In cloud-native systems, microservices communicate with each other through remote calls. This communication side channel contains various information that can be leveraged to carry out topology probing attacks, DDoS attacks, etc. To defend against these attacks, researchers conducted work on critical path analysis and topology obfuscation. However, these works can not be applied to cloud-native scenarios because of limited flexibility and the long calculation time. In this paper, we propose MeshGuard, a novel obfuscation framework for mitigating topology probing attacks in cloud-native systems. Specifically, we construct a service-level dynamic labyrinth to achieve adaptive topology obfuscation. To avoid leaking traffic patterns when obfuscating topology, we disguise obfuscated traffic with tailored parameters. Finally, we design a tag-based obfuscation mechanism to avoid affecting normal microservices. The preliminary results show that MeshGuard can effectively protect the critical path and services with acceptable resource overhead.

Serverless computing, also known as Function-as-a-Service (FaaS), is widely used in modern applications. Function instances share the underlying physical infrastructure, which makes co-location attacks possible and leads to the leakage of sensitive information such as function activity states. Existing work has respective limitations in serverless scenarios because of incomplete detection coverage, long training time, and intrusion into the function's runtime environment. In this paper, we propose FaaSGuard, an obfuscation framework to protect function activity states in network side-channels and enhance privacy in serverless applications. To be specific, we design an adaptive obfuscation strategy selection mechanism to make FaaSGuard flexible. We design a traffic camouflage method to make obfuscated traffic indistinguishable from normal traffic, making FaaSGuard invisible. In order not to affect normal traffic, we propose a tag-based obfuscation mechanism to identify obfuscated packets. The preliminary evaluation results show that FaaSGuard can conceal function activity states with negligible resource overhead.

Active network scanning in IPv6 is hindered by the vast address space of IPv6. Researchers have proposed various target generation methods, which are proved effective for reducing scanning space, to solve this problem. However, the current landscape of address generation methods is characterized by either low hit rates or limited applicability. To overcome these limitations, we propose 6Former, a novel target generation system based on Transformer. 6Former integrates a discriminator and a generator to improve hit rates and overcome usage scenarios limitations. Our experimental findings demonstrate that 6Former improves hit rates by a minimum of 38.6% over state-of-the-art generation approaches, while reducing time consumption by 31.6% in comparison to other language model-based methods.

Domain name system (DNS) is the address book of the Internet and domain names are queried before almost every network activity. Since the entities like recursive resolvers can monitor users' DNS queries, privacy concerns such as user tracking arise. Though a number of prior works have looked into this issue, they all focus on the closed-world setting, which means that victim users must be known to the adversary. We argue that it does not reflect the adversary's true capabilities. Moreover, there lacks an effective approach to defend against DNS-based user tracking. In this work, we revisit these issues by investigating the attack surface in both open-world and closed-world settings and studying how to protect users. First, we introduce a new tracking mechanism DSCorr which incorporates domain-based word embedding to capture the fine-grained distance between domain names, and automatic threshold generation for fine-tuning the attack outcome. The evaluation result on a real-world DNS dataset shows DSCorr is able to outperform the existing works by a large margin especially in the open-world setting. On the defense side, we develop a system called LDPResolve, which incorporates a recently proposed differential privacy notion ULDP (Utility-optimized Local Differential Privacy) and a new technique named parallel domain resolving, to provide privacy guarantees without damaging the utility of legitimate applications. The evaluation result on the same dataset shows the DNS-based user tracking can be effectively curbed, e.g., tracking accuracy degraded from 93% to 10.1%.

Although IPv6 has been proposed to solve the IP address exhaustion problem for decades, the transition process from IPv4 to IPv6 is rather slow due to the possible loss of users and increased costs for ISPs compared with the potential profits. In order to accelerate this process and make full use of the IPv6 network, in this paper, we propose a user-transparent solution named NetBoost by transferring IPv4 traffic through the IPv6 core network. We also implement a simulator called NetBoostSim to further verify the usefulness and prospective performance gain of NetBoost in different network environments. By deploying our system upon both real and simulated network environments, we showcase that better performance for IPv4 end-to-end connections can be acquired by utilizing the light-loaded IPv6 network to transfer traffic from heavy-loaded IPv4 core network, using stateless IPv4/IPv6 translation techniques. In this way, our system can serve as an incentive for ISPs to upgrade to pure IPv6 networks gradually without concerns for the user churn.

Abstract With increasing number of cloud data leakage accidents exposed, outsourced data control becomes a more and more serious concern of their owner. To relieve the concern of these cloud users, reliable logging schemes are widely used to generate proof for data confidentiality auditing. However, high frequency operation and fine operation granularity on cloud data both result in a considerably large volume of operation logs, which burdens communication and computation in log auditing. This paper proposes a multi-grained log auditing scheme to make logs volume smaller and log auditing more efficient. We design a logging mechanism to support multi-grained data access with Merkle Hash Tree structure. Based on multi-grained log, we present a log auditing approach to achieve data confidentiality auditing and leakage investigation by making an Access List. Experiments results indicate that our scheme obtains about 54% log volume and 60% auditing time of fine-grained log auditing scheme in our scenario.

