposed. However, for large-scale real-world deployments, deciding whether and when to use QUIC in mobile web service is challenging. Complex temporal correlation of network conditions, high spatial heterogeneity of users in a nationwide deployment, and limited resources on mobile devices all affect the selection of transport protocols. In this paper, we present WiseTrans to adaptively switch transport protocols for mobile web service online and improve the completion time of web requests.

Distributed Denial-of-Service (DDoS) attacks have become a critical threat to the Internet. Due to the increasing number of vulnerable Internet of Things (IoT) devices, attackers can easily compromise a large set of nodes and launch high-volume DDoS attacks from the botnets. State-of-the-art DDoS defenses, however, have not caught up with the fast development of the attacks. Middlebox-based defenses can achieve high performance with specialized hardware; however, these defenses incur a high cost, and deploying new defenses typically requires a device upgrade. On the other hand, software-based defenses are highly flexible, but software-based packet processing leads to high performance overheads. In this article, we propose Poseidon, a system that addresses these limitations in today's DDoS defenses. It leverages emerging programmable switches, which can be reconfigured in the field without additional hardware upgrades. Users of Poseidon can specify their defense strategies in a modular fashion in the form of a set of defense primitives; this can be further customized easily for each network and extended to include new defenses. Poseidon then maps the defense primitives to run on programmable switches-and when necessary, on server software-for effective defense. When attacks change, Poseidon can reconfigure the underlying defense primitives to respond to the new attack patterns. Evaluations using our prototype demonstrate that Poseidon can effectively defend against high-volume attacks, easily support customization of defense strategies, and adapt to dynamic attacks with low overheads.

Major commercial client-side video players employ adaptive bitrate (ABR) algorithms to improve the user quality of experience (QoE). With the evolvement of ABR algorithms, increasingly complex methods such as neural networks have been adopted to pursue better performance. However, these complex methods are too heavyweight to be directly deployed in client devices with limited resources, such as mobile phones. Existing solutions suffer from a trade-off between algorithm performance and deployment overhead. To make the deployment of sophisticated ABR algorithms practical, we propose PiTree, a general, high-performance, and scalable framework that can faithfully convert sophisticated ABR algorithms into decision trees with teacher-student learning. In this way, network operators can train complex models offline and deploy converted lightweight decision trees online. We also present theoretical analysis on the conversion and provide two upper bounds of the prediction error during the conversion and the generalization loss after conversion. Evaluation on three representative ABR algorithms with both trace-driven emulation and real-world experiments demonstrates that PiTree could convert ABR algorithms into decision trees with <; 3% average performance degradation. Moreover, compared to original deployment solutions, PiTree could save considerable operating expenses for content providers.

Software-Defined Networking (SDN) continues to be deployed spanning from enterprise data centers to cloud computing with the proliferation of various SDN-enabled hardware switches and dynamic control plane applications. However, state-of-the-art SDN-enabled hardware switches have rather limited downlink message processing capability, especially for Flow-Mod and Statistic Query, which may not suffice the huge need of dynamic control plane applications. In this paper, we systematically study the interactions between the control plane applications and the data plane switches, and present two new attacks, namely Control Plane Reflection Attacks, to exploit the limited processing capability of SDN-enabled hardware switches. The reflection attacks adopt direct and indirect data plane events to force the control plane to issue massive expensive downlink messages towards SDN switches. Moreover, we propose a two-phase probing-triggering attack strategy, which makes the reflection attacks much more efficient and powerful. Experiments on a testbed with 3 different physical OpenFlow switches demonstrate that the attacks can lead to catastrophic results such as hurting the establishment of new flows and even disruption of connection between SDN controller and switches. To mitigate such attacks, we present several countermeasures from different perspectives. In particular, we propose a novel, systematical defense framework, SwitchGuard, to detect anomalies of downlink messages and prioritize these messages based on a novel monitoring granularity, i.e., host-application pair (HAP). Implementations and evaluations demonstrate that SwitchGuard can effectively reduce the latency for legitimate hosts and applications under the control plane reflection attacks with only minor overheads.

Modern network devices and systems are raising higher requirements on network testers that are regularly used to evaluate performance and assess correctness. These requirements include high scale, high accuracy, flexibility and low cost, which existing testers cannot fulfill at the same time. In this paper, we propose HyperTester, a network tester leveraging new-generation programmable switches and achieving all of the above goals simultaneously. Programmable switches are born with features like high throughput and linerate, deterministic processing pipelines and nanosecond-level hardware timestamps, the P4 programming model as well as comparable pricing with commodity servers, but they come with limited programmability and memory resources. HyperTester uses template-based packet generation to overcome the limitations of the switch ASIC in programmability and designs a stateless connection mechanism as well as counter-based state compression algorithms to overcome the memory resource constraints in the data plane. We have implemented HyperTester on Tofino, and the evaluations on the hardware testbed show that HyperTester supports high-scale packet generation (more than 1.6Tbps) and achieves highly accurate rate control and timestamping. We demonstrate that programmable switches can be potential and attractive targets for realizing network testers.

Monitoring network traffic based on operators' intents is essential to today's networks. As the bandwidth and size of networks increase steeply, monitoring systems shall fulfill the requirements of on-demand network monitoring for ever-growing traffic volumes. However, existing monitoring systems either cannot satisfy operators' intents on demand or introduce substantial monitoring overheads. In this paper, we present Newton, an intent-driven traffic monitor that enables specifying operators' intents with traffic monitoring queries and supports dynamic and scalable network-wide queries. Specifically, Newton 1) empowers operators to dynamically create, remove, and update on-data-plane queries without interrupting normal packet forwarding, 2) conducts systematic optimizations to achieve precise network traffic monitoring, and 3) executes network-wide queries with high resilience to dynamic network status. Evaluation results show that Newton improves the flexibility, scalability, and resource efficiency of traffic monitoring, demonstrating its great potential to be deployed in large-scale programmable networks.

Network telemetry is to collect information (e.g., hop latency, throughput) from network devices. Network-wide telemetry is critical for operators to understand the quality of network performance and to diagnose on-going failures. The state-of-the-art telemetry approaches are far from ideal as they are unable to fully satisfy diverse requirements of operators, specifically for on-demand, full coverage, and scalable telemetry. In this paper, we provide a new framework of network telemetry for data center networks, called NetView. NetView can support various telemetry applications and frequencies on demand, monitoring each device via proactively sending dedicated probes. Technically, NetView leverages source routing to forward probes, achieving full coverage. Besides, a series of probe generation algorithms largely reduce probe number, providing high scalability. The evaluation shows that NetView reduces the bandwidth occupancy by more than two orders of magnitude compared with Pingmesh and INT-path, and conducts network-wide telemetry for large-scale data center network using only one vantage server, without bringing about resources bottleneck.

Smart Network Interface Cards (SmartNICs) have been widely used to accelerate software-based network functions (NFs). However, from the scope of a service chain, a careless selection of NFs to offload onto SmartNIC could severely degrade the performance due to frequent communications between CPU and SmartNIC. In this paper, we present SmartChain, a high performance and efficient framework that achieves optimal partition of service chains between SmartNIC and CPU. SmartChain consists of two logical steps. First, SmartChain analyzes the suitability of elements in a chain to run on SmartNIC to exploit its high performance. Besides, SmartChain also ensures the dependencies between elements. Second, as our key novelty, SmartChain models the service chain latency and resource constraints, and solves the partition problem with 0-1 integer linear programming. We implement a SmartChain prototype based on Netronome SmartNIC. Evaluation results show that when used in real world cases, SmartChain could reduce the service chain latency by up to 87% with throughput maintained compared with strawman solutions.

Traffic engineering (TE) attracts extensive researches over the years. Operators expect to design a TE scheme which accommodates traffic dynamics well and achieves good TE performance with little overhead. Some approaches like oblivious routing compute an optimal static routing based on a large traffic matrix (TM) range, which usually leads to much performance loss. Many approaches compute routings based on one or a few representative TMs obtained from observed historical TMs. However, they may suffer performance degradation for unexpected TMs and usually induce much overhead of system operating. In this paper, we propose ALTE, an adaptive and low-cost TE scheme based on TM classification. We develop a novel clustering algorithm to properly group a set of historical TMs into several clusters and compute a candidate routing for each TM cluster. A machine learning classifier is trained to infer the proper candidate routing online based on the features extracted from some easily measured statistics. We implement a system prototype of ALTE and do extensive simulations and experiments using both real and synthetic traffic traces. The results show that ALTE achieves near-optimal performance for dynamic traffic and introduces small overhead of routing updates.

Data plane programming languages enable administrators of Software-Defined Networks (SDNs) to perform fine-grained flow control by compiling high-level policies into low-level rules and deploying rules in the data plane. However, it is difficult to scale the data plane with the dynamics of network traffic and the limited storage space of switches. In this paper, we propose a lazy OpenFlow Rule Placement (ORP) framework to enforce control polices and scale the SDN data plane by placing and reusing wildcard rules. We provide an offline rule placement scheme to meet performance objectives under real-world constraints. To handle dynamic traffic and perform incremental rule updates, we design an online matching rule deployment algorithm to place rules in polynomial time and prove it to be conditionally-optimal. Furthermore, to address the rule dependency problem during online rule placement, we extend the algorithm to deploy dependent rules and present lightweight heuristics to guarantee the fast reaction to the new flows. Extensive experiments are conducted on diverse network topologies and datasets to show that the lazy ORP framework significantly reduces the storage cost, improves data plane scalability and is flexible enough to accomplish different optimization goals.

Faithfully emulating networks is critical for verifying the correctness and effectiveness of new networking-related designs. Existing network experiment platforms either cannot faithfully emulate functionality and performance of production networks or cannot scale well because of cost limitations. In this paper, we propose TurboNet, a new network emulator that leverages one programmable switch to enable faithful emulation of both network data plane and control plane. For data plane emulation, we present a series of key designs such as port mapper, queue mapper, and delayed queue to emulate network topologies and performance metrics with high flexibility and accuracy. For control plane emulation, we support static routing configurations, distributed routing agents, and the centralized routing controller. Meanwhile, we provide API for operators to simplify network emulation tasks. We implement TurboNet on a Tofino switch. The evaluation results show that: (1) TurboNet can flexibly emulate various topologies such as the 8-ary fat-tree on the data plane and support about 200 BGP agents with 25% CPU usage on the control plane; (2) TurboNet can accurately emulate different network performance metrics, including 400Gbps linerate background traffic injection, as small as 10-8link loss, and microsecond-level to millisecond-level link delay.

Traffic engineering (TE) in multi-region networks is a challenging problem due to the requirement that each region must independently compute its routing decisions based on local observations, yet with the goal of optimizing global TE objectives. Traditional approaches often lack the agility to adapt to changing traffic patterns and thus may suffer hefty performance loss under highly dynamic traffic demands. In this paper, we propose a data-driven framework for multi-region TE problems, which makes novel use of multi-agent deep reinforcement learning. In particular, we propose two reinforcement learning agents for each region, namely T-agents and O-agents, to control the terminal traffic and outgoing traffic, respectively. These distributed agents collect local link utilization statistics within their regions, optimize local routing decisions, and observe the resulting congestion-related reward. To facilitate these agents for optimizing global TE objectives, we tailor the agent design carefully including input, output, and reward functions. The proposed framework is evaluated extensively using real-world network topologies (e.g., Telstra and Google Cloud) and synthetic traffic patterns (e.g., the Gravity model). Numerical results show that comparing with existing protocols and single-agent learning algorithms, our solution can significantly reduce congestion and achieve nearly-optimal performance with both superior scalability and robustness. Throughout our simulations, over 90% of tests limit congestion within 1.2 times the global optimal solution.

