Weak authentication practices that rely on passwords for security have led to widespread data breaches and successful phishing attacks. Recent advances in the cost and usability of hardware security tokens have made the prospect of effectively augmenting password-based authentication or removing it altogether a possibility. To actualize this, a paradigm change in how people learn to authenticate accounts on-line must occur. Towards this end, we describe a curriculum to teach high-school students the perils of passwords and a program to distribute hardware security tokens to them as they are first setting up their on-line presence in order to improve the security of the next generation.

CyberPDX is an annual professional development program hosted at Portland State University. Our long-term goal is to broaden participation in cybersecurity. Since 2016, over 70 middle and high school teachers from the Pacific Northwest have participated in the STREAM program, which offers interdisciplinary instruction in programming, cryptography, personal security, policy, literature, and arts. In this poster, we share our interdisciplinary curriculum, present data on short-term impacts, and describe our in-progress work to evaluate the program's longer term impacts.

Spam is a problem that refuses to go away. An immense amount of time and money is currently devoted to hiding spam, but not enough is devoted to effectively preventing it. CAPTCHAs are a prevalent spam prevention mechanism, but are getting harder for humans to solve and easier for programs to "break". CAPTCHAs also cannot prevent spam from hijacked accounts since they are mostly used during account creation. Proof-of-work approaches are gaining popularity, but current implementations are not effective enough and cannot be used by generic web applications. We present MetaCAPTCHA, an application-agnostic spam prevention service for web applications. MetaCAPTCHA dynamically issues CAPTCHAs and proof-of-work "puzzles" while ensuring that more malicious users solve "harder" puzzles. In order to support its operation, MetaCAPTCHA implements a novel secure protocol -- for authenticating web sites and validating proof-of-work solutions -- that allows for seamless integration across a variety of web applications.

Crowd-sourced mobile embedded systems allow people to contribute sensor data, for critical applications, including transportation, emergency response and eHealth. Data integrity becomes imperative as malicious participants can launch software and Sybil attacks modifying the sensing platform and data. To address these attacks, we develop (1) a Trusted Sensing Peripheral (TSP) enabling collection of high-integrity raw or aggregated data, and participation in applications requiring additional modalities; and (2) a Secure Tasking and Aggregation Protocol (STAP) enabling aggregation of TSP trusted readings by untrusted intermediaries, while efficiently detecting fabricators. Evaluations demonstrate that TSP and STAP are practical and energy-efficient.

Online games are a rapidly growing Internet application. In order to run a successful online game, game companies and game infrastructure providers must properly manage game workloads and content so that they can maximize player satisfaction while minimizing their own costs. Toward this end, this paper provides a comprehensive, long-term analysis of several popular online games and their players using one of the richest data sets available for online games.

As a result of physically owning the client machine, cheaters in online games currently have the upper-hand when it comes to avoiding detection. To address this problem and turn the table on cheaters, this paper presents Fides, an anomaly-based cheat detection approach that remotely validates game execution. With Fides, a server-side Controller specifies how and when a client-side Auditor measures the game. To accurately validate measurements, the Controller partially emulates the client and collaborates with the server. This paper examines a range of cheat methods and initial measurements that counter them, showing that a Fides prototype is able to efficiently detect several existing cheats, including one state-of-the-art cheat that is advertised as "undetectable".

Unwanted traffic remains a fundamental problem for networked systems. Proof-of-work (PoW) is a defense mechanism that adds a client-specific challenge at the start of a networked protocol. The challenge acts as a filter for clients based on their willingness to solve a computational task of varying difficulty. The difficulty is tailored to the individual client and is set proportional to its relative load on the server.

As video sensor networks become more widely deployed, mechanisms for adaptively transmitting video data within the network are necessary because of their generally large resource requirements compared to their scalar counterparts. The key features of such networks include (i) many sources can inject video into the network that is destined for the same sink and (ii) nodes that participate in routing can also potentially work collaboratively for the benefit of the entire system. In this paper, we propose a multi-hop buffering and adaptation framework for video-based sensor networking applications. We explore several approaches in this framework and compare their performance with traditional IP-based video streaming technologies. Our experiments show that these approaches outperform traditional technologies in video quality, bandwidth waste, and bandwidth sharing fairness.