Emotion-cause pair extraction, which aims at extracting both the emotion and its corresponding cause in text, is a significant and challenging task in emotion analysis. Previous work formulated the task in a two-step framework, i.e., emotion and cause extraction, and emotion-cause relation classification. However, different tasks may correlate with each other and the two-step framework does not fully exploit the interactions between tasks. In this paper, we propose a multi-task neural network to perform emotion-cause pair extraction in a unified model. The task of relation classification is learned together with emotion and cause extraction. To this end, we develop a method to obtain training samples for relation classification without the dependence on the result of emotion and cause extraction. To fully exploit the interactions between different tasks, our model shares useful features across tasks. Moreover, we propose a method to incorporate position-aware emotion information in cause extraction to further improve the performance. Experimental results show that our model outperforms the state-of-the-art model on emotion-cause pair extraction.

Software-Defined Networking (SDN) greatly simplifies middlebox policy enforcement. Middleboxes need tag packet headers to avoid forwarding ambiguity on SDN switches. In this paper, we present a new attack, called middlebox-bypass attack, to breach SDN-based middlebox policy enforcement. Such an attack manipulates a compromised switch to locally tag attacking packets without handing them over to the attached middlebox for inspection. Existing SDN security solutions, however, cannot detect the middlebox-bypass attack under practical constraints of efficiency, robustness, and applicability. We design and implement FlowCloak, the first protocol for per-packet real-time detection and prevention of middlebox-bypass attacks. FlowCloak enables middleboxes to generate tags that are probabilistically unknown to an attacker and confines it to only random guessing. We propose a multi-tag verification technique to address the tradeoff between FlowCloak robustness and TCAM usage by tag verification rules on the egress switch. Experiment results show that dozens of verification rules can confine the attacking probability under 0.1 %. FlowCloak imposes only a 0.3 ms packet processing delay on middleboxes and no obvious delay on the egress switch.

It is often difficult to separate the highly capable “experts” from the average worker in crowdsourced systems. This is especially true for challenge application domains that require extensive domain knowledge. The problem of stock analysis is one such domain, where even the highly paid, well-educated domain experts are prone to make mistakes. As an extremely challenging problem space, the “wisdom of the crowds” property that many crowdsourced applications rely on may not hold. In this article, we study the problem of evaluating and identifying experts in the context of SeekingAlpha and StockTwits, two crowdsourced investment services that have recently begun to encroach on a space dominated for decades by large investment banks. We seek to understand the quality and impact of content on collaborative investment platforms, by empirically analyzing complete datasets of SeekingAlpha articles (9 years) and StockTwits messages (4 years). We develop sentiment analysis tools and correlate contributed content to the historical performance of relevant stocks. While SeekingAlpha articles and StockTwits messages provide minimal correlation to stock performance in aggregate, a subset of experts contribute more valuable (predictive) content. We show that these authors can be easily identified by user interactions, and investments based on their analysis significantly outperform broader markets. This effectively shows that even in challenging application domains, there is a secondary or indirect wisdom of the crowds. Finally, we conduct a user survey that sheds light on users’ views of SeekingAlpha content and stock manipulation. We also devote efforts to identify potential manipulation of stocks by detecting authors controlling multiple identities.

The transition to IPv6 has been an inevitable trend because there are still more than half of the world's population without the Internet access but the global IPv4 address space has been exhausted. Meanwhile, IPv6 users and emerging IPv6 services still need public IPv4 addresses to communicate with the global IPv4 users and resources, making it important for providers to share scarce global IPv4 addresses effectively. Existing IPv6 transition mechanisms have their own address sharing solutions, but none of them is good enough to be deployed in large-scale networks. In this paper, we propose a novel hybrid address sharing scheme, denoted by HAS, which can be both scalable and agile enough in large-scale deployments, and can help the other billion users access the Internet in a graceful manner. Moreover, the HAS scheme can be deployed in different phases of the IPv6 transition process and can provide a transparent, smooth, self-benefiting IPv6 transition strategy. We implemented the HAS scheme and have deployed it in the Tsinghua University Campus Network (TUNET) to provide Internet access for thousands of campus users. The real traffic data show that the HAS scheme has a good performance in actual deployments.

IPv6 has been an inevitable trend with the depletion of the global IPv4 address space. However, new IPv6 users still need public IPv4 addresses to access global IPv4 users/resources, making it important for providers to share scarce global IPv4 addresses effectively. There are two categories of solutions to the problem, carrier-grade NAT (CGN) and ‘A+P’ (each customer sharing the same IPv4 address is assigned an excluded port range). However, both of them have limitations. Specifically, CGN solutions are not scalable and can bring much complexity in managing customers in large-scale deployments, while A+P solutions are not flexible enough to meet dynamic port requirements. In this paper, we propose a hybrid mechanism to improve current solutions and have deployed it in the Tsinghua University Campus Network. The real traffic data shows that our mechanism can utilize limited IPv4 addresses efficiently without degrading the performance of applications on end hosts. Based on the enhanced mechanism, we propose a method to help service providers make address plans based on their own traffic patterns and actual requirements.