Advanced network management systems, including network measurement and traffic control, rely on a remote controller to make control decisions. However, this approach incurs a long control loop of a few seconds to minutes. Even if we switch to switch-local controller, the latency is still tens of milliseconds and is unacceptable for many latency-sensitive tasks. In this paper, we propose Martini, a general framework that supports measurement-based timely control. The key idea is to perform measurement, control decision, and control entirely in the switch data plane. This could shorten the control loop of management tasks that require timely control based on only locally measured statistics in the switch. First, Martini introduces a set of primitives to describe management tasks. Next, Martini provides an innovative network-wide task placement mechanism to exploit resources of all switches to accommodate massive management tasks. Finally, Martini provides a code library and a compiler to support measurement and control on a state-of-the-art switching ASIC. Evaluation results show that Martini can effectively support a wide range of fine-timescale management tasks such as microburst detection and fast load balancing by reducing the control loop from seconds to nanoseconds.

Spoofed traffic has been a great threat to the Internet. Tag-based inter-AS source address validation solutions show great effectiveness and high deployment incentives on filtering spoofed traffic. However, they fail to consider secure key negotiation for tags, efficient tag generation for network devices, and compatible tag placement for network functionalities. In this paper, we present SEC, a secure, efficient, and compatible source address validation scheme based on packet tags. We provide a secure key negotiation method and a lightweight tag generation algorithm for SEC considering hardware limitations of network devices. They can be easily implemented in network devices to filter spoofed packets while forwarding packets at approximately line rate. We also carefully place all tags into appropriate option fields in packet headers to guarantee the compatibility of network functionalities. We implement SEC in real programmable switches. Both theoretical analysis and experimental results show SEC can verify source addresses of packets in a secure, efficient, and compatible way.

The Border Gateway Protocol (BGP) is the de facto standard interdomain routing protocol. A major problem affecting the operation of BGP is its failure to provide security guarantees. Despite some high-profile security extensions proposed, none of them has been largely deployed by Autonomous Systems (AS) in the global Internet. Previous studies show that three main factors hinder the adoption of BGP security solutions: limited benefits in partial deployment, computational overheads, and the trouble of coordinating among tens of thousands of independent ASes. In this paper, we present Neighbor Routes Validator (NRV), a lightweight prototype system of BGP security enhancement. Instead of depending on a single centralized authority, NRV focuses on neighboring ASes' self-driven collaborations that significantly reduce the scale of coordination. It aims to address real-world security issues of BGP and uses the privacy-preserving capability of Secure Multi-Party Computation (SMPC) to dispel ASes' privacy concerns. Security analyses and simulations demonstrate the feasibility of NRV, and we also argue that network operators have incentives to deploy it after weighing the pros and cons.

Many enterprises run Network Function Virtualization (NFV) services on public clouds to relieve management burdens and reduce costs. However, NFV operators still face the burden of choosing the right types of virtual machines (VMs) for various network functions (NFs), as well as the cost of renting VMs at a granularity of months or years while many VMs remain idle during valley hours. A recent computing model named serverless computing automatically executes user-defined functions on requests arrival, and charges users based on the number of processed requests. For NFV operators, serverless computing has the potential of completely relieving NF management burden and significantly reducing costs. Nevertheless, naively exploring existing serverless platforms for NFV introduces significant performance overheads in three aspects, including high remote state access latency, long NF launching time, and high packet delivery latency between NFs. To address these problems, we propose Serpens, a high-performance serverless platform for NFV. Firstly, Serpens designs a novel state management mechanism to support local state access. Secondly, Serpens proposes an efficient NF execution model to provide fast NF launching and avoid extra packet delivery. We have implemented a prototype of Serpens. Evaluation results demonstrate that Serpens could significantly improve performance for NFs and service function chains (SFCs) comparing to existing serverless platforms.

Network performance anomalies (NPAs), e.g. long-tailed latency, bandwidth decline, etc., are increasingly crucial to cloud providers as applications are getting more sensitive to performance. The fundamental difficulty to quickly mitigate NPAs lies in the limitations of state-of-the-art network monitoring solutions --- coarse-grained counters, active probing, or packet telemetry either cannot provide enough insights on flows or incur too much overhead. This paper presents NetSeer, a flow event telemetry (FET) monitor which aims to discover and record all performance-critical data plane events, e.g. packet drops, congestion, path change, and packet pause. NetSeer is efficiently realized on the programmable data plane. It has a high coverage on flow events including inter-switch packet drop/corruption which is critical but also challenging to retrieve the original flow information, with novel intra- and inter-switch event detection algorithms running on data plane; NetSeer also achieves high scalability and accuracy with innovative designs of event aggregation, information compression, and message batching that mainly run on data plane, using switch CPU as complement. NetSeer has been implemented on commodity programmable switches and NICs. With real case studies and extensive experiments, we show NetSeer can reduce NPA mitigation time by 61%-99% with only 0.01% overhead of monitoring traffic.

While many deep learning (DL)-based networking systems have demonstrated superior performance, the underlying Deep Neural Networks (DNNs) remain blackboxes and stay uninterpretable for network operators. The lack of interpretability makes DL-based networking systems prohibitive to deploy in practice. In this paper, we propose Metis, a framework that provides interpretability for two general categories of networking problems spanning local and global control. Accordingly, Metis introduces two different interpretation methods based on decision tree and hypergraph, where it converts DNN policies to interpretable rule-based controllers and highlight critical components based on analysis over hypergraph. We evaluate Metis over two categories of state-of-the-art DL-based networking systems and show that Metis provides human-readable interpretations while preserving nearly no degradation in performance. We further present four concrete use cases of Metis, showcasing how Metis helps network operators to design, debug, deploy, and ad-hoc adjust DL-based networking systems.

With the development of Internet of Things (IoT), edge computing becomes more and more prevalent currently. However, edge computing needs to deploy a large number of edge servers to reduce the communication latency, which will bring additional costs to the system. Although there exist some idle computing resources at the edge, the owners distrust each other and lack the incentives to contribute to the system. In this article, we propose a new edge computing platform decentralized and trusted platform for edge computing (DeTEC), which provides a unified interface to users, resolves the user's requests to the most appropriate edge server through domain name server, and returns the computational results to the IoT user. To build a trustworthy system, DeTEC integrates the blockchain technology with edge computing, such that the contributions of each participant could be accounted and rewarded. We formulate the task allocation problem, taking both node capacity and reward fairness into consideration, and solve it through a heuristic algorithm. Finally, to guarantee the trustworthiness of computational results, we utilize a police patrol model and try to optimize the system overall reward. We implement DeTEC based on an open source project and conduct comprehensive experiments to test its performance. The results show that our DeTEC system works well in the IoT scenario.

Industrial Internet of Things (IIoT) has been widely used in many fields. Meanwhile, blockchain is considered promising to address the issues of the IIoT. However, the current blockchains have a limited throughput. In this article, we devise an efficient and secure blockchain protocol compacted directed acyclic graph (CoDAG) based on a compacted directed acyclic graph, where blocks are organized in levels and width. New-generated blocks in the CoDAG will be placed appropriately and point to those in the previous level, making it a well-connected channel. Transactions in the network will be confirmed in a deterministic period, and the CoDAG keeps a simple data structure at the same time. We also illustrate the attack strategies by adversary, and it is proved that our protocols are resistant to these attacks. Furthermore, we design a CoDAG-based IIoT architecture to improve the efficiency of the IIoT system. Experimental results show that the CoDAG achieves 164× Bitcoin's throughput and 77× Ethererum's throughput.

With increasing demands for more flexible services, the routing policies in enterprise networks become much richer. This has placed a heavy burden to the current router forwarding plane in support of the increasing number of policies, primarily due to the limited capacity in TCAM, which further hinders the development of new network services and applications. The scalable forwarding table structures for enterprise networks have therefore attracted numerous attentions from both academia and industry. To tackle this challenge, in this paper we present the design and implementation of a new forwarding table structure. It separates the functions of TCAM and SRAM, and maximally utilizes the large and flexible SRAM. A set of schemes are progressively designed, to compress storage of forwarding rules, and maintain correctness and achieve line-card speeds of packet forwarding. We further design an incremental update algorithm that allows less access to memory. The proposed scheme is validated and evaluated through a realistic implementation on a commercial router using real datasets. Our proposal can be easily implemented in the existing devices. The evaluation results show that the performance of forwarding tables under the proposed scheme is promising.

Load balancing in datacenter networks (DCNs) is an important and challenging task for datacenter managers. A number of sophisticated technologies have been proposed to improve load balancing performance in a complicated circumstance, i.e., with various traffic characteristics. Many approaches need a high cost to implement, such as changing switch hardware. The efficiency problem has not been well addressed. MPTCP was proposed as a low-cost approach to improve data transmission in DCNs, which uses subflows to balance workloads across multiple paths. However, current MPTCP is not satisfying, especially when there are rack-local flows or many-to-one short flows. In this article, we propose DCMPTCP to improve the efficacy of MPTCP. We gradually develop three mechanisms. First, DCMPTCP identifies rack-local traffic and eliminates unnecessary subflows to reduce the overhead. Second, DCMPTCP estimates flow length and establishes subflows in a smarter way. Third, DCMPTCP strengthens explicit congestion notification to improve the congestion control performance on inter-rack many-to-one short flows. We have implemented DCMPTCP in both the Linux kernel and ns-3 simulator. Our comprehensive testbed experiments and simulations show that DCMPTCP outperforms MPTCP in both 1 Gbps testbed, and 10 Gbps large-scale simulation network.

Modern network research and operations are inseparable from network testers to evaluate performance limits of proofs-of-concept, troubleshoot failures, etc. Existing network testers suffer from either constrained flexibility or a low performance-cost ratio. In this paper, we propose a new network tester, HyperTester. The core of HyperTester is to leverage new-generation programmable switches for generating and capturing test traffic with high performance, low cost, and remarkable flexibility. We design a series of efficient mechanisms, including template-based packet generation, false-positive-free counter-based queries, and stateless connections to realize various network testing tasks upon switches with limited programmability and resources. Meanwhile, to facilitate developing testing tasks upon HyperTester, we provide a high-level network testing API. We have implemented HyperTester on the Tofino switch and built dozens of network testing tasks. The evaluations on the hardware testbed show that HyperTester supports line-rate packet generation (400Gbps in the testbed) with highly-accurate rate control, while HyperTester can save $40150 per Tps and 9225W per Tbps when compared with the software network testers.