Cheating in on-line games is a prevalent problem for both game makers and players. The popular real-time strategy game genre is especially vulnerable to cheats, as it is frequently hosted as a peer-to-peer game. As the genre has moved towards a distributed simulation approach to gameplay, the number of cheats has been reduced to bug exploits and “maphacks”: a form of information exposure that reveals the opponent’s units and positions when they should be hidden. This paper proposes a technique for detecting maphacking based on bit commitment and explores the tradeoffs in network traffic and information exposure inherent in reducing information exposure in peer-to-peer games.

Complex heterogeneous sensor networks that include both traditional scalar and richer video data are becoming possible. With such technologies comes the task of making them useful to the applications that rely on them. Unfortunately, such applications are extremely diverse in the interaction requirements of the system components. This paper argues that the system software for such sensor systems needs to balance optimization for performance and providing a flexible interface that can be tailored to the requirements of the user application. We propose Cascades, a cascading filter mechanism that can allow users to quickly compose and re-task diverse sensor systems (which include both scalar and video-based sensors) with highly optimized application-specific algorithms.

A wireless network of remotely located, self-powered video sensors must make efficient use of limited network capacity and power. An ideal media-access protocol for such a network would fully utilize available throughput while using no more power than necessary and maintaining a reasonable level of fairness. To accomplish these goals, the paper proposes and evaluates a time-division multiple-access protocol that may run on top of unmodified IEEE 802.11 hardware. Our protocol uses an 802.11 access point as a controller for a set of 802.11 clients. The controller allocates timeslots to its clients; during its timeslot, a client may send to and receive from the controller. Each client may turn its radio off during other clients' timeslots to save power that would otherwise be wasted contending for a busy channel. We compare and contrast our protocol to other wireless power-saving mechanisms, then discuss the design and implementation of our protocol and its performance compared to standard 802.11 in terms of throughput, power, and fairness. We conclude that our protocol offers a significant reduction in power consumption and improved fairness. Finally, we show that our protocol's throughput is similar to that of standard 802.11.

Video-based sensor networks can provide important visual information in a number of applications including: environmental monitoring, health care, emergency response, and video security. This article describes the Panoptes video-based sensor networking architecture, including its design, implementation, and performance. We describe two video sensor platforms that can deliver high-quality video over 802.11 networks with a power requirement less than 5 watts. In addition, we describe the streaming and prioritization mechanisms that we have designed to allow it to survive long-periods of disconnected operation. Finally, we describe a sample application and bitmapping algorithm that we have implemented to show the usefulness of our platform. Our experiments include an in-depth analysis of the bottlenecks within the system as well as power measurements for the various components of the system.

This paper describes the results of the first comprehensive analysis of a range of popular on-line, multiplayer, game servers. The results show that the traffic behavior of these servers is highly predictable and can be attributed to the fact that current game designs target the saturation of the narrowest, last-mile link. Specifically, in order to maximize the interactivity of the game itself and to provide relatively uniform experiences between players playing over different network speeds, on-line games typically fix their usage requirements in such a way as to saturate the network link of their lowest speed players. While the traffic observed is highly predictable, the traces also indicate that these on-line games provide significant challenges to current network infrastructure. As a result of synchronous game logic requiring an extreme amount of interactivity, a close look at the trace reveals the presence of large, highly periodic, bursts of small packets. With such stringent demands on interactivity, routers must be designed with enough capacity to quickly route such bursts without delay.