Comparing to TCP traffic, the composition of UDP traffic is still unclear. Although it is observed that a large fraction of UDP traffic appears to be P2P applications, application level classification of UDP traffic is still very hard since most of these applications are private protocols based. In this paper, a novel method is proposed to classify UDP traffic. Based on the assumption that traffic from two communicating half-tuples identified by theis from the same application, all half-tuples can be grouped into several connected subgraphs. The port numbers which are adopted by most links or half-tuples in each subgroup can thus be used to characterize the application types of the whole subgroup. Experiment results show that this approach is feasible and can classify UDP traffic only using flow level information. The port numbers adopted by most links or half-tuples are surprisingly stable among different time periods, for example, for Youku application remain the same for more than 90% of periods in all the 1429 periods.

The current Internet is suffering from IPv4 address depletion. Stateless NAT64 is proposed to facilitate the IPv4/IPv6 co-existence and transition. In the past, the stateless NAT64 is mainly for IPv6 clients to access both IPv6 and IPv4 servers. As the fast growth of IP address consuming Internet services, the support for pure IPv6 servers is becoming urgent. In this paper, we propose a design of stateless NAT64 based translator with server port mapping and application layer proxy support to ensure both the IPv4 and IPv6 accessibility to pure IPv6 servers. By deploying such translators, pure IPv6 server infrastructure can be built and the transition process can be promoted.

In the current Internet, IP address system suffers from the overloading of semantics. This brings great challenge to the scalability of the routing system and the mobility of network hosts. One proposal called Locator/ID separation which separates network layer into locater layer and ID layer has been discussed within the IETF and IRTF for years. In the meantime, the Internet is going through a phase of transition from IPv4 to IPv6. One seamless approach called IVI which achieves IPv4/IPv6 inter-connection by stateless address and protocol translation is designed and has been fully tested. However, most of the existing Locator/ID separation approaches do not take IPv4/IPv6 transition into consideration and have scalability problem. In this paper, we propose an evolvable Locator/ID separation Internet architecture (ELISIA), which extends the address mapping mechanism of IVI system and NAT system as its Locator/ID mapping mechanism. In this new architecture, hosts mobility and multihoming are supported, the growth rate of routing table will slow down, both IPv4 and IPv6 applications can get access to Internet without upgrading backbone into dual stack. What's more important, we expect that through the deployment of this architecture, the current Internet would eventually evolve into pure IPv6 network while IPv4 quits from history stage.

Popular Internet services in recent years have shown that remarkable things can be achieved by harnessing the power of the masses. However, crowd-sourcing systems also pose a real challenge to existing security mechanisms deployed to protect Internet services, particularly those tools that identify malicious activity by detecting activities of automated programs such as CAPTCHAs.

The current Internet is challenged by the IPv4 address depletion. The stateless IPv4/IPv6 translation technology (IVI) is proposed to facilitate IPv4/IPv6 coexistence and transition. The IVI protocol translation involves the address mapping between IPv4 and IPv6, but the address mapping rules still rely on static configuration. In this paper, we propose an IVI-based locator/id separation architecture for IPv4/IPv6 transition. The new architecture provides a scalable address mapping mechanism and extends IVI to support inter-domain networking and host mobility. Through the deployment of this architecture, the Internet would eventually evolve into a pure IPv6 backbone while the IPv4 layer would be separated from the IPv6 network via protocol translation.

Data sparseness, the evident characteristic of short text, has always been regarded as the main cause of the low accuracy in the classification of short texts using statistical methods. Intensive research has been conducted in this area during the past decade. However, most researchers failed to notice that ignoring the semantic importance of certain feature terms might also contribute to low classification accuracy. In this paper we present a new method to tackle the problem by building a strong feature thesaurus (SFT) based on latent Dirichlet allocation (LDA) and information gain (IG) models. By giving larger weights to feature terms in SFT, the classification accuracy can be improved. Specifically, our method appeared to be more effective with more detailed classification. Experiments in two short text datasets demonstrate that our approach achieved improvement compared with the state-of-the-art methods including support vector machine (SVM) and Naïve Bayes Multinomial.