Fast rerouting (FRR) has become an important technology for networks to enhance the resilience against failures. On the other hand, there is an increasing interest on integrating routing control and network functions, enabling highly programmable, adaptive, and cross-layer networking. In this paper, we propose a unified FRR scheme (UFRR) under the circumstance of network function virtualization and service function chain (SFC). By exposing the SFC information to the network layer, UFRR can make rerouting decisions that are more flexible, and protect the routing against various types of failures, including switch, router, and server failures. We propose the system architecture, and develop two algorithms to compute rerouting paths, which consider path length and forwarding entry number concurrently. Simulation results show that the unified FRR is effective, and the path stretch can be reduced by more than 10% compared to a typical network layer FRR scheme, while the forwarding entry number remains similar.

Network function virtualization has become a promising technology recently. To accommodate dynamic traffic such as burst, NFV can scale virtual network functions (VNFs) across several physical servers, which is known as horizontal scaling, or enlarge the capacity of a VNF leveraging idle resources in one physical server, which is called vertical scaling. Vertical scaling should be used as much as possible to accommodate user traffic increment immediately, and horizontal scaling is only performed when vertical scaling cannot allocate sufficient resource to meet the demand. We find that just to reserve redundant resource is far from sufficient to enable vertical scaling with good performance, and VNF placement plays a crucial role. In this paper, we model the scalable VNF placement problem formally, and prove that the problem is NP-hard. Then, we develop two online heuristic algorithms gradually to solve the problem. The sVNFP algorithm focuses on maximizing the vertical scalability, while the sVNFP-adv algorithm considers path length and server utilization concurrently. Simulation results show that our algorithms can reduce packet loss ratio by 15% to 40%, with a short path length and a high server utilization.

Network Function Virtualization (NFV) provides middleboxes with substantial elasticity from a system level, and Artificial Neural Network (ANN) empowers middleboxes with great intelligence from an algorithm-level perspective. However, when ANN-based Network Functions (NFs) want to take advantage of the elasticity of NFV, our study finds that huge gaps exist between the existing approaches and the ideal goals for the elasticity control of ANN-based NFs. By revealing the key differences between ANN-based NFs and traditional NFs, we propose LEGO, an innovative framework that provides systematic mechanisms for traffic splitting, instance partition and runtime management to enable correct and efficient scaling of ANN-based NFs. Preliminary implementation and evaluation demonstrate the feasibility and effectiveness of the LEGO system. The major purpose of this paper is to highlight these challenges and sketch out a new roadmap towards ANN-based NFV paradigm.

Software-Defined Networking (SDN) provides a tractable and efficient architecture for operators to customize their network functions. Many traditional Data Center Networks (DCNs) are upgraded by SDN to improve link utilization and management flexibility, but they are lack of the instructions for selecting the substitutive SDN switches with the proper flow table space to achieve cost-effective and energy-saving networks. In this paper, we fill the gap of solving the flow table space estimation problem based on queuing theory. First, we divide the life process of a flow table entry into the packet-in process, the handling process and the serving process to establish a queuing system to estimate the least required number of the flow table entries of SDN switches. Second, we analyze the traffic distribution of DCNs to calculate the critical parameters in our model. Third, on the basis of the essence of the structured topologies in DCNs, we construct a probability model of routing strategies to quantize the influence of path selection. Comprehensive experiments show that the relative flow table space estimation error of our model can be less than 10%, which can give operators insights into the requirement of the SDN switches at specific positions.

Major commercial client-side video players employ adaptive bitrate (ABR) algorithms to improve user quality of experience (QoE). With the evolvement of ABR algorithms, increasingly complex methods such as neural networks have been adopted to pursue better performance. However, these complex methods are too heavyweight to be directly implemented in client devices, especially mobile phones with very limited resources. Existing solutions suffer from a trade-off between algorithm performance and deployment overhead. To make the implementation of sophisticated ABR algorithms practical, we propose PiTree, a general, high-performance and scalable framework that can faithfully convert sophisticated ABR algorithms into lightweight decision trees to reduce deployment overhead. We also provide a theoretical upper bound on the optimization loss during the conversion. Evaluation results on three representative ABR algorithms demonstrate that PiTree could faithfully convert ABR algorithms into decision trees with <3% average performance degradation. Moreover, comparing to original implementation solutions, PiTree could save operating expenses for large content providers.

In recent years, many companies have developed various distributed computation frameworks for processing machine learning (ML) jobs in clusters. Networking is a well-known bottleneck for ML systems and the cluster demands efficient scheduling for huge traffic (up to 1GB per flow) generated by ML jobs. Coflow has been proven an effective abstraction to schedule flows of such data-parallel applications. However, the implementation of coflow scheduling policy is constrained when coflow characteristics are unknown a prior, and when TCP congestion control misinterprets the congestion signal leading to low throughput. Fortunately, traffic patterns experienced by some ML jobs support to speculate the complete coflow characteristic with limited information. Hence this paper summarizes coflow from these ML jobs as self-similar coflow and proposes a decentralized self-similar coflow scheduler Cicada. Cicada assigns each coflow a probe flow to speculate its characteristics during the transportation and employs the Shortest Job First (SJF) to separate coflow into strict priority queues based on the speculation result. To achieve full bandwidth for throughput- sensitive ML jobs, and to guarantee the scheduling policy implementation, Cicada promotes the elastic transport-layer rate control that outperforms prior works. Large-scale simulations show that Cicada completes coflow 2.08x faster than the state-of-the-art schemes in the information-agnostic scenario.

A logically centralized controller of Software Defined Networking (SDN) is responsible for the management of routing planning and monitoring of network status. With this central control and global visibility, in this paper, we propose a congestion- aware fast failure recovery scheme (CAFFE), which can not only recover the affected flows fast from a wide range of failure scenarios but also avoid potential congestion in the post-recovery network. CAFFE achieves fast recovery by detouring the traffic from neighbour switches as soon as they detect failures and avoids potential congestion by protected paths constructed with the combined consideration of the knowledge of network topology, failure states and network load distribution. We formulate and solve the protected path planning problems where all potential network failures should be protected and the maximum link load in the post- recovery network should be minimized. The resulting protected paths ensure high traffic reachability and low link load even when network failure happens. All these paths are set up a priori by CAFFE. This allows switches to handle failures automatically without the need on waiting for the response from the controller. Experimental results show that CAFFE achieves fast recovery with relatively low overheads on either switches (in terms of backup rule number to configure) or controller (in terms of computational time). It also shows that CAFFE is able to better load-balance the post-recovery network comparing to shortest path re-calculation and OpenFlow-based Segment Protection (OSP).

Load balancing in datacenter networks (DCNs) is an important and challenging task for datacenter managers. A number of sophisticated technologies have been proposed to improve load balancing performance in a complicated circumstance, i.e., with various traffic characteristics. Many approaches need a high cost to implement, such as changing switch hardware. The efficiency problem has not been well addressed. MPTCP was proposed as a low-cost approach to improve data transmission in DCNs, which uses subflows to balance workloads across multiple paths. However, current MPTCP is not satisfying, especially when there are rack-local flows or many-to-one short flows. In this paper, we propose DCMPTCP to improve the efficacy of MPTCP. We gradually develop three mechanisms. First, DCMPTCP identifies rack-local traffic and eliminates unnecessary subflows to reduce the overhead. Second, DCMPTCP estimates flow length and establishes subflows in a smarter way. Third, DCMPTCP strengthens explicit congestion notification to improve the congestion control performance on inter-rack many-to-one short flows. DCMPTCP has a good compatibility and is easy to deploy. We implement DCMPTCP in ns-3 simulator and evaluate the performance by comprehensive simulations. The results show that DCMPTCP achieves ~65-771X and ~10-15X better FCT than MPTCP for rack-local and inter-rack traffic respectively.

With the development of the network applications and services (e.g., video conferencing and streaming, online gaming, e-commerce, etc.), the user experience is becoming increasingly important. For network operators, deploying effective Quality of Service (QoS) technologies is a key approach to ensure a high-quality user experience. Despite a large volume of works from both academia and industry, QoS has not been completely deployed in today's networks. The primary reasons are the complexity of proposed QoS solutions and largely manual per-device configuration of QoS knobs by network administrators. Software-defined networking (SDN) provides a promising alternative due to its centralized global network view, flexible match fields and the separation of the control plane and data plane. In this paper, we present S5, an application sensitive QoS assurance system via$S$DN. In S5, we propose a novel QoS measurement framework based on the vertical QoS mapping between the metrics at different network layers. Based on the precise and fine-grained QoS measurement, our system provides a series of QoS guarantee mechanisms, including intelligent call admission control, optimized queue management, and QoS-routing, to guarantee the QoS metrics for the corresponding application. We implement a prototype to validate the feasibility and effectiveness of our system, and get inspired results.

A fine-grained traffic engineering (TE) that enables per-flow control is considered to be necessary in future Internet. In this paper, we study to realize flow-level TE in conventional networks, where hop-by-hop routing is available, and advanced technologies such as SDN and MPLS are not deployed. Based on analysis and modelling on real Internet traffic, we propose to detect and schedule a few large flows in real time, which dominate the traffic amount. The proposed scheme leverages advanced algorithms for detection, computes the rerouting paths in a centralized server, uses extended OSPF to distribute the routing, and uses a few ACL entries for flow-level forwarding. We formalize the link weight assignment-based large flow scheduling problem and prove that the problem is NP-hard. We develop algorithms to compute the routing and reduce extra LSA number required. We present a set of theoretical results on the TE performance bounds when the number of large flows varies. Experiment and simulation results show that our scheme can reroute large flows within 0.5 second, and the maximum link utilization is within 102% of the optimal solution for source and destination addresses-based flows, while the extra LSA number is small.

Due to the expensive hardware and complex management of the traditional middlebox, a concerted effort toward the virtualized middlebox has been launched in both academia and industry. In this paper, we propose a unified middlebox model, MBBrick, which is composed of three operation modules (classifier, rewriter, and forwarder) and a control module. We then design a language, middlebox language, to describe the MBBrick process. By concatenating different modules, MBBrick can achieve the functions of different middleboxes or service chains in one single super middlebox. We design the framework for managing MBBrick and network resources. We propose the efficient algorithms to optimize the MBBrick deployment and schedule the traffic. We also consider the situation of the network failure and divide it into two types (the normal failure and the MBBrick failure). We propose the backup scheme for each MBBrick to cover the potential failure. If the failure occurs, this method can reduce the impact on the network performance. The experiment results show that MBBrick significantly reduces the processing latency and improves the network throughput.

Multi-link failures may incur heavy packet loss and degrade the network performance. Fast rerouting has been proposed to address this issue by enabling routing protections. However, the effectiveness and efficiency issues of fast rerouting are not well addressed. In particular, the protection performance of existing approaches is not satisfactory even if the overhead is high, and topology constraints need to be met for the approaches to achieve a complete protection. To optimize the efficiency, we first answer the question that whether label-free routing can provide a complete protection against arbitrary multi-link failures in any networks. We propose a model for interface-specific-routing which can be seen as a general label-free routing. We analyze the conditions under which a multi-link failure will induce routing loops. And then, we present that there exist some networks in which no interface-specific-routing (ISR) can be constructed to protect the routing against any k-link failures (k ≥ 2). Then, we propose a tunneling on demand (TOD) approach, which covers most failures with ISR, and activate tunneling only when failures cannot be detoured around by ISR. We develop algorithms to compute ISR properly so as to minimize the number of activated tunnels, and compute the protection tunnels if necessary. We prove that TOD can protect routing against any single-link failures and dual-link failures. We evaluate TOD by simulations with real-world topologies. The results show that TOD can achieve a near 100% protection ratio with small tunneling overhead for multi-link failures, making a better tradeoff than the state-of-the-art label-based approaches.