Many network devices such as routers and firewalls employ caches to take advantage of temporal locality of packet headers in order to speed up packet processing decisions. Traditionally, cache designs trade off time and space with the goal of balancing the overall cost and performance of the device. We examine another axis of the design space that has not been previously considered: accuracy. In particular, we quantify the benefits of relaxing the accuracy of the cache on the cost and performance of packet classification caches. Our cache design is based on the popular Bloom filter data structure. This paper provides a model for optimizing Bloom filters for this purpose, as well as extensions to the data structure to support graceful aging, bounded misclassification rates, and multiple binary predicates. Given this, we show that such caches can provide nearly an order of magnitude cost savings at the expense of misclassifying one billionth of packets for IPv6-based caches.

Multi-field packet classification is frequently performed by network devices such as edge routers and firewalls - such devices can utilize programmable network processors to perform this computation-intensive task at nearly line speeds. The architectures of programmable network processors are typically highly parallel and a single algorithm can be mapped in different ways onto the hardware. We study the performance of two different design mappings of the bit vector packet classification algorithm on the Intel/sup /spl reg// IXP1200 network processor. We show that: (i) overall, parallel mapping has a better packet processing rate (25% more) than pipelined mapping; (ii) in parallel mapping, a processing element's utilization can be considerably affected by code complexity, in terms of branching, because of significant time wasted (as much as 40% more) due to aborting instruction execution pipelines; (iii) in pipelined mapping, multiple memory reads per packet can lower the overall performance.

For many on-line games, user experience is impacted significantly by network latency. As on-line games and on-line game servers proliferate, the ability to discover and connect to nearby servers is essential for maintaining user satisfaction. In this paper, we present a redirection service for on-line games based on the geographic location of players relative to servers. As our results show, the service better meets client demand, saving each client and the Internet as a whole, thousands of miles of networking inefficiency.

This demonstration will show the video sensor networking technologies developed at the OGI School of Science and Engineering. The general purpose video sensors allow programmers to create application-specific filtering, power management, and event triggering mechanisms. The demo will show a handful of video sensors operating under a variety of conditions including intermittent network connectivity as one might see in an environmental observation application.

Video-based sensor networks can provide important visual information in a number of applications including: environmental monitoring, health care, emergency response, and video security. This paper describes the Panoptes video-based sensor networking architecture, including its design, implementation, and performance. We describe a video sensor platform that can deliver high-quality video over 802.11 networks with a power requirement of approximately 5 watts. In addition, we describe the streaming and prioritization mechanisms that we have designed to allow it to survive long-periods of disconnected operation. Finally, we describe a sample application and bitmapping algorithm that we have implemented to show the usefulness of our platform. Our experiments include an in-depth analysis of the bottlenecks within the system as well as power measurements for the various components of the system.

This paper describes the results of a 500 million packet trace of a popular on-line, multi-player, game server. The results show that the traffic behavior of this heavily loaded game server is highly predictable and can be attributed to the fact that current game designs target the saturation of the narrowest, last-mile link. Specifically, in order to maximize the interactivity of the game and to provide relatively uniform experiences between all players, on-line games typically fix their usage requirements in such a way as to saturate the network link of their lowest speed players. While the traffic observed is highly predictable, the trace also indicates that these on-line games provide significant challenges to current network infrastructure. Due to synchronous game logic requiring an extreme amount of interactivity, a close look at the trace reveals the presence of large, highly periodic, bursts of small packets. With such stringent demands on interactivity, routers must be designed with enough capadty to quickly route such bursts without delay. As current routers are designed for bulk data transfers with larger packets, a significant, concentrated deployment of online game servers will have the potential for overwhelming current networking equipment.

In order to stem the increasing packet loss rates caused by an exponential increase in network traffic, the IETF has been considering the deployment of active queue management techniques such as RED (random early detection) (see Floyd, S. and Jacobson, V., IEEE/ACM Trans. Networking, vol.1, p.397-413, 1993). While active queue management can potentially reduce packet loss rates in the Internet, we show that current techniques are ineffective in preventing high loss rates. The inherent problem with these algorithms is that they use queue lengths as the indicator of the severity of congestion. In light of this observation, a fundamentally different active queue management algorithm, called BLUE, is proposed, implemented and evaluated. BLUE uses packet loss and link idle events to manage congestion. Using both simulation and controlled experiments, BLUE is shown to perform significantly better than RED, both in terms of packet loss rates and buffer size requirements in the network. As an extension to BLUE, a novel technique based on Bloom filters (see Bloom, B., Commun. ACM, vol.13, no.7, p.422-6, 1970) is described for enforcing fairness among a large number of flows. In particular, we propose and evaluate stochastic fair BLUE (SFB), a queue management algorithm which can identify and rate-limit nonresponsive flows using a very small amount of state information.