Network Coordinate (NC) systems provide an efficient and scalable mechanism to estimate latencies among hosts. However, many popular algorithms like Vivaldi suffer greatly from the existence of Triangle Inequality Violations (TIVs). Two-layer systems like Pharos and hierarchical Vivaldi have been proposed to remedy the impact of TIVs. They divide the whole space into several location-based clusters and run NC systems on both global layer and local layer. However, the two-layer model is only able to optimize the intra-cluster links relating to a limited portion of TIV triangles. In this paper, we propose a new NC system, Tarantula, which divides the space in a novel way. By categorizing the TIVs into three classes, we show that Tarantula handles a much larger portion of existing TIVs than two-layer systems. Moreover, we present two techniques to further strengthen the Tarantula system: 1) relate the updating step size in the Vivaldi algorithm used in Tarantula to ground-truth latency so as to improve the prediction for short links; 2) propose Dynamic Cluster Optimization to dynamically adjust clustering of hosts. Our experimental results show that Tarantula outperforms Pharos and Vivaldi significantly in terms of estimation accuracy. When implementing different NC systems in the application of server selection and detour finding, Tarantula again performs the best.

Twitter-like services are now a popular kind of online social networking services, in which user can express themselves, share contents, and follow others they are interested in. User modeling, building a model for user's interests, is a key problem in many social networking applications, such as recommendation, advertisement, etc. This paper focuses on data selection for user modeling in Twitter-like services. That is, we study the problem of how to select useful data to model a user's interests. Using different data, three user modeling methods are proposed and experiments on a real Twitter-like service are conducted to verify the effectiveness of proposed approaches. Experimental results shows that modeling user's interests with what he/she wrote and selectively what he read performs the best among the three methods we proposed.

IPv4 addresses are already depleted in IANA and will be soon exhausted in RIR while more clients are pouring into the Internet. IPv6, as the only available next generation Internet protocol, is still not commercially successful because a scheme that could solve the migration of IPv4 resources to IPv6 network, as well as mutual communication between the two incompatible protocols, has not been fully developed and deployed. Translation solution provides a proper approach to address this problem. In this article, we propose IVI, an IPv4/IPv6 translation scheme, in order to facilitate resource migration and protocol transition. We explain how it works to translate between IPv4 and IPv6, and how combinations of IVI flavours and various translation scenarios are used in each phase of transition. The evaluation of scalability and robustness, which is important to a widely deployed translation scheme, is also discussed.

Computing the shortest-path distances between nodes is a key problem in analyzing social graphs. Traditional methods like breadth-first search (BFS) do not scale well with graph size. Recently, a Graph Coordinate System, called Orion, has been proposed to estimate shortest-path distances in a scalable way. Orion uses a landmark-based approach, which does not take account of the shortest-path distances between non-landmark nodes in coordinate calculation. Such biased input for the coordinate system cannot characterize the graph structure well. In this paper, we propose Pomelo, which calculates the graph coordinates in a decentralized manner. Every node in Pomelo computes its shortest-path distances to both nearby neighbors and some random distant neighbors. By introducing the novel partial BFS, the computational overhead of Pomelo is tunable. Our experimental results from different representative social graphs show that Pomelo greatly outperforms Orion in estimation accuracy while maintaining the same computational overhead.

Network coordinate (NC) systems provide a lightweight and scalable way for predicting the distances, i.e., round-trip latencies among Internet hosts. Most existing NC systems embed hosts into a low dimensional Euclidean space. Unfortunately, the persistent occurrence of Triangle Inequality Violation (TIV) on the Internet largely limits the distance prediction accuracy of those NC systems. Some alternative systems aim at handling the persistent TIV, however, they only achieve comparable prediction accuracy with Euclidean distance based NC systems. In this paper, we propose an NC system, so-called Phoenix, which is based on the matrix factorization model. Phoenix introduces a weight to each reference NC and trusts the NCs with higher weight values more than the others. The weight-based mechanism can substantially reduce the impact of the error propagation. Using the representative aggregate data sets and the newly measured dynamic data set collected from the Internet, our simulations show that Phoenix achieves significantly higher prediction accuracy than other NC systems. We also show that Phoenix quickly converges to steady state, performs well under host churn, handles the drift of the NCs successfully by using regularization, and is robust against measurement anomalies. Phoenix achieves a scalable yet accurate end-to-end distances monitoring. In addition, we study how well an NC system can characterize the TIV property on the Internet by introducing two new quantitative metrics, so-called RERPLand AERPL. We show that Phoenix is able to characterize TIV better than other existing NC systems.

IPv6 transition problem has become one of the key factors which are holding up the development of the next generation Internet. Aiming to solve IPv6 transition problem, several translation and tunneling techniques have been proposed, satisfying the demand of IPv4-IPv6 interconnection and traversing respectively. However, translation techniques can't convert the semantic between IPv4 and IPv6 protocol perfectly, and they have serious limitations in operation complexity and scalability. Researchers tried to decompose, simplify these problems and improve translation techniques accordingly, but they've come to little achievement since these problems result from the very nature of translation. We propose a novel approach of choosing appropriate translation spot to solve these problems in a different angle, and hence make effective use of translation technique. Then we propose a framework for IPv4-IPv6 coexistence called PET, which integrates tunneling and translation to support both traversing and IPv4-IPv6 interconnection, and uses them properly to constitute communication models in different scenarios. Moreover, we put forward PET signaling method to achieve automatic translation spot election and translation context advertisement, as a complement to the framework.