In Software Defined Networking (SDN), the severe conflict between rule number and memory size has attracted considerable academic attention. Ternary Content Addressable Memory (TCAM), generally used to guarantee the query speed, is a scarce and expensive resource, which limits the number of rules that the switch can support. However, the table miss may increase processing burden of the controller and cause latency issues. Therefore, it is significantly important to improve the efficiency of TCAM in SDN switches. In this paper, we propose BALANCER, a traffic-aware hybrid rule allocation scheme. In BALANCER, we logically split TCAM into two parts: reactive and proactive, which can be dynamically adjusted according to network traffic behavior. Also, we propose an algorithm to generate proactive rules with high entropy in the proactive part, and for the reactive part, we provide a rule caching approach and an efficient rule replacement algorithm, Multi-Bucket. To evaluate BALANCER, we conduct comprehensive experiments with both synthetic and real-world routing policies. Compared with the reactive mode and the proactive mode, results show that BALANCER achieves the least update costs while the number of table misses is extremely close to that in the proactive mode.

User data allowance trading emerges as a promising practice in mobile data networks since it can help mobile networks to attract more users. However, to date, there is no study on user data allowance trading in mobile networks. In this paper, we develop a truthful framework that allows users to bid for data allowance. We focus on preventing price cheating, guaranteeing fairness, and minimizing trading maintenance cost in trading. We formulate the data trading process as a double auction problem and develop algorithms to solve the problem. In particular, we use a uniform price auction based on a competitive equilibrium to defend against price cheating and provide fair-ness. Meanwhile, we leverage linear programming to minimize trading maintenance cost. We conduct extensive simulations to demonstrate the performance of the proposed mechanism. The simulation results show that our trading mechanism is truthful and fair, while incurring a minimized maintenance cost.

Among the schemes proposed for failure recovery in software-defined networks, installing backup paths in advance is considered to be an effective approach to reduce the recovery latency. However, the pre-installation poses undue storage overheads on flow tables. In this paper, we propose a customized and cost-efficient backup scheme, which achieves fast recovery from any single-link failure. We introduce an improved breadth first search algorithm to construct the customized backup paths of flows to accommodate their diverse routing demands. By analyzing the path characteristics carefully, we observe that non-conflicted backup paths can be aggregated with each other to reduce the number of backup rules. We formulate this backup path aggregation as an optimization problem. The challenge is how to aggregate the backup paths without causing routing ambiguity. To this end, we design a two-stage aggregation (2SA) algorithm. At its core, 2SA leverages conflict matrixes to guarantee the correctness of aggregation. We evaluate our scheme comprehensively with both the real-world topologies and generated topologies. Simulation results show that our scheme can pre-install the customized backup paths with much fewer, typically one order of magnitude, backup rules compared to the traditional flow-based protection without aggregation.

Interdependent networks, where two networks depend on each other, are becoming more and more significant in modern systems, e.g., the control and transmission networks in the smart grid. From previous work, it can be concluded that interdependent networks are more vulnerable than a single network. The robustness in interdependent networks deserves special attention. In this paper, we propose a metric of robustness from a new perspective — the balance. We define the balance-coefficient of the interdependent system. Some evaluations verify the impact of the balance property.

Recently, QUIC proposed by Google has drawn great attentions due to several attractive features which improve the page load time for Web applications. The features of QUIC lie across different protocol layers, and the benefits and the limitations introduced by each feature have not been understood sufficiently. In this paper, we focus on the transport aspect of QUIC, with the packet pacing mechanism for congestion control. We conduct an experimental study to evaluate the performance of QUIC as a general-purpose transport protocol, especially when QUIC is used concurrently with TCP, which is still the dominating transport protocol on the Internet. By doing so, we can exploit the potential of QUIC as a transport protocol in other application scenarios besides HTTP/2. It is also useful for the improvement of QUIC itself, because each object transmitted in one stream of a QUIC connection has to compete for resources with other transport protocols on the Internet. We do both testbed and real Internet experiments, on typical network environments such as 4G and WiFi. Our main findings indicate that, QUIC is less competitive than TCP in a network with little loss rate, large buffer, or large propagation delay; the 0-RTT connection establishment feature of QUIC has little advantage over TCP in practice; and the main benefit of QUIC lies in the multi-stream-based multiplexing mechanism.

A variety of wireless communication links today, such as HSPA+ access in high speed trains, balloon-based aerial wireless networks and satellite Internet connections have high loss rates. In such environments, Multipath TCP (MPTCP) offers a robust solution compared to regular TCP. However, MPTCP and existing schedulers suffer from performance degradation for both constant bit rate (CBR) and bulk traffic. To tackle this challenge, we develop LAMPS, a novel scheduler for MPTCP, which considers both the loss and delay when selecting subflows and chooses segments based on subflows' state. The design goal of LAMPS is to achieve a steady performance for different traffic and significantly reduce the unnecessary bandwidth consumption, especially in case of bursty losses. We have implemented LAMPS and evaluated its performance for Dynamic Adaptive Streaming over HTTP (DASH), CBR, and bulk traffic. Our experiment results show that LAMPS preserves application latency, keeps low memory consumption, and significantly reduces extra bandwidth consumption in the presence of high packet loss rate.

It has been widely agreed that the architecture of the Internet is ossified. Many advanced technologies were proposed to deal with the shortcomings of the Internet, such as Quality of Service (QoS), IP multicast, and BGP multipath, but they have not been deployed widely in the Internet. Information-Centric Networking (ICN) has attracted many interests in the research community. The key insight of ICN is that the usage of the Internet has dramatically changed from connecting nodes to accessing information. By the inspiration of ICN thinking, we argue that it is not the ossification of the IP architecture which matters, but the ossification of the business model between ISPs. In this paper, we propose a Supply Chain Management (SCM) based business model to regulate the business relationships between ISPs. The payment flow along Internet Service Providers (ISPs) is changed from the conventional bottom up mode to a chain like mode, very similar to the payment flow of SCM. Simulation results show that the average Autonomous System (AS) hops can be reduced by 47% at most. The hit ratio of replicated contents can be improved by 28% at most, and the profit change of various ASes is almost balanced.

In typical data center networks, an overwhelming majority of the flows are smaller than 200 KB in size, while most transmitted bytes are from a small fraction of large flows. The small flows are usually from the applications interacting with end users, thus they require small completion times. Meanwhile, the data center owners hope to keep the high throughput of the network to make full use of their investments on the network devices. To reduce the completion times of small flows while maintaining the high throughput of the network, we propose a novel transport algorithm, SCT (Transport with Slight Congestion), in this paper. SCT gives small flows higher priority by increasing their congestion windows at a higher rate. Moreover, SCT keeps the network to be in high utilization, thus the throughput of network is guaranteed. Extensive simulations show that SCT can reduce the average completion time of small flows by up to 48% at the expense of degrading the throughput of network by 5% only, compared with DCTCP.

We present a study on minimizing non-renewable energy for the Internet. The classification of renewable and non-renewable energy brings in several challenges. First, it is necessary to understand how the routing system can distinguish the two types of energy in the power supply. Second, the routing problem changes due to renewable energy; and so do the algorithm designs and analysis. We first clarify the model of how routers can distinguish renewable and non-renewable energy supporting their power supply. This cannot be determined by the routing system alone, and involves modeling the energy generation and supply of the grid. We then present the router power consumption model, which has a fixed startup power and a dynamic traffic-dependent power. We formulate a minimum non-renewable energy routing problem, and two special cases representing either the startup power dominates or the traffic-dependent power dominates. We analyze the complexity of these problems, develop optimal and sub-optimal algorithms, and jointly consider QoS requirements such as path stretch. We evaluate our algorithms using real data from both National and European centers. As compared to the algorithms minimizing the total energy, our algorithms can reduce the non-renewable energy consumption for more than 20% under realistic assumptions.

Information-Centric Networking (ICN) is proposed to address the inefficiency of content delivery of IP networks from the perspective of architecture. In contrast, Content Delivery Network (CDN) is an overlay solution in current IP networks. We believe that even though ICN is fully deployed, there is still a role for CDNs to play in ICN networks. Since ISPs in ICN will replicate and forward contents according to their policies and interests, it may not align with the objectives of Content Providers (CPs). Therefore, CPs are willing pay a third party (i.e., CDN providers) a certain fee to meet their own requirements. In this paper, we propose to use the inventory model of Supply Chain Management (SCM) in logistics to formulate the content delivery process of ICN networks. The product-centric model of SCM is well-suited for the content-centric content delivery process of ICN networks. Also, we propose the system framework of inventory Centric Delivery Network (iCDN). Simulation results show that the average cost and link usage of the SCM-based algorithm can be reduced by 52% and 15% respectively compared to the baseline approach.

The previous surveys show that more than 90% of the flows in typical data center networks are smaller than 100KB in size, while most bytes transmitted are from a few large flows. The small flows are usually sensitive to their completion times while the large flows require a high throughput. The previous works usually either achieve low completion times for small flows or high throughput for large flows, but not both. In this paper, we propose PTT (Priority-based and Throughput-guaranteed Transport) to minimize the average completion time of small flows while guaranteeing the high throughput of large flows. We conduct comprehensive simulations to evaluate the performance of PTT. The simulation results show that PTT reduces the average completion time of small flows by up to 27.52% over DCTCP and 23.82% over L2DCT while the throughput of large flows is comparable to that in DCTCP, which is 170.46% better than that in L2DCT.

In Content-Centric Networks (CCN), multiple routers may cache the same content, which makes it possible to retrieve the content chunks in parallel. In this paper, we propose Multi-Source Request and Transmission mechanism (MSRT) for CCN. We develop a MinMax problem to compute the optimal solution to retrieve all the chunks from multiple sources in the shortest time. We prove that the problem is NP complete and thus design a fully polynomial-time approximation algorithm to solve this problem. However, the previous works on multipath congestion control cannot be directly employed in MSRT. Therefore, we then propose the Half eXplicit Congestion Protocol (HXCP) to control the request/transmission pace in MSRT. To demonstrate the performance of MSRT, we construct comprehensive experiments. The results show that 1) our scheme reduces the content transmission time to at most 80%; 2) our multipath congestion control scheme HXCP effectively avoids congestion, improves the throughput and guarantees the fairness in the multi-source/multipath scenario.

In Software Defined Networking (SDN), the configuration inconsistency during updates is one main source of network instability. An efficient updating scheme with configuration consistency is required. In this paper, we propose the scheme of Fast Incremental Consistent Update for SDN (FICUS) based on the relation graph (RG). In our scheme, we analyse the relation between update operations, construct the relation graph and find a proper order of these update operations to avoid inconsistency. To solve the problem, we define two types of relations: the path dependency relation and the path rejection relation. We evaluate our scheme and algorithms by comprehensive experiments. The results show that our scheme needs only 10%–40% of the rules compared with the two-phase update scheme and speeds up the update process by 40% in average.