This paper describes and evaluates stochastic fair blue (SFB), a novel technique for enforcing fairness among a large number of rows. SFB scalably detects and rate-limits non-responsive flows through the use of a marking probability derived from the blue queue management algorithm and a Bloom (1970) filter. Using analysis and simulation, SFB is shown to effectively handle non-responsive flows using an extremely small amount of state information.

This paper exposes an inherent weakness in current active queue manage ment techniques such asRedin that they rely on queue lengths to indicate the severity of congestion. In light of this observation, a fundamentally different active queue management algorithm calledBlueis proposed.Blueuses packet loss and link utilization to manage congestion. Using simulation and controlled experiments,Blueis shown to significantly outperformRedin providing lower packet loss rates and smaller queuing delays to networked applications such as interactive audio and video.

The congestion control mechanisms used in TCP have been the focus of numerous studies and have undergone a number of enhancements. However, even with these enhancements, TCP connections still experience alarmingly high loss rates, especially during times of congestion. To alleviate this problem, the IETF is considering active queue management mechanisms, such as random early detection (RED), for deployment in the network. In this paper, we first show that the effectiveness of RED depends, to a large extent, on the appropriate parameterization of the RED queue. We then show that there is no single set of RED parameters that work well under different congestion scenarios. In light of this observation, we propose and experiment with more adaptive RED gateways which self-parameterize themselves based on the traffic mix. The results show that traffic cognizant parameterization of RED gateways can effectively reduce packet loss, while maintaining high link utilizations under a range of network loads.

The transfer of prerecorded, compressed variable-bit-rate video requires multimedia services to support large fluctuations in bandwidth requirements on multiple time scales. Bandwidth smoothing techniques can reduce the burstiness of a variable-bit-rate stream by transmitting data at a series of fixed rates, simplifying the allocation of resources in video servers and the communication network. This paper compares the transmission schedules generated by the various smoothing algorithms, based on a collection of metrics that relate directly to the server, network, and client resources necessary for the transmission, transport, and playback of prerecorded video. Using MPEG-1 and MJPEG video data and a range of client buffer sizes, we investigate the interplay between the performance metrics and the smoothing algorithms. The results highlight the unique strengths and weaknesses of each bandwidth smoothing algorithm, as well as the characteristics of a diverse set of video clips.

This paper examines the use of adaptive priority marking for providing soft bandwidth guarantees in a differentiated-services Internet. In contrast to other proposals for achieving the same objective, the proposed scheme does not require resource reservation for individual connections and can be supported with minimal changes to the network infrastructure. It uses modest support from the network in the form of priority handling for appropriately marked packets, and relies on intelligent transmission control mechanisms at the edges of the network to achieve the desired throughput levels. This paper describes the control mechanisms and evaluates their behavior in various network environments. These mechanisms are show in to have several salient features which make them suitable for deployment in an evolving Internet.