Multi-party videoconferencing is one many-to-many group communication application in which multicast could be utilized to save bandwidth. For native multicast is still not available everywhere, we need provide scalable and efficient way for unicast users to communicate with multicast-capable users in videoconferencing. This paper proposes one scalable hybrid multicast scheme with peer-forwarding for multi-party videoconferencing. The multicast-capable users are designed as peers to forward data as reflectors do. The group communication mechanisms of hybrid multicast with reflector-based and peer-based data forwarding are introduced. Session management, connection building between peers and unicast users, and terminal functions are introduced. We implement the videoconferencing system based on hybrid multicast and applied it on CERNET backbone. The applications and experiments show that the scheme is feasible and valid.

Routing policies and the complexity of network give rise to violations of the Triangle Inequality with respect to delay (Round-Trip Time) in the Internet. Most of the network coordinate (NC) systems, for example Vivaldi, suffer from inaccurate distance estimation due to such Triangle Inequality Violations (TIVs). In this abstract, we propose a methodology to overcome TIVs by introducing medium in Euclidean distance based NC model.

We present an Internet-scale network topology information (NTI) service named WIND for localizing P2P traffic. Central to WIND are the two simple ideas: 1) obtaining NTI directly from routing infrastructures, and 2) leveraging existing, widely deployed DNS caches for NTI delivery. WIND fulfills the fidelity, flexibility and scalability requirement of an effective NTI service. WIND is deployed in CERNET. We conduct extensive trace-driven emulations on PlanetLab. Experimental results confirm the effectiveness of the WIND service.

Microblogging services, such as Twitter, are among the most important online social networks(OSNs). Different from OSNs such as Facebook, the topology of microblogging service is a directed graph instead of an undirected graph. Recently, due to the explosive increase of population size, graph sampling has started to play a critical role in measurement and characterization studies of such OSNs. However, previous studies have only focused on the unbiased sampling of undirected social graphs. In this paper, we study the unbiased sampling algorithm for directed social graphs. Based on the traditional Metropolis-Hasting Random Walk (MHRW) algorithm, we propose an unbiased sampling method for directed social graphs(USDSG). Using this method, we get the first, to the best of our knowledge, unbiased sample of directed social graphs. Through extensive experiments comparing with the ”ground truth ” (UNI, obtained through uniform sampling of directed graph nodes), we show that our method can achieve excellent performance in directed graph sampling and the error to UNI is less than 10%.

Previously, the network must be congested by probing flow before the congestion-related parameters (such as background flow and available bandwidth) can be estimated, which lead to the inaccuracy and inefficiency of today's Internet. In this work, the authors study how to estimate network state without saturating the network. By introducing the queueing theory, this study proposes a novel packet time series analysis (PTSA) framework model, which can be used to estimate the congestion-related parameters without saturating the network. The accuracy and efficiency of PTSA are validated under NS-2 simulation environment. The performance of PTSA methodology is evaluated in Schooner test-bed with a special scenario. The analytical, simulative and experimental results show that PTSA framework is more efficient to estimate network state with less aggression and higher sensitivity than those methods that need to saturate the network.

In recent research work of securing Network Coordinate (NC) system, they concentrate on the passive security defense mechanisms. In this paper we propose SLINCS, a social link based evaluation security system that utilizes information from existing social relationship networks to implement proactive security mechanisms for NC systems. The key idea is to eliminate suspicious nodes before they launch potential attacks.

Broadcatching is a promising mechanism to improve the experience of BitTorrent users by automatically downloading files advertised through RSS feeds. However, though widely used, the mechanism itself has not been well studied. In this paper, we conducted extensive experiments on PlanetLab to evaluate the performance of Broadcatching under different typical scenarios. The results demonstrated the effectiveness of the broadcatching: it reduces the average completion time and downloading failure ratio. It also improves the overall fairness of the system: the subscribers are encouraged to share more while downloading faster, which results in the increased share ratio. Our study is the first work to systematically evaluate the benefit of broadcatching and sheds lights on how to improve performance of BitTorrrent by manipulating peer's behavior like Broadcatching.

Network coordinates (NC) system is an efficient mechanism for Internet distance prediction with scalable measurements. The intrinsical cause for the unsatisfactory accuracy of the simulation-based NC algorithms has been identified. Then Pharos, a fully decentralised and hierarchical scheme, is proposed to solve this problem. Pharos leverages multiple coordinate sets at different distance scales, with the right scale being chosen for prediction each time. We evaluate the performance of Pharos system with the King data set and latency data from PlanetLab, and compare it with the representative NC system, Vivaldi. The experimental results show that Pharos greatly outperforms Vivaldi in Internet distance prediction without adding any significant overhead. Our extensive evaluation results also demonstrate that Pharos can significantly improve the performance in distributed Internet applications, such as overlay multicast and server selection.