Multi-link failures in the Internet may incur heavy packet loss and degrade the network performance. Existing approaches have been proposed to address this issue by enabling routing protections. However, the effectiveness and efficiency issues of these approaches are not well addressed. In particular, it has not been answered that whether label-free routing can provide full protection against arbitrary multi-link failures in any networks. We propose a model for interface-specific-routing (ISR) which can be seen as a general label-free routing. We present that there exist some networks in which no ISR can be constructed to protect the routing against any k-link failures (k ≥ 2). To improve the protection effectiveness with little overhead in such cases, we propose a tunneling on demand (TOD) approach in this paper. With our approach, most failures can be covered by ISR, and tunneling is activated only when failures cannot be detoured around by ISR. We develop algorithms to compute ISR properly so as to minimize the number of activated tunnels, and compute the protection tunnels if necessary. We prove that TOD can protect routing against any single-link failures and dual-link failures. We evaluate TOD by simulations with real world topologies. The results show that TOD can achieve a protection ratio higher than 98% with small tunneling overhead for multi-link failures, better than existing tunnel-free approach whose protection ratio is 85% to 95%.

IP lookup plays a significant role in networking. The rapid development of the Internet brings new challenges to IP lookup in recent years. To deal with these challenges, we propose the first algorithm that we are aware of to use Minimal Perfect Hash (MPH) filters in IP lookup. It achieves the information theoretic optimum on-chip memory storage and O(1) worst case on-chip lookup speed. To overcome the shortcoming of MPH filter's no support for insertions, we propose an incremental update algorithm which achieves average update speed of O(1) memory access per update.

BGP measurement is important for monitoring and understanding the Internet anomalies. Most of the previous works on BGP measurement rely on aggregated statistics from BGP monitors, e.g., total updates. However, BGP events may have quite limited visibility. Therefore, merely investigating aggregated data may lead to misunderstanding Internet instability, e.g., overestimating the impact of monitor-local events. In this empirical study, we demonstrate how BGP data are distributed among a large number of monitors. We define eleven features as the analysis targets, and three metrics to quantify disparity. We apply the method to 1.14 TB data and find that the distribution of most of the features is quite uneven, and different types of feature illustrate different levels of disparity. We also observe long periods of persistent high disparity, and a small set of cross-feature highly active monitors. Our analysis highlights the necessity of per-monitor data analysis in future BGP measurement study.

Border Gateway Protocol (BGP) has been and will still be the de-facto standard for inter-domain routing in the Internet. However, the problem of routing oscillations in BGP has not been well addressed, which can introduce lots of unnecessary routing updates and severely degrade network performance. In particular, existing studies need a great effort to be deployed or introduce a large overhead. In this paper, we propose to first detect a routing oscillation quickly after the oscillation happened, and then, we eliminate the routing oscillation by disseminating only one additional path (Add-path). Based on analysis of BGP updates in the routers where oscillations have already happened, we present a general method to detect a routing oscillation within a couple of routing replacements. Then, we show that one more Add-path is enough to stop the oscillation. We propose the Minimal Add-paths BGP (MA-BGP) approach, develop algorithms, and prove that MA-BGP can guarantee stable iBGP by a classical model that captures the underlying semantics of any path vector protocol including BGP. The simulation results show the effectiveness and efficiency of our approach.

Measuring the instability of IP prefixes in BGP is critical for network operation and management. In particular, identifying and investigating the most active prefixes assist in detecting, analyzing, and understanding network problems. The traditional metric to assess the activeness of a prefix is the quantity of BGP update. However, this metric may be strongly affected by monitor-local events: the large amount of updates for a highly active prefix may be caused by an event with rather limited impact area. To cope with the issue, we propose a two-dimensional method: in addition to the traditional metric, Update Quantity (UQ), we introduce Update Visibility (UV). The key idea is that we mark a prefix as a `Highly Active Prefix' only when the large number of updates for it are widely observable. We define five types of active prefixes and propose a measurement method. We apply the method to 947 GB updates; the measurement results show that the two-dimensional method provides a more comprehensive picture of the highly active prefixes in the Internet than traditional single-metric schemes, and provides insights into network operations.

With the recent development of Device-to-Device (D2D) communication technologies, mobile devices will no longer be treated as pure “terminals”, but they could become an integral part of the network in specific application scenarios. In this paper, we introduce a novel scheme of using D2D communications for enabling data relay services in partial Not-Spots, where a client without local network access may require data relay by other devices. Depending on specific social application scenarios that can leverage on the D2D technology, we consider tailored algorithms in order to achieve optimised data relay service performance on top of our proposed network-coordinated communication framework. The approach is to exploit the network's knowledge on its local user mobility patterns in order to identify best helper devices participating in data relay operations. This framework also comes with our proposed helper selection optimization algorithm based on reactive predictability of individual user. According to our simulation analysis based on both theoretical mobility models and real human mobility data traces, the proposed scheme is able to flexibly support different service requirements in specific social application scenarios.

Satellite networks are drawing more and more attention, since they can provide various services to everywhere on the earth. Communication devices in satellites are typically powered by solar panels and battery cells, which are carefully designed to guarantee power supply and avoid deficiency. However, we find that unrestrained use of energy will cause a satellite to age quickly, because the number of recharge/discharge of battery cells is limited. Due to the extremely high cost of satellites, the development of energy-efficient satellite routing to save energy and prolong satellite lifetimes has become significantly important. In this paper, we do comprehensive studies. First, we model the power consumption of a space router, power supply by solar panels, and aging of battery cells formally. Second, we define the energy-efficient satellite routing (EESR) problem, and prove that the EESR problem is NP-hard. Then, we develop three algorithms to gradually solve the EESR problem. GreenSR-B is a baseline algorithm which computes link costs iteratively to compute a routing that minimizes the total recharge/discharge cycle number. GreenSR-A selects space routers to switch into sleep mode to improve energy conservation. GreenSR jointly considers energy efficiency and QoS requirements of path length and the maximum link utilization ratio. We evaluate our algorithms by simulations on a low earth orbit satellite network with real Internet usage traces. The results show that GreenSR can prolong the lifetime of satellite battery cells by more than 40%, with little increment in path length and a small link utilization ratio.

In this paper we study energy conservation in the Internet. We observe that different traffic volumes on a link can result in different energy consumption; this is mainly due to such technologies as trunking (IEEE 802.1AX), adaptive link rates, etc. We design a green Internet routing scheme, where the routing can lead traffic in a way that is green. We differ from previous studies where they switch network components, such as line cards and routers, into sleep mode. We do not prune the Internet topology. We first develop a power model, and validate it using real commercial routers. Instead of developing a centralized optimization algorithm, which requires additional protocols such as MPLS to materialize in the Internet, we choose a hop-by-hop approach. It is thus much easier to integrate our scheme into the current Internet. We progressively develop three algorithms, which are loop-free, substantially reduce energy consumption, and jointly consider green and QoS requirements such as path stretch. We further analyze the power saving ratio, the routing dynamics, and the relationship between hop-by-hop green routing and QoS requirements. We comprehensively evaluate our algorithms through simulations on synthetic, measured, and real topologies, with synthetic and real traffic traces. We show that the power saving in the line cards can be as much as 50 percent.

Energy conservation has become a major challenge to the Internet. Switching part of components into sleep mode is an effective way for energy conservation. Many existing approaches compute routing based on traffic matrices, to balance energy saving and traffic engineering goals, e.g., the maximum link utilization ratio (MLUR). However, accurate traffic matrices are difficult to obtain and change frequently, resulting in lack of routing stability and robustness. We propose to find one energy-aware routing robust to a set of traffic matrices. Such demand-oblivious routing problem has been studied without energy conservation, but it becomes more challenging when energy is considered. To overcome the challenges, we define a metric that reflects the MLUR distance from a routing to the optimal routing under certain energy conservation requirement. We model the problem of minimizing the metric, and analyze the upper bounds. Then, we propose a robust energy-aware routing (REAR) scheme to solve the problem by selecting sleeping links and computing the routing, based on a classical demand-oblivious routing algorithm. We evaluate our algorithms by simulations on real topologies. The results show that REAR is much more robust than existing approaches while more than 35\% line card power can be saved.

User data allowance trading is emerging as a promising field in mobile data networks. Mobile operators are establishing data trading platforms to attract more users. To date, there has been no coherent study on user data allowance trading. In this paper, we develop a truthful framework that allows users to bid for data allowance. We focus on preventing price cheating, guaranteeing fairness and minimizing trading maintenance cost. We model the data trading process as a double auction problem. We develop algorithms to solve the problem. The algorithms use a uniform price based on a competitive equilibrium to defend against price cheating and provide fairness, and use linear programming to minimize trading maintenance cost. We conduct extensive simulations to testify the proposed mechanism. Results show that our mechanism is truthful, fair and can minimize the cost of trading.

Many attempts have been made to detect and analyze anomalous Internet events through dissecting BGP updates and tables, and substantial progress has been made in detecting and quantifying the impact of major Internet disruptions. However, we notice that most works in this realm either deploy/use a limited quantity of monitors or analyze aggregated statistics, and such practice may result in overestimating the impact of monitor-local events, which can be viewed only by a rather small portion of the Internet. To eliminate the impact of such local events on the detection of Internet-level anomalies, we raise the concept of Large-scale BGP Event (LBE), which affects a large amount of IP prefixes (high impact) and is widely observable (non-local). To detect LBE, we record update data in the Update Visibility Matrix (UVM) according to the prefix and monitor related to each update. At first, we formulate the problem of identifying LBE in UVM as a bi-clustering problem; after proving it is NP-hard, we describe our heuristic algorithm. Next, we apply our scheme to more than 2 TB of historical data. We find that LBE is highly correlated with many well-known disruptive incidents. Furthermore, we also identify some abnormal events that have never been investigated. We believe our work can assist in network operation tasks such as problem prevention, diagnosis, and recovery.

We propose an "α%-Green" network benchmark, whose spirit is that α% of the network power should come from the renewable energy. We argue that, as long as such a benchmark is satisfied, the network should always set its primary objective to its own optimization concerns.

The size of Forwarding Information Base (FIB) maintained at backbone routers is experiencing an exponential growth, and various solutions have been proposed in the literature. The main shortcoming of FIB compression is the update overhead. Only when the update speed of FIB compression algorithms is sufficiently fast and bounded, the probability of packet loss incurred by FIB compression operations during update can be completely avoided. However, no prior FIB compression algorithm can bound the worst case of update, and hence a mature solution with complete avoidance of packet loss is still yet to be identified. To address this issue, we propose the Unite and Split (US) compression algorithm to enable fast update with bounded worst case performance. Experimental results show that the average update speed of the US algorithm is almost the same as that of the binary trie without any compression.

Anomalous BGP events can deteriorate Internet performance and connectivity thus have always been a research topic. However, most measurement works in this realm are prone to monitor-local events, namely, the events local to only few BGP monitors. Besides, events that are widely observed can also have negligible impact, e.g., prefix-local events. In contrast, a Large-scale BGP Event (LBE) makes a large quantity of prefixes be updated and can be observed by a large portion of monitors. Such events are anomalous even harmful. We formulate the problem of identifying LBEs from BGP updates, then propose the Iterative Cut-off Algorithm to solve it. We apply the method to some famous disruptive events and some `innocent' data, which are collected from more than 400 monitors. The measurement results validate the effectiveness of our method. Moreover, we detect a severe and persistent misconfiguration event that has remained unreported before.

