Live virtual machine (VM) migration is commonly used for enabling dynamic resource or fault management, or for load balancing in datacenters or cloud platforms. A service hosted by a VM may also be migrated to prevent its visibility to an external adversary who may seek to disrupt its operation by launching a DDoS attack against it. We first show that current systems cannot adequately hide a VM migration from an external adversary. The key reason for this is that a migration typically manifests a traffic pattern with distinguishable statistical properties. We introduce two new attacks that can allow an adversary to effectively track a migration in progress, by leveraging observations of these properties. As our primary contribution, we design and implement a stealth migration framework that causes migration traffic to be indistinguishable from regular Internet traffic, with a negligible latency overhead of approximately 0.37 seconds, on average.

We present XSWAT (Xen SoftWare ATtestation), a system that makes use of timing based software attestation to verify the integrity of cloud computing platforms. We believe that ours is the first instance of a system that uses this attestation technique in a cloud environment and results obtained indicate the feasibility of its deployment. An overview of the XSWAT system and the associated threat model, along with a study of cloud environment impacts on performance, is presented. Environmental parameters include types of interconnects between the XSWAT verifier and measurement agent as well as the number of concurrently executing virtual machines on the platform being verified. Conversely, we also study the impact of XSWAT execution using well known system benchmarks and find this to be insignificant, thereby strengthening the case for XSWAT. We also discuss novel XSWAT mechanisms for addressing TOCTOU attacks.

We describe a system for estimating the reliability of nodes in a mobile ad hoc network. The goal of the system is to detect insider attacks on the control plane of wireless protocols at the link and network layers, and to generate and propagate corresponding reliability estimates for nodes across the network. Our contributions are two-fold: first, we implement a cross-layer invariant-based technique for attack detection, where rules about correct combined behavior of protocols are specified based on data collected from multiple layers of the protocol stack. Next, we use the results of our attack detection techniques to compute reliability estimates for network nodes, where a reliability estimate represents the estimate of a node N for another node M. The form of our reliability estimate for a node is expressed as (t, c), where t indicates the trust for that node, and c indicates the confidence in this trust value. Reliability estimates are propagated across the network in a manner that is resilient to malicious nodes that propagate false reliability estimates, and minimizes network overheads. Our simulation results show that the above techniques result in highly accurate reliability estimates even in the presence of multiple malicious nodes in the network.

In this paper, we discuss a time synchronization approach to the time divergence problem in hybrid network emulation. Such emulation comprises primarily a discrete-event simulated network and virtual machines that send and receive traffic through the simulated network. For slower than real-time network simulations, the rate of time advance on virtual machines (real time) is faster than that of the discrete-event time. Consequently, packet transmission latency and other metrics in such hybrid network emulations will be distorted. As a result, e.g., TCP sessions between virtual machines may unduly time out. To address this problem, we have developed TimeSync, which tracks discrete-event simulation time to control time advance on virtual machines for slower than real time simulations so that time perception in the hybrid network emulation system is synchronized. We describe how TimeSync works and present our experimental evaluation and analysis.

Computer networks exist to provide a communication medium for social networks, and information from social networks can help in estimating their communication needs. Despite this, current network management ignores the information from social networks. On the other hand, due to their limited and fluctuating bandwidth, mobile ad hoc networks are inherently resource-constrained. As traffic load increases, we need to decide when and how to throttle the traffic to maximize user satisfaction while keeping the network operational. The state-of-the-art for making these decisions is based on network measurements and so employs a reactive approach to deteriorating network state by reducing the amount of traffic admitted into the network. However, a better approach is to avoid congestion before it occurs, by (a) monitoring the network for early onset signals of congestive phase transition, and (b) predicting future network traffic using user and application information from the overlaying social network. We use machine learning methods to predict the amount of traffic load that can be admitted without transitioning the network to a congestive phase and to predict the source and destination of near future traffic load. These two predictions when fed into an admission control component ensure better management of constrained network resources while maximizing the quality of user experience.

Virtual Ad Hoc Network (VAN) testbed aims at achieving large scale application testing for ad hoc networks by integrating host virtualization and network simulation. Efficient use of storage space is essential for such testbeds. Storage redundancy resulting from duplicated files and application installations across the virtual machines in a large scale testbed (> a few hundred VMs) can be significantly reduced by using storage sharing techniques. Although Content Addressable Storage (CAS) along with Copy-on-write can remove storage redundancy at block-level, it requires hash computation for every write operation that incurs considerable online computation overhead.

Due to their limited and fluctuating bandwidth, mobile ad hoc networks (MANETs) are inherently resource-constrained. As traffic load increases, we need to decide when to throttle the traffic to maximize user satisfaction while keeping the network operational. The state-of-the-art for making these decisions is based on network measurements and so employs a reactive approach to deteriorating network state by reducing the amount of traffic admitted into the network. However, a better approach is to avoid congestion before it occurs by predicting future network traffic using user and application information from the overlaying social network. We use machine learning methods to predict the source and destination of near future traffic load.

Testing and evaluation of applications over mobile ad hoc networks is a challenge due to the difficulty of conducting field experiments and regression test. The common practice today is to perform such testing in a virtual ad hoc network testbed before field experiments. Although typical emulated network testbeds can be instrumented to generate and control certain network conditions, there is a class of network-aware applications, including network management systems, that needs to interact with network elements in order to observe and control the network behavior. To support testing and evaluation of such applications, a virtual ad hoc network testbed must allow monitoring as well as runtime configuration and control of the virtual network. Moreover, such virtual network testbeds should i) present a standard-based interface, ii) streamline the testbed setup process, and iii) not require any code modification to the application under test. In this paper, we present techniques that can satisfy the above requirements for a virtual ad hoc network testbed. An SNMP interface was used to illustrate the automation of testbed setup for evaluating applications as is.

In large-scale service monitoring, automated dynamic (re)distribution of running monitoring applications is likely to push the limits of scalability. In the aggregation nets approach, we associate each partition of a distributed application with an autonomous agent capable of relocating the partition fully or partially, or modifying it to accommodate the dynamics of its local environment. Coordinated agent behaviour is to result in maintaining acceptable performance for the whole application. Aggregation nets is a typical Grid application that relies on the availability of distributed computing power and a network sensing infrastructure that provides information for agent decision-making. In order to evaluate our approach, we emulate aggregation nets on top the physical network simulator Berkeley ns. We describe our model of aggregation nets, and its implementation.