A Network Coordinate (NC) system is an efficient mechanism to predict Internet distance with scalable measurements. In this paper, we focus on the node churn problem – the continuous process of nodes arrival and departure – in distributed applications. Studies on Vivaldi, a representative distributed NC system, show that under node churn the prediction accuracy of the NC system will be seriously impaired. In this paper, we focus on how to handle the impact of node churn in Vivaldi. Firstly, we propose a simple solution by directly increasing the measurement frequency. Our experiments have demonstrated that this approach can reduce the harm of node churn. However, it increases the communication overhead as the measurement frequency grows. To avoid such expensive solution, we propose the design and implementation of Myth, a decentralised and fast convergence NC system. It introduces the merit of Landmark-based NC system to shorten convergence time in Vivaldi with slight extra overhead. Our experimental results show that Myth outperforms Vivaldi a lot under node churn, without compromising the performance under stable environment. Moreover, we have found that the use of Myth is a cost-effective way to achieve higher prediction accuracy; it will not only improve the prediction accuracy but also save the communication overhead.

Modeling the Internet delay structure is an important issue in designing large-scale distributed systems. However, linear models fail to characterize Triangle Inequality Violations (TIV), motivating us to research on nonlinear ones. In this paper, we propose the methodology and design of nonlinear modeling by utilizing Kernel Methods(KM), which is demonstrated effective by simulation. Moreover, our nonlinear model is easy to be applied without introducing any measurement overhead.

Network coordinates (NC) system is an efficient mechanism for Internet distance prediction with limited measurements. In this paper, we identify the intrinsical cause for the inadequate accuracy of the simulation based NC algorithms. We then propose Pharos, a fully decentralized and hierarchical scheme, to remedy this problem. Pharos leverages multiple coordinate sets at different distance scales, with the right scale being chosen for prediction each time. We evaluate the performance of Pharos system with the King data set and latency data from PlanetLab, and compare it with the representative NC system, Vivaldi. The experimental results show that Pharos outperforms Vivaldi much without adding any significant overhead.

A large number of overlay protocols have been developed, almost all of which assume each host has two-way communication capability. However, this does not hold as the deployment of firewalls and Network Address Translators (NAT) is widespread in the current Internet, which is a challenge to the design and implementation of overlay models and protocols. In this paper, we present Potential-based Multicast Tree Algorithm (PMTA) to enhance the multicast tree construction in presence of connectivity restricted hosts. We evaluate PMTA and previous multicast tree protocols based on real Internet end-to-end delay datasets. According to evaluation results, PMTA outperforms those protocols in terms of all metrics. PMTA reduces ARDP by 26%, and it also results in 23%-54% reduction in average overlay latencies. As the results suggest, PMTA can build efficient and effective multicast tree and is suitable for Internet multicast applications in the presence of connectivity restricted hosts.

Network traffic anomaly detection is a difficult problem in network management. This paper presents a wavelet generalized likelihood ratio (WGLR) algorithm and an error performance detection (EPD) algorithm to solve this problem. WGLR algorithm combines generalized likelihood ratio (GLR) algorithm and wavelet transform method, and captures the failure point in real time. Error performance detection (EPD) algorithm is based on the prediction error of the traffic model and regards the error as the statistical variable, comparing with the threshold, which will detect the anomalous change in the signal without test window delay. Simulation and network traffic experiment has demonstrated that the algorithm has the better performance in fault detection.

The current Internet addressing architecture does not verify the source address of a packet received and forwarded. This causes serious security and accounting problems. Based on the drastically increased IPv6 address space, a "source address validation architecture" (SAVA) is proposed in this paper, which can guarantee that every packet received and forwarded holds an authenticated source IP address. The design goals of the architecture are lightweight, loose coupling, "multi-fence support" and incremental deployment. This paper discusses the details of design and implementation for the architecture, including inter-AS, intra-AS and local subnet. This architecture is deployed into the CNGI-CERNET2 infrastructure -a large-scale native IPv6 backbone network of the China Next Generation Internet project. We believe that the source address validation architecture will help the transition to a new, more secure and sustainable Internet.

Packet forwarding prioritization (PFP) in routers is one of the mechanisms commonly available to network administrators. PFP can have a significant impact on the performance of applications, the accuracy of measurement tools' results and the effectiveness of network troubleshooting procedures. Despite their potential impact, no information on PFP settings is readily available to end users. In this paper, we present an end-to-end approach for packet forwarding priority inference and its associated tool, POPI. This is the first attempt to infer router packet-forwarding priority through end-to-end measurement. Our POPI tool enables users to discover such network policies through the monitoring and rank classification of loss rates for different packet types. We validated our approach via statistical analysis, simulation, and wide-area experimentation in PlanetLab. As part of our wide-area experiments, we employed POPI to analyze 156 random paths across 162 PlanetLab nodes. We discovered 15 paths flagged with multiple priorities, 13 of which were further validated through hop-by-hop loss rates measurements. In addition, we surveyed all related network operators and received responses for about half of them confirming our inferences.