In the current IP networks, content replication and inter-domain Traffic Engineering (TE) are manipulated by different entities with respective objectives, and work at different layers as well. In Information-Centric Networking (ICN), however, they can both be administered by Internet Service Providers (ISPs) and work at the same network layer. In this paper, we present our study of jointly optimizing content replication and inter-domain TE in ICN, which aims at maximizing the profit of inter-domain traffic for an ISP while constrained by the limits of link bandwidth and the availability of contents. Results show that our algorithms can increase the ISP's profit by 66% and reduce the link utilization by 23% on average, which are near-optimal and with much less running time.

Ternary Content Addressable Memory(TCAM)-based multidimensional tables are widely used to implement Access Control Lists (ACLs) for Internet packet classification and filtering, and have also become attractive for constructing the forwarding tables of Internet routers and the flow tables of Openflow switches, where multiple fields are generally used to match incoming packets. However, as such tables can grow quickly as the Internet develops fast, and sometimes even expand in size because of TCAMs limitation in storing rules with range fields, it becomes imperative to compress these tables. In this paper, we propose a fast and efficient approach to multidimensional table compression. We divide the multidimensional space iteratively to obtain a series of cells, and then combine those cells that are associated with the same action. Our approach applies to tables of any dimension, addresses the range expansion problem, and provides efficient compression for TCAM-based tables. The experiments show that our approach has low computing cost in time, which is significant for the online update of tables. On average, it reduces 23.0% entries of the real-life ACLs, 25.8% to 55.1% of the generated two-dimension tables, 55.1% of the generated ACLs, and 28.4% of the generated Openflow flow tables.

Cloud computing not only requires high-capacity data center networks to accelerate bandwidth-hungry computations, but also causes considerable power expenses to cloud providers. In recent years many advanced data center network architectures have been proposed to increase the network throughput, such as Fat-Tree [1] and BCube [2], but little attention has been paid to the power efficiency of these network architectures. This paper makes the first comprehensive comparison study for typical data center networks with regard to their Network Power Effectiveness(NPE), which indicates the end-to-end bps per watt in data transmission and reflects the tradeoff between power consumption and network throughput. We take switches, server NICs and server CPU cores into account when evaluating the network power consumption. We measure NPE under both regular routing and power-aware routing, and investigate the impacts of topology size, traffic load, throughput threshold in power-aware routing, network power parameter as well as traffic pattern. The results show that in most cases Flattened Butterfly possesses the highest NPE among the architectures under study, and server-centric architectures usually have higher NPEs than Fat-Tree and VL2 architectures. In addition, the sleep-on-idle technique and power-aware routing can significantly improve the NPEs for all the data center architectures, especially when the traffic load is low. We believe that the results are useful for cloud providers, when they design/upgrade data center networks or employ network power management.

Information-Centric Networking (ICN) provides substantial flexibility for users. One of the most important features of ICN is the universal in-network caching. The characteristics of ICN make it substantially different from traditional caching systems. In this paper we propose an age-based cooperative caching scheme in response to the special characteristics of ICN. We leverage the coupling between routing and caching in ICN to develop a light-weight collaboration mechanism that adaptively pushes popular contents to the network edge. We evaluate our approach using real traces and realistic network topology. Results show that our approach can significantly reduce network delay and traffic, and outperforms existing schemes.

With increasing demands for more flexible services, the routing policies in enterprise network becomes much richer. This has placed a heavy burden to the current router forwarding plane to support the increasing number of policies, primarily due to the limited capacity in TCAM. This hinders the development of new network services. In this paper, we present the design and implementation of a new forwarding table structure. It separates the functions of TCAM and SRAM and maximally utilizes the large & flexible SRAM. We progressively design a set of schemes, to maintain correctness, compress storage, and achieve line-card speeds. We also design incremental update algorithms that bring less accesses to memory. We present implementation designs and evaluate our scheme with a real implementation on a commercial router using real data sets. Our design does not require new devices. The evaluation results show that the performance of our forwarding tables is promising.

Information-Centric Networking (ICN) has been proposed recently to improve the efficiency of content delivery in current IP networks. ICN employs data names, instead of host addresses, as routing and forwarding indicators. Content in the ICN carries only signature of the content provider but does not contain the identity of the content consumer by default. Such information is, however, essential for many of the web applications, such as email, online social networking, online game, e-commerce, and other session-based web services. In this paper, we propose a session-based access control (SAC) mechanism for ICN scenario to bridge the gap. Key distribution protocols are designed to protect the confidentiality of the content during information delivery. We also employ a dynamic naming scheme to enhance user privacy. According to security analysis, our access control mechanism can provide communication security and privacy protection for both sides of the session. Our design can be easily applied to session-based applications in ICN with negligible overhead.

TCP has been widely adopted in current data centers to ensure reliable data delivery. However, recently TCP Incast was found to occur in many-to-one communications with barrier-synchronized requirement, where the TCP goodput drops dramatically. Previous solutions to TCP Incast either require updating the OS/hardware to support fine-grained timers, or smartly control utilization of the switch buffer to reduce the probability of buffer overflow and packet loss. In this paper we explore a different approach to support many-to-one communication in data center networks, which we call LTTP (LT-code based Transport Protocol). LTTP improves LT (Luby Transform) code to achieve reliable UDP-based transmission by exploiting data redundancy, and employs TFRC (TCP Friendly Rate Control) to adjust the traffic sending rates at servers. NS-2 based simulation shows that the goodput of LTTP never degrades with the increase of the number of servers in many-to-one communications, and LTTP significantly outperforms DCTCP when the number of servers is large. Simulation results also demonstrate that LTTP flows can fairly share bandwidth with TCP flows.

Multicast benefits data center group communication in both saving network traffic and improving application throughput. Reliable packet delivery is required in data center multicast for data-intensive computations. However, existing reliable multicast solutions for the Internet are not suitable for the data center environment, especially with regard to keeping multicast throughput from degrading upon packet loss, which is norm instead of exception in data centers. We present RDCM, a novel reliable multicast protocol for data center network. The key idea of RDCM is to minimize the impact of packet loss on the multicast throughput, by leveraging the rich link resource in data centers. A multicast-tree-aware backup overlay is explicitly built on group members for peer-to-peer packet repair. The backup overlay is organized in such a way that it causes little individual repair burden, control overhead, as well as overall repair traffic. RDCM also realizes a window-based congestion control to adapt its sending rate to the traffic status in the network. Simulation results in typical data center networks show that RDCM can achieve higher application throughput and less traffic footprint than other representative reliable multicast protocols. We have implemented RDCM as a user-level library on Windows platform. The experiments on our test bed show that RDCM handles packet loss without obvious throughput degradation during high-speed data transmission, gracefully respond to link failure and receiver failure, and causes less than 10% CPU overhead to data center servers.

The Internet is generally not energy-efficient since all network devices are running all the time and only a small fraction of consumed power is actually related to traffic forwarding. Existing studies try to detour around links and nodes during traffic forwarding to save powers for energy-efficient routing. However, energy-efficient routing in traditional IP networks is not well addressed. The most challenges within an energy-efficient routing scheme in IP networks lie in safety and practicality. The scheme should ensure routing stability and loop- and congestion-free packet forwarding, while not requiring modifications in the traditional IP forwarding diagram and shortest-path routing protocols. In this paper, we propose a novel energy-efficient routing approach called safe and practical energy-efficient detour routing (SPEED) for power savings in IP networks. We provide theoretical insight into energy-efficient routing and prove that determining if energy-efficient routing exists is NP-complete. We develop a heuristic in SPEED to maximize pruned links in computing energy-efficient routings. Extensive experimental results show that SPEED significantly saves power consumptions without incurring network congestions using real network topologies and traffic matrices.

In this paper, we revisit the design of mega data centers, which are usually built by a number of modularized containers. Due to technical innovation and vendor diversity, heterogeneity widely exists among data-center containers in practice. To embrace this issue, we propose uFix, which is a scalable, flexible, and modularized network architecture to interconnect heterogeneous data-center containers. The intercontainer connection rule in uFix is designed in such a way that it can flexibly scale to a huge number of servers with stable server/switch hardware settings. uFix allows modularized and fault-tolerant routing by completely decoupling intercontainer routing from intracontainer routing. We implement a software-based uFix prototype on a Linux platform. Both simulation and prototype-based experiment show that uFix enjoys high network capacity, gracefully handles server/switch failures, and causes lightweight CPU overhead onto data-center servers.

The vast majority of application traffic in modern data center networks (DCNs) can be classified into two categories: throughput-sensitive large flows and latency-sensitive small flows. These two types of flows have the conflicting requirements on link buffer occupancy. Existing data transfer proposals either do not fully utilize the path diversity of DCNs to improve the throughput of large flows, or cannot achieve a controllable link buffer occupancy to meet the low latency requirement of small flows. Aiming to balance throughput with latency, we develop the eXplicit MultiPath (XMP) congestion control scheme for DCNs. XMP comprises two components: the BOS algorithm brings link queue buffers consumed by large flows under control, while the TraSh algorithm is responsible for shifting traffic from more congested paths to less congested ones, thus achieving high throughput. We implemented XMP and evaluated its performance on traffic shifting, fairness, goodput, buffer occupancy and link utilization by conducting comprehensive experiments and simulations. The results show that XMP outperforms existing schemes and achieves a reasonable tradeoff between throughput and latency.

Information centric networking is proposed to deal with the inefficiency of content distributions in traditional networks. It replaces the current host-centric communication paradigm with the content-centric one, so all the network devices can identify and cache the contents passed by. Traditional cache consistency approaches which rely on the origin server to validate cached contents will not be practical in ICN. The origin server might be overwhelmed by the large volume of validation requests from ubiquitous caches. In this paper, we propose a cache consistency architecture named Content Update Validation System (CUVS). It makes use of the servers located in each domain to provide the content validation service. It relieves the origin server and the routing protocols from caring about the cache consistency issue. The system is designed as a hierarchical overlay network in ICN, so it is easy to deploy and scales well.

Transmission efficiency of the current Internet routing system has witnessed a continuous degradation with the increasing popularity of content-oriented applications (e.g., YouTube). As a future Internet architecture, Information-Centric Networking (ICN) is proposed to solve this problem partly by in-network caching which means ICN routers are aware of and able to cache the content being delivered. In this paper, we present a Hop-based Probabilistic Caching (HPC) for ICN. When delivering the data back to the requester, each content router caches the data with a probability determined by the number of the hops between the responder and the router itself. First, we design an approach to computing the hop-based caching probability with a small amount of overhead. Second, we provide a caching weight based on the mean residence time of the cached contents, which guarantees that the cached contents remain in a router for an expected duration. The simulation results show that HPC achieves a caching hit ratio of 60% and extensively improves the transmission efficiency, compared with 20%, 43% and 46% of LRU, LFU and ProbCache, a recently proposed scheme for ICN, respectively.

