The identification of Internet traffic applications is very important for ISPs and network administrators to protect their resources from unwanted traffic and prioritize some major applications. Statistical methods are preferred to port-based ones since they don't rely on the port number, which can change dynamically, and to deep packet inspection since they also work for encrypted traffic. These methods combine the statistical analysis of the application packet flow parameters, such as packet size and inter-packet time, with machine learning techniques. Other successful approaches rely on the way the hosts communicate and their traffic patterns to identify applications. In this paper, we propose a new online method for traffic classification that combines the statistical and host-based approaches in order to construct a robust and precise method for early Internet traffic identification. Without loss of generality we use the packet size as the main feature for the classification and we benefit from the traffic profile of the host (i.e., which application and how much) to refine the classification and decide in favor of this or that application. The host profile is then updated online based on the result of the classification of previous flows originated by or addressed to the same host. We evaluate our method on real traces using several applications. The results show that leveraging the traffic pattern of the host ameliorates the performance of statistical methods. They also prove the capacity of our solution to derive profiles for the traffic of Internet hosts and to identify the services they provide.

The identification of Internet applications is important for ISPs and network administrators to protect the network from unwanted traffic and prioritize some major applications. Statistical methods are widely used since they allow to classify applications according to their statistical signatures. They combine the statistical analysis of flow parameters, such as packet size and inter-packet time, with machine learning techniques. Previous works are mainly based on the packet size and the directions of the packets. In this work we make a complete study about the inter-packet time to prove that it is also a valuable information for the classification of Internet traffic. We discuss how to isolate the noise due to the network conditions and extract the time generated by the application. We present a model to preprocess the inter-packet time and use the result as input to the learning process. We discuss an iterative approach for the on line identification of the applications and we evaluate our method on two different real traces. The results show that the inter-packet time is an important parameter to classify Internet traffic.

The easy deployment of P2P self-organized systems has contributed to their wide diffusion and to the definition of a new communication paradigm. Mobile communities can now spontaneously emerge to enable users to become both consumer and service providers. However, the presence of selfish and malicious nodes can thwart the sustainability of these systems as nodes try to exploit services without contributing resources. In these P2P systems reputation management schemes can promote collaboration, but they are mostly ineffective in communities that last for short time.In this paper we propose a token based mechanism that extends existing reputation management schemes to support mobility. It reduces the problem of bootstrapping the reputation values and provides incentives for nodes to properly behave. Simulation results show that the token based extension enables the correlation of transactions in different contexts efficiently.

Peer-to-peer networks need to have self-organization properties because of the lack of a centralized authority. This implies that nodes should self-manage and cooperate to sustain the availability of the resources in the system. In this context reputation management schemes have been proven in the past to be a useful tool to foster cooperation. In this paper we discuss the importance for a node to build and use its reputation value. We propose a game-theoretical framework, based on the generalized form of the Iterated prisoner's dilemma, to model the interactions of rational and selfish nodes in distributed systems. We study how a node takes into account the change of its reputation when deciding its behaviour in a transaction and discuss the Nash equilibrium in the system. Then, we also simulate nodes' interactions under different strategies to analyze how cooperation and reputation evolve in the system.

Vehicular networks create a new communication paradigm that enables to exploit the movement of cars to disseminate content. If network coding is used, vehicles have much more flexibility in content sharing and the system stability and scalability are promoted also in presence of mobility. Along this line, we propose an efficient mechanism to provide secrecy of the information. Traditional approaches based on encryption decrease the cooperation willingness of intermediate nodes, which have no expectation of recovering the file. Our scheme is based on obfuscation by processing and polluting the original file so that only the intended recipients, informed of corrupted blocks, can recover the information timely. We present several alternatives to efficiently provide weak secrecy and to foster cooperation. We simulate the file distribution in a vehicular network and show that the proposed scheme enhances content distribution in term of downloading speed and it is much more efficient than the ones that use encryption.

The specific objective of a reputation management system is to facilitate nodes to decide whom to trust before providing resources and the expected quality of service. In self-organized systems, the use of reputation-based mechanisms has a cost in terms of messages required to disseminate feedbacks and to synchronize reputation values. In this paper we discuss the implementation of a reputation management system and consider two approaches to collect and disseminate data: proactive and reactive schemes. We analyze the cost of these approaches in terms of extra signaling and evaluate the benefit of using reputation management systems, measured as the number of avoided transactions with malicious nodes.

Leveraging social networks in computer systems can be effective in dealing with a number of trust and security issues. Spam is one such issue where the "wisdom of crowds" can be harnessed by mining the collective knowledge of ordinary individuals. In this paper, we present a mechanism through which members of a virtual community can exchange information to combat spam. Previous attempts at collaborative spam filtering have concentrated on digest-based indexing techniques to share digests or fingerprints of emails that are known to be spam. We take a different approach and allow users to share their spam filters instead, thus dramatically reducing the amount of traffic generated in the network. The resultant diversity in the filters and cooperation in a community allows it to respond to spam in an autonomic fashion. As a test case for exchanging filters we use the popular SpamAssassin spam filtering software and show that exchanging spam filters provides an alternative method to improve spam filtering performance.

In order for autonomic systems to function, the individual components must co-operate and not indulge in malicious behavior. However, it is almost certain that autonomous systems in. Next generation networks will inadvertently include less than trustworthy components. Identifying such entities is critical to the smooth and effective functioning. We present new experiments conducted with the ROCQ scheme, a reputation-based trust management system that computes the trustworthiness of peers on the basis of transaction-based feedback. The ROCQ model combines four parameters: reputation (R) or a peer's global trust rating, opinion (O) formed by a peer's first-hand interactions, credibility (C) of a reporting peer and quality (Q) or the confidence a reporting peer puts on the feedback it provides. In this paper, we demonstrate that ROCQ is robust against churn and also examine the effect of credibility and quality on the performance of the scheme.

We propose a reputation-based trust management system, ROCQ, to reduce unauthentic and corrupted file transfers in end-user collaborative content-distribution systems. Such systems are characterized by the splitting of large files into (optionally encoded) blocks and the simultaneous downloading of several blocks from different nodes to speed up content distribution. All nodes must cooperate and provide correct content for such systems to function smoothly. If malicious nodes are present, they can quickly bring the system to a halt by introducing fake blocks in the network making it impossible to reconstruct the original file. ROCQ (reputation, opinion, credibility and quality) uses feedback from past interactions among nodes to create node reputations. This allows detection of malicious nodes in a transaction-based network. We study the performance of ROCQ as used in a content distribution network. We find that ROCQ decreases the likelihood of a user receiving fake blocks by up to 16%, and, hence, significantly reduces bandwidth waste.