Network traffic anomaly detection is a difficult problem in network management. This paper proposed the wavelet generalized likelihood ratio WGLR) algorithm and the error performance detection (EPD) algorithm to solve this problem. The WGLR algorithm combines the generalized likelihood ratio (CLR) algorithm and the Wavelet transform method, and has an advantage of less computation cost. The EPD algorithm, which is based on the prediction error of the traffic model, will detect the anomalous change in the signal without test window delay. Simulating and network traffic experimental results show that the new algorithm has the better performance in network traffic anomaly detection.

Collection selection, ranking collections according to user query is crucial in distributed search. However, few features are used to rank collections in the current collection selection methods, while hundreds of features are exploited to rank web pages in web search. The lack of features affects the efficiency of collection selection in distributed search. In this paper, we exploit some new features and learn to rank collections with them through SVM and RankingSVM respectively. Experimental results show that our features are beneficial to collection selection, and the learned ranking functions outperform the classical CORI algorithm.

Collection size is an important feature to represent the content summaries of a collection, and plays a vital role in collection selection for distributed search. In uncooperative environments, collection size estimation algorithms are adopted to estimate the sizes of collections with their search interfaces. This paper proposes heterogeneous capture (HC) algorithm, in which the capture probabilities of documents are modeled with logistic regression. With heterogeneous capture probabilities, HC algorithm estimates collection size through conditional maximum likelihood. Experimental results on real web data show that our HC algorithm outperforms both multiple capture-recapture and capture history algorithms.

Port scan detection is very important to predict network intrusions and prevent viruses from spreading. Many networks deploy Network Intrusion Detection Systems (NIDS) to detect port scans in real-time. However, most NIDS are perflow based. They are not scalable on high speed links since it is infeasible to maintain the states of numerous flows. In this paper, we propose a scalable scheme for real-time port scan detection without keeping any per-flow state. We use a double-filter structure to find outpairs which connect to more than Npairs in T time. The experimental results on real network traces show that our scheme can find out those over-thresholdpairs with high accuracy. It is easy to scale our scheme to high speed environments due to its little memory consumption and fast processing pipeline.

Internet traffic analysis, models simulation and prediction play a very important part in the network management and design. This paper shows the new thought in network traffic modelling and prediction, and proposes a new algorithm to modify the model coefficient continuously. By far, most of models have not been considered to possess the adaptive ability. Our goal is to improve the model adaptive ability and make the model parameters update dynamically. We present the modified LSL algorithm, which can modify the parameters with each new input data update and has the property of fast convergence and high accuracy.

As the IPv6 networks rapidly deployed, the transition problem has been changed. Because the transition of applications is a steady process with a far longer duration in comparison to the transition of infrastructure, providers cannot give up the duty of serving IPv4 traffics for the time being. On the other hand, operating a dual-stack backbone is highly costing for large-scale deployment of new networks. In this paper, a new technique of forwarding IPv4 traffics in IPv6-only backbone is developed. Rather than the ever-existing tunneling approaches, the proposed one is automatic and stateless for end nodes, without explicit tunneling. The route entries for delivering IPv4 traffics are well aggregated on the borders of IPv6 autonomous systems. This makes the technique suitable for large-scale deployment in an inter-domain networking environment.

Current Internet research suffers from limited information available from public network traffic traces due to the privacy concern of ISP and lack of effective trace distribution systems. In this paper, we present our SANTT (sharing anonymized network traces) system to share valuable network traffic traces safely and widely. SANTT employs a novel prefix-preserving anonymization method to sanitize privacy information in packets and takes advantage of specific high-speed traffic capturing hardware. After removing privacy information, SANTT distributes the traces by multicast, which makes it easy for researchers to access. The experimental results show that SANTT implemented on IXP2400 platform can process the fastest traffic rate (1,1953,125 PPS) offered by Gigabit links with high accuracy and stability

Much work has been done on IPv6 standards and testbeds deployment. However, little is known about the performance of the real IPv6 Internet, especially from the perspective of end users. In this paper, we present a measurement study of current IPv6 performance conducted from CERNET. We study 585, 680 packet-level traces with 133,340 million packets collected from 936 IPv4/IPv6 dual-stack Web servers located in 44 countries. We present a comprehensive performance comparison of IPv6 and IPv4, including connectivity, packet loss rate, round-trip time, etc. Our measurement results show that IPv6 connections tend to have smaller RTTs than their IPv4 counterparts, but suffer higher packet loss rate at the same time. We also notice that tunneled paths do not show notable performance degradation compared with native paths. To our best knowledge, this paper is the first performance study based on both large scale TCP and ICMP traffic measurement in real IPv6 Internet.