In this paper we study energy conservation in the Internet. We observe that different traffic volumes on a link can result in different energy consumption; this is mainly due to such technologies as trunking (IEEE 802.1AX), adaptive link rates, etc. We design a green Internet routing scheme, where the routing can lead traffic in a way that is green. We differ from previous studies where they switch network components, such as line cards and routers, into sleep mode. We do not prune the Internet topology. We first develop a power model, and validate it using real commercial routers. Instead of developing a centralized optimization algorithm, which requires additional protocols such as MPLS to materialize in the Internet, we choose a hop-by-hop approach. It is thus much easier to integrate our scheme into the current Internet. We progressively develop three algorithms, which are loop-free, maximize energy conservation, and jointly consider green and QoS requirements such as path stretch. We comprehensively evaluate our algorithms through simulations on synthetic and real topologies and traffic traces. We show that the power saving in the line cards can be as much as 50%.

The Internet global routing tables have been expanding at a dramatic and increasing rate. In this paper, we propose the next hop of strict partial order to construct and aggregate the Nexthop-Selectable FIB (NSFIB). We control the path stretch caused by NSFIB aggregation by setting an upper limit number of next hops. According to our simulation, our aggregation algorithms shrink the FIB to 5-15%, compared with 20-60% of single-nexthop FIB aggregation algorithms; our method works very well in controlling the path stretch.

Content-Centric Network is a new and promising architecture with in-network caching. In such a system with universal caching, the cache would play as a high-cut low-pass filter and have a big influence on the requests distribution, and further on cache efficiency. This paper looks into the change of request distribution though caches and presents a model of the “filter effect” in LRU (Least Recently Used) cache. Through the simulation in two common topologies, the experiment results have verified the validity of the new model. Since our model can quantify the network load of any certain cache deployment scheme, we optimize the way of deploying cache when the total cache size is limited. Simulation results show our optimal way can effectively minimize the total network load.

The goal of this paper is to improve wireless AP caching by leveraging in-network caching. We observe that by treating routers as an in-network storage extension, we can relieve the storage limitation of APs. The unique challenge is that APs and routers cannot have a full collaboration, which makes the problem different from traditional cooperative caching problems. We study how APs can optimize caching decisions by using in-network caching information without controlling routers.

The Internet is a great hit in human history. However, it has evolved greatly from its original incarnation. Content distribution is playing a central role in today's Internet, which makes it difficult for the conventional host-to-host communication to meet the ever-increasing demands. In this paper, we present a novel “service and information oriented network architecture” (SIONA). The key aspect of SIONA is the name-based two-dimensional routing paradigm that provides scalable routing, caching and content delivery. We argue that SIONA solves the problems of mobile Internet by naturally supporting mobility, and provides network layer P2P for massive data distribution. Evaluation is conducted to investigate its caching and mobility performance.

Although most researchers have agreed that the locator/identifier separation is beneficial for the Internet, there is no consensus on how to define the “identifier”. In this paper, we propose a scheme in which identifiers are distributed by authorities to endpoints, and the authorities are responsible for maintaining real-time locators of endpoints with identifiers they distributed. This scheme can be helpful to accounting, security and other network management tasks. We also present in details how to implement this scheme with extended DNS and a new infrastructure, i.e., ID Mapping System (IDMS).

Source address filtering is used as an important mechanism to prevent malicious traffic. Currently, most networks store filters in hardware such as TCAM, which has limited capacity, high power consumption and high cost. Although software can accommodate large number of filters, it needs multiple accesses to memory on the border router, which bears much more additional burden than other routers. In this paper, we propose a software-based mechanism for source address filtering. In our mechanism, we only need to check a few bits in source addresses on each router, rather than checking all bits on the ingress router. Through cooperation among routers, our mechanism ensures that malicious traffic will be filtered in the network. We formulate this problem as finding a cooperative scheme such that the loads on all routers are optimally balanced. We show that the problem can be optimally solved by dynamic programming. We evaluate our algorithms using comprehensive simulations with BRITE generated topologies and real world topologies. We conduct a case study on China Education and Research Network 2 (CERNET2) configurations, a large IPv6 network. Compared to checking 128-bit IP addresses on ingress routers, our algorithm checks at most 40 bits on each router.

With the aid of multipath transport protocols, a multihomed host can shift some of its traffic from more congested paths to less congested ones, thus compensating for lost bandwidth on some paths by moderately increasing transmission rates on other ones. However, existing multipath proposals achieve only coarse-grained load balancing due to a rough estimate of network congestion using packet losses. This paper formulates the problem of multipath congestion control and proposes an approximate iterative algorithm to solve it. We prove that a fair and efficient traffic shifting implies that every flow strives to equalize the extent of congestion that it perceives on all its available paths.We call this result “Congestion Equality Principle”. By instantiating the approximate iterative algorithm, we develop weighted Vegas (wVegas), a delay-based algorithm for multipath congestion control, which uses packet queuing delay as congestion signals, thus achieving fine-grained load balancing. Our simulations show that, compared with loss-based algorithms, wVegas is more sensitive to changes of network congestion and thus achieves more timely traffic shifting and quicker convergence. Additionally, as it occupies fewer link buffers, wVegas rarely causes packet losses and shows better intra-protocol fairness.

The Internet is facing severe routing scalability problem. The Internet Service Providers cannot afford to upgrade their routers at the pace of routing table growth. Therefore, FIB aggregation has been proposed. However, current single-nexthop FIB aggregation solutions cannot provide a satisfactory performance. In this paper, we first propose the next hop of strict partial order (SPO next hop) to construct the Nexthop-Selectable FIB (NSFIB). The approach guarantees that NSFIB-based aggregation performs better than single-nexthop FIB aggregation, especially in larger and denser backbone networks. We then provide the NSFIB-based aggregation algorithms. According to our simulation, our algorithms can shrink the FIB to 5% and the aggregation performance does not degrade when the network density increases, both of which are a great improvement overhead single-nexthop FIB aggregation.

The weak trust model in Border Gateway Protocol (BGP) introduces severe vulnerabilities for Internet routing including active malicious attacks and unintended misconfigurations. Although various secure BGP solutions have been proposed, the complexity of security enforcement and data-plane attacks still remain open problems. We propose TBGP, a trusted BGP scheme aiming to achieve high authenticity of Internet routing with a simple and lightweight attestation mechanism. TBGP introduces a set of route update and withdrawal rules that, if correctly enforced by each router, can guarantee the authenticity and integrity of route information that is announced to other routers in the Internet. To verify this enforcement, an attestation service running on each router provides interfaces for a neighboring router to challenge the integrity of its routing stack, enforced rules, and the attestation service itself. If this attestation succeeds, the neighboring router updates its routing table or announces the route to its neighbors, following the same rules. Thus, a router on a routing path only needs to verify one neighbor's routing status to ensure that the route information is valid. Through this, TBGP builds a transitive trust relationship among all routers on a routing path. We implement a prototype of TBGP to investigate its practicality. In our implementation, we use identity-based signature and trusted computing techniques to further reduce the complexity of security operations. Our security analysis and performance study shows that TBGP can achieve the security goals of BGP with significantly better convergence performance and lower computation overhead than existing secure BGP solutions.

Routing failures are common on the Internet and routing protocols can not always react fast enough to recover from them, which usually cause packet delivery failures. To address the problem, fast reroute solutions have been proposed to guarantee reroute path availability and to avoid high packet loss after network failures. However, existing solutions are often specific to single type of routing protocol. It is hard to deploy these solutions together to protect Internet routing including both intra- and inter-domain routing protocols because of their individual computational and storage complexity. Moreover, most of them can not provide effective protection for traffic over failed links, especially for the bi-directional traffic. In this paper, we propose a unified fast reroute solution for routing protection under network failures. Our solution leverages identifier based direct forwarding to guarantee the effectiveness of routing protection and supports incremental deployment. In particular, enhanced protection cycle (e-cycle) is proposed to construct rerouting paths and to provide node and link protection for both intra- and inter-domain routing protocols. We evaluate our solution by simulations, and the results show that the solution provides 100% failure coverage for all end-to-end routing paths with approximately two extra Forwarding Information Base (FIB) entries. Furthermore, we report an experimental evaluation of the proposed solution in operational networks. Our results show that the proposed solution effective provides failure recovery and does not introduce processing overhead to packet forwarding.

The weak trust model in Border Gateway Protocol (BGP) introduces severe vulnerabilities for Internet routing including active malicious attacks and unintended misconfigurations. Although various secure BGP solutions have been proposed, they share similar weaknesses such as high complexity of security enforcement and incapability of data-plane attack prevention. We propose TBGP, a trusted BGP scheme aiming to achieve high authenticity of Internet routing with a simple and lightweight attestation mechanism. TBGP introduces a set of route update and withdrawal rules that, if correctly enforced by each router, can guarantee the authenticity and integrity of route information that is announced to other routers in the Internet. Through this, TBGP builds a transitive trust relationship among all routers on a routing path. We implement a prototype of TBGP to investigate its practicality. In our implementation, we use identity-based signature (IBS) and trusted computing (TC) techniques to further reduce the complexity of security operations. The performance study show that TBGP can achieve significantly better convergence performance and lower computation overhead than existing secure BGP solutions.

Evaluating the reliability of Internet routing is important for an ISP to assess existing peer relationships or establish new peer relationships. Existing algorithms for network reliability computations take all routing paths as inputs. However, these paths may not be actually available for routing because of the constraints of routing policies in the Internet. In this paper, we propose an algebraic approach that effectively reduces the number of candidate routing paths according to the given routing policy. We further improve the accuracy of the routing reliability result by subtracting the miscounted value of routing paths due to overlooking routing policy constraints.

Data center containers are regarded as the basic units to build mega data centers. In practice, heterogeneity exists among data center containers, because of technical innovation and vendor diversity. In this paper, we propose uFix, a scalable, flexible and modularized network architecture to interconnect heterogeneous data center containers. The inter-container connection rule in uFix is designed in such a way that it can flexibly scale to a huge number of servers with stable server/switch hardware settings. uFix allows modularized and fault-tolerant routing by completely decoupling inter-container routing from intra-container routing. We implement a software-based uFix stack on the Linux platform. Simulation and experiment results show that uFix enjoys high network capacity, gracefully handles server/switch failures, and brings light-weight CPU overhead onto data center servers.

In recent years, the core-net routing table, e.g., Forwarding Information Base (FIB), is growing at an alarming speed and this has become a major concern for Internet Service Providers. One effective solution for this routing scalability problem, which requires only upgrades on individual routers, is FIB aggregation. Intrinsically, IP prefixes with numerical prefix matching and the same next hop can be aggregated. Very commonly, all previous studies assume that each IP prefix has one corresponding next hop, i.e., towards one optimal path. In this paper, we argue that a packet can be delivered to its destination through a path other than the one optimal path. Based on this observation, we for the first time propose Nexthop-Selectable FIB Aggregation that is fundamentally different from all previous aggregation schemes. IP prefixes are aggregated if they have numerical prefix matching and share one common next hop. Consequently, IP prefixes that cannot be aggregated, due to lack of the same next hop, are aggregated; and we achieve a substantially higher aggregation ratio. In this paper, we provide a systematic study on this Nexthop-Selectable FIB Aggregation problem. We present several practical choices to build the sets of selectable next hops for the IP prefixes. To maximize the aggregation, we formulate the problem as an optimization problem. We show that the problem can be solved by dynamic programming. While the straightforward application of dynamic programming has exponential complexity, we propose a novel algorithm that is O(N). We then develop an optimal online algorithm with constant running time. We evaluate our algorithms through a comprehensive set of simulations with BRITE with RIBs collected from RouteViews. Our evaluation shows that we can reduce more than an order of the FIB size.