A large number of Internet applications are sensitive to overload conditions in the network. While these applications have been designed to adapt somewhat to the varying conditions in the Internet, they can benefit greatly from an increased level of predictability in network services. We propose minor extensions to the packet queueing and discard mechanisms used in routers, coupled with simple control mechanisms at the source that enable the network to guarantee minimal levels of throughput to different sessions while sharing the residual network capacity in a cooperative manner. The service realized by the proposed mechanisms is an interpretation of the controlled-load service being standardized by the Internet Engineering Task Force. Although controlled-load service can be used in conjunction with any transport protocol, our focus in this paper is on understanding its interaction with Transmission Control Protocol (TCP). Specifically, we study the dynamics of TCP traffic in an integrated services network that simultaneously supports both best-effort and controlled-load sessions. In light of this study, we propose and experiment with modifications to TCP's congestion control mechanisms in order to improve its performance in networks where a minimum transmission rate is guaranteed. We then investigate the effect of network transients, such as changes in traffic load and in service levels, on the performance of controlled-load as well as best-effort connections. To capture the evolution of integrated services in the Internet, we also consider situations where only a selective set of routers are capable of providing service differentiation between best-effort and controlled-load traffic. Finally, we show how the service mechanisms proposed here can be embedded within other packet and link scheduling frameworks in a fully evolved integrated services Internet.

Multimedia applications that transmit long continuous streams of data across the Internet will continue to stress networking technologies for the years to come. To help improve the performance of congestion avoidance protocols like TCP and to punish non-adaptive UDP-based applications, the IETF is considering the widespread deployment of random early detection (RED) queue management. We examine the impact of RED queue management on multimedia applications and their congestion control mechanisms. Our results show that even in ideal scenarios, the use of TCP-based congestion control in conjunction with active queue management based on RED will add significantly more bandwidth jitter over both short and long time scales, making it particularly difficult for adaptive, TCP-compatible, multimedia applications to converge on a single, fixed sending rate.

This paper examines the use of adaptable priority marking for providing soft bandwidth guarantees to individual connections or connection groups over the Internet. In contrast to other proposals for service differentiation which focus on providing firm performance guarantees, the proposed scheme does not require resource reservation for individual connections and can be supported with minimal changes to the network infrastructure. It uses modest support from the network in the form of priority handling for appropriately marked packets and relies on intelligent transmission control mechanisms at the edges of the network to achieve the desired throughput levels. The paper describes the control mechanisms and evaluates their behaviour in various network environments. These mechanisms are shown to have several salient features which make them suitable for deployment in an evolving Internet.

Maximizing overall performance in multicomputers requires matching application communication characteristics with a suitable routing scheme.However, since the communication demands of emerging applications vary significantly, it is hard for a single routing algorithm to perform well under all workloads.In order to study the complex dependencies between routing policies and communication workloads, we have performed a set of multi-factor experiments to better characterize routing performance.These experiments show that in addition to adaptivity, the selection functions used to order the candidate links greatly affect network performance under various traftic patterns.By supporting flexible routing, the network can tune its routing policies to application communication characteristics in order to improve performance.

The paper presents pp-mess-sim, an object-oriented discrete-event simulation environment for evaluating interconnection networks in message-passing systems. The simulator provides a toolbox of various network topologies, communication workloads, routing-switching algorithms, and router models. By carefully defining the boundaries between these modules, pp-mess-sim creates a flexible and extensible environment for evaluating different aspects of network design. The simulator models emerging multicomputer networks that can support multiple routing and switching schemes simultaneously; pp-mess-sim achieves this flexibility by associating routing-switching policies, traffic patterns, and performance metrics with collections of packets, instead of the underlying router model. Besides providing a general framework for evaluating router architectures, pp-mess-sim includes a cycle-level model of the PRC, a programmable router for point-to-point distributed systems. The PRC model captures low-level implementation details, while another high-level model facilitates experimentation with general router design issues. Sample simulation experiments capitalize on this flexibility to compare network architectures under various application workloads.

SPIDER is a network adapter that provides scalable communication support for point-to-point distributed systems. The device exports an efficient interface to the host processor, provides transparent support for dependable, time-constrained communication, and handles packet routing and switching. The communication support provided by SPIDER exploits concurrency between the independent data channels feeding the point-to-point network, and offers flexible and transparent hardware mechanisms. SPIDER allows the host to exercise fine-grain control over its operation, enabling the latter to monitor and influence data transmission and reception efficiently. In the current implementation, SPIDER interfaces to the Ironics IV-3207, a VMEbus-based 68040 card and will be controlled by x-kernel, a communication executive allowing the flexible composition of communication protocols.>