Image clustering is an important research topic which contributes to a wide range of applications. Traditional image clustering approaches are based on image content features only, while content features alone can hardly describe the semantics of the images. In the context of Web, images are no longer assumed homogeneous and "flatdistributed but are richly structured. There are two kinds of reinforcements embedded in such data: 1) the reinforcement between attributes of different data types (intra-type links reinforcements); and 2) the reinforcement between object attributes and the inter-type links (inter-type links reinforcements). Unfortunately, most of the previous works addressing relational data failed to fully explore the reinforcements. In this paper, we propose a reinforcement clustering framework to tackle this problem. It reinforces images and texts' attributes via inter-type links and inversely uses these attributes to update these links. The iterative reinforcing nature of this framework promises the discovery of the semantic structure of images, which is the basis of image clustering. Experimental results show the effectiveness of our proposed framework.

Application-layer multicast (ALM), as alternative to IP multicast, provides group communication without the need for network infrastructure support. To improve the reliability of ALM service, path diversity has been studied and two schemes to construct diverse paths for hosts are proposed. One is the random multicast forest (RMF) and the other is topology-aware hierarchical arrangement graph (THAG). RMF makes the paths from the media source to a participating host diverse by selecting parents for each host randomly, while THAG makes the paths node-disjoint by constructing multiple independent multicast trees, where any interior node in a multicast tree will be leaf node in all the other multicast trees. Topology-awareness is implemented in both schemes to make them efficient for media delivery. We compare the reliability and efficiency of THAG and RMF through extensive simulation. The results show that the reliability of THAG has been improved up to 20% compared with RMF. The efficiency metrics, such as relative delay penalty, link stress, and delay variation among different trees in THAG, are also smaller than or almost the same as that in RMF. The results indicate that THAG is a reliable and efficient ALM scheme for streaming media service.

This work presents a high performance, software programmable and low cost accounting management system building on a network processor. In order to achieve this, the hicuts algorithm was also improved to adapt for packet classification in accounting management system. An optimization method was made in order to reduce the IP flow number to enhance the system by dropping the first packet with a SYN flag and recovering its size in the following processing.

Bridging the cognitive gap in image retrieval has been an active research direction in recent years. Existing solutions typically require a large volume of training data that could be difficult to obtain in practice. In this paper, we propose a data-driven approach that uses Web images and their surrounding textual annotations as the source of training data to bridge the cognitive gap. We construct an image thesaurus that contains a set of codewords, each representing a semantically related subspace in the feature space. We also explore the use of query expansion based on the constructed image thesaurus for improving image retrieval performance.

In this paper, we propose a Web image search result organizing method to facilitate user browsing. We formalize this problem as a salient image region pattern extraction problem. Given the images returned by Web search engine, we first segment the images into homogeneous regions and quantize the environmental regions into image codewords. The salient codeword "phrases" are then extracted and ranked based on a regression model learned from human labeled training data. According to the salient "phrases", images are assigned to different clusters, with the one nearest to the centroid as the entry for the corresponding cluster. Satisfying experimental results show the effectiveness of our proposed method.

In this paper, we propose an iterative similarity propagation approach to explore the inter-relationships between Web images and their textual annotations for image retrieval. By considering Web images as one type of objects, their surrounding texts as another type, and constructing the links structure between them via webpage analysis, we can iteratively reinforce the similarities between images. The basic idea is that if two objects of the same type are both related to one object of another type, these two objects are similar; likewise, if two objects of the same type are related to two different, but similar objects of another type, then to some extent, these two objects are also similar. The goal of our method is to fully exploit the mutual reinforcement between images and their textual annotations. Our experiments based on 10,628 images crawled from the Web show that our proposed approach can significantly improve Web image retrieval performance.

At the TCP sender side, the arrival of an ack packet always triggers the sender to send data packets, which establishes a correspondency between the arrived ack packet and the sent data packets. In a TCP connection, the correspondency between every ack packet and its corresponding data packets forms a sequence. This sequence characterizes the sender's behavior. In this paper, we propose a method to estimate this correspondency sequence from the dump trace measured at the receiver side. Because many possible correspondency sequences can be constructed based on the trace, the problem here is an estimation problem, which is to select a most possible one from those candidate sequences. The method proposed first eliminates some candidates that violate basic TCP congestion behavior. Then, it chooses the most possible one among the remaining sequences using the statistical characteristics of delays between the acks and their corresponding data packets under maximum-likelihood criterion. The method can work in the condition when the TCP connection experiences various network delay and loss, and it applies to TCP senders of different versions. Simulations and Internet experiments have been performed to validate the method.

This paper proposes and analyzes an evolving training model method for selecting the best training parameters of one-class support vector machines (SVM). The method: 1) presents and computes effectively the generalization performance of one-class SVM, including using fraction of support vectors and /spl xi//spl alpha//spl rho/-estimate of recall to evaluate the size of region and the generalization fraction of data points in the region, respectively; and 2) uses genetic algorithms to evolve the training model, the evolution is supervised by the generalization performance of one-class SVM. Experiments on an artificial data illustrate the adaptation of the region to the distribution. Experiments on a standard intrusion detection dataset demonstrate that our method not only improves the false positive rate and detection rate, but also is able to control the tradeoff between these measures.