Multicast benefits data center group communication in both saving network traffic and improving application throughput. The SLA (Service Level Agreement) of cloud service requires the computation correctness of distributed applications, translating to the requirement of reliable Multicast delivery. In this paper we present RDCM, a novel reliable Multicast approach for data center network. The key idea of RDCM is to minimize the impact of packet loss on the Multicast performance, by leveraging the rich link resource in data centers. A Multicast-tree-aware backup overlay is purposely built on group members for peer-to-peer packet repair. Riding on Unicast, packet repair not only achieves complete repair isolation, but also has high probability to bypass the pathological links in the Multicast tree where packet loss occurs. The backup overlay is organized in such a way that it causes little individual repair burden, control overhead, as well as overall repair traffic. We have implemented RDCM as a user-level library on Windows platform. The experiments on our test bed show that RDCM handles packet loss without obvious throughput degradation during high-speed data transmission.

The demand for faster failure-recovery in the Internet has led to the development of several IP Fast Reroute (IPFRR) schemes, which are all too computationally expensive or unsatisfactory in protection coverage. In this paper, we propose Minimum Protection Cost Tree (MPCT) for IPFRR using Tunnel. By constructing an MPCT for each hypothetical failed neighbor, MPCT finds the protection paths for all the affected destinations. First, MPCT provides 100% single-node protection coverage by direct forwarding (DF) and re-protection. Second, the computational complexity of MPCT is less than one full shortest path first (SPF) calculation. Third, by simulation with the data from CERNET, Rocketfuel and Brite, we show that even without DF and re-protection, MPCT can provide more than 99.7% protection coverage for single-node failures. We believe that our scheme MPCT moves a big step towards practical deployment.

Network survivability is an important topic for the Internet. To improve the performance of the Internet during failure, IP Fast Reroute (IPFRR) mechanisms are proposed to establish backup routes for failure-affected packets. NotVia, a most prominent one, provides 100% protection coverage for single-node failures. However, it brings in nontrivial computing and memory pressure to routers with special NotVia addresses, in which only some are necessary for a specific router. Besides, the protection path of NotVia is 20% longer than the optimal path on average. In this paper, we propose early decapsulated NotVia (ED-NotVia) handling the aforementioned problems and thus making NotVia more practical. We first analyze the properties of necessary NotVia addresses to any specific node. Then we develop a heuristic Nec-NotVia Algorithm for a node to find the necessary NotVia addresses and compute routes for them, where unnecessary addresses are eliminated. Based on this elimination, early decapsulation is imported to optimize the protection path with marginal overhead. We evaluate our algorithm and demonstrate the effectiveness of ED-NotVia using topologies from Rocketfuel and Brite. The results show that 1) only 5% to 20% of SPT(Shortest Path Tree)-related NotVia addresses (1.23% to 6.41% of all the NotVia addresses) in an AS are necessary for a node; 2) by computing the routes for 15% to 40% SPT-related NotVia addresses, ED-NotVia provides 98% protection coverage; and 3) the protection path stretch ratio of ED-NotVia is only 1.03 on average as compared to 1.20 for NotVia.

IPv6 transition problem has become one of the key factors which are holding up the development of the next generation Internet. Aiming to solve IPv6 transition problem, several translation and tunneling techniques have been proposed, satisfying the demand of IPv4-IPv6 interconnection and traversing respectively. However, translation techniques can't convert the semantic between IPv4 and IPv6 protocol perfectly, and they have serious limitations in operation complexity and scalability. Researchers tried to decompose, simplify these problems and improve translation techniques accordingly, but they've come to little achievement since these problems result from the very nature of translation. We propose a novel approach of choosing appropriate translation spot to solve these problems in a different angle, and hence make effective use of translation technique. Then we propose a framework for IPv4-IPv6 coexistence called PET, which integrates tunneling and translation to support both traversing and IPv4-IPv6 interconnection, and uses them properly to constitute communication models in different scenarios. Moreover, we put forward PET signaling method to achieve automatic translation spot election and translation context advertisement, as a complement to the framework.

IP Fast ReRoute (IPFRR) has received increasing attention as a means to effectively shorten traffic disruption under failures. A major approach for IPFRR is to pre-calculate backup paths for nodes and links. Such approach is, however, hard to deploy due to the tremendous computational overhead. Thus, a lightweight IPFRR scheme is desired to effectively detour failures and provide routing protection. In this paper, we propose a Fast Tunnel Selection (FTS) algorithm to achieve tunnel-based IPFRR. The FTS algorithm can find an effective tunnel endpoint before complete computation of entire SPT and effectively reduce computation overhead. We simulate FTS with different size of generated topologies, and the results show that FTS algorithm reduces much computation overhead compared to existing approaches, and achieves a 99.10% average link protection rate and a 91.97% average node protection rate.

Routing failures are common on the Internet and routing protocols can not always react fast enough to recover from them, which usually causes packet delivery failures. To address the problem, fast reroute solutions have been proposed to guarantee reroute path availability and to avoid high packet loss after network failures. However, existing solutions are often specific to single type of routing protocol. It is hard to deploy these solutions together to protect Internet routing including intra- and inter-domain routing because of their individual computational and storage complexity. Moreover, most of them can not provide effective protection for traffic over failed links, especially for the bi-directional traffic. In this paper, we propose a unified fast reroute solution for routing protection under network failures. Our solution leverages identifier based direct forwarding to guarantee the effectiveness of routing protection and supports incremental deployment. In particular, enhanced protection cycle (e-cycle) is proposed to construct rerouting paths and to provide node and link protection for both intra- and inter-domain routing. We evaluate our solution by simulations, and the results show that the solution provides 100% failure coverage for all end-to-end routing paths with approximately two extra Forwarding Information Base (FIB) entries.

The demand for faster failure-recovery in pure intra-domain IP networks has led to the development of several IP Fast ReRoute (IPFRR) mechanisms. However, these mechanisms are all either too computationally expensive, or fail to provide satisfiable protection coverage. For these reasons, IPFRR schemes have yet to see widespread commercial deployment. In this paper, we present a new IPFRR mechanism called Tunnel-AT based on incremental SPF algorithm and the concept of Attaching Tree. Tunnel-AT outperforms existing IPFRR mechanisms by providing 100% node protection coverage at a computational cost of less than one full SPF calculation.

In recent years, there are substantial demands to reduce packet loss in the Internet. Among the schemes proposed, finding backup paths in advance is considered to be an effective method to reduce the reaction time. Very commonly, a backup path is chosen to be a most disjoint path from the primary path, or in the network level, backup paths are computed for all links (e.g., IPRFF). The validity of this straightforward choice is based on 1) all the links may fail with equal probability; and 2) facing the high protection requirement today, having links not protected or sharing links between the primary and backup paths just simply look weird. Nevertheless, indications from many research studies have confirmed that the vulnerability of the links in the Internet is far from equality. In addition, we have seen that full protection schemes may introduce high costs. In this paper, we argue that such approaches may not be cost effective. We first analyze the failure characteristics based on real world traces from CERNET2, the China education and Research NETwork 2. We observe that the failure probabilities of the links is heavy-tail, i.e., a small set of links caused most of the failures. We thus propose a selective protection scheme. We carefully analyze the implementation details and the overhead for general backup path schemes of the Internet today. We formulate an optimization problem where the routing performance (in terms of network level availability) should be guaranteed and the backup cost should be minimized. This cost is special as it involves computation overhead. Consequently, we propose a novel Critical-Protection Algorithm which is fast itself. We evaluate our scheme systematically, using real world topologies and randomly generated topologies. We show significant gain even when the network availability requirement is 99.99\% as compared to that of the full protection scheme.

Web pages polluted by unhealthy contents (e.g. pornography or violence) have offended many users and become a social headache. This paper presents a collaborative rating system and a light-weight algorithm to detect polluted pages and thus improve user experience of web browsing. It mainly tackles two challenges. First, the system should cater to web users' different tastes and judging standards on which polluted pages they like or dislike. Second, the system should be resilient to dishonest ratings and collusions. The model and the algorithm are evaluated by simulations which show that they can work well.

QoS (quality-of-service) control is one of the most important mechanisms in the next-generation Internet, where QoS routing (QoSR) is a promising solution. We propose a multi-constrained intradomain QoS routing protocol SQOSPF. The advantages of this protocol include easy implementation, multi-constrained QoS support, high-speed convergence and multiple QoSR algorithms support. Stochastic Petri net is employed to model SQOSPF and analyze impacts of update threshold and routing holding time upon the load of networks and routers. Extensive simulations show that choosing appropriate update threshold and routing holding time can excessively reduce the extra load and keep routing performance at the same time.

As the most challenging problems of the upcoming next-generation networks, 2-constrained quality of service routing (QoSR) is NP-complete problem, for which we propose a novel precomputation algorithm, LEFPA. This algorithm converts two additive weights to a single metric with linear energy functions (LEFs) and pre-computes QoS routing table with multiple (B) LEFs to further enhance its scalability. We first analyze the performance of LEFs and give a method to determine the feasible and unfeasible areas in the metric space for a QoS request. We then introduce the proposed LEFPA, whose computation complexity is O(B(m+nlogn+n)). Furthermore, we use three methods to evaluate the routing performance. Extensive simulations show that our LEFPA has both absolutely and competitively high performance.

With the network applications development, routers must support those functions such as firewalls, provision of QoS and traffic billing etc. All these functions need classification of IP packets, according to which it is determined how different packets are processed subsequently. A novel IP classification algorithm is proposed based on the grid of tries algorithm. The new algorithm not only eliminates original limitations in the case of multiple fields but also shows better performance in regard to both time and space. It has better overall performance than many other algorithms.

System stability is an important criterion in selecting an appropriate control or scheduling policy for re-entrant line systems. Traditionally, stability analysis was based on the concept of time boundedness and was studied using Foster's criterion, which is a special case of stochastic Lyapunov functions. We emphasized the concept of buffer boundedness as an alternative criterion for characterizing the stability of scheduling policies and analyzed the stability of re-entrant line systems using this concept. A Petri net based framework was introduced to represent the dynamic behavior of re-entrant line systems. The Petri net method has been shown to be intuitive, simple and efficient.

Proposes an integrative scheme of differentiated services (DiffServ) for the Internet. In our scheme, the quality of service (QoS) is ranked according to the levels of both importance and urgency, which makes the service negotiation and the implementation mechanism more flexible and universal. Samples of the implementation mechanism at the edge nodes and interior nodes are described, and stochastic Petri net models of them are given. The performance of the per-hop behavior (PHB) implementation mechanism is analyzed, under both Poisson and self-similar arrivals. An approximate analysis technique of decomposition and iteration is used to reduce the complexity. For self-similar traffic, an MMPP (Markov-modulated Poisson process) based self-similar model of A.T. Andersen et al. (1998) is used.