Network service providers rely on network functions (NFs) for security, performance optimization, and traffic management. User traffic typically traverses a chain of these functions to satisfy both user-level and infrastructure requirements. Traditionally, NFs have been implemented either in flexible software or in high-performance fixed-function hardware, leading to a tradeoff between agility and efficiency. The advent of programmable networking hardware offers a new balance between flexibility and performance, enabling the deployment of NFs directly on commodity devices such as programmable switches, SmartNICs, and DPUs. However, programming these devices remains challenging due to limited compute and memory resources and the diversity of their architectures and abstractions.We introduce SALAD-Nets, a framework that automatically maps virtual NF chains onto heterogeneous programmable infrastructures. Given a high-level specification of a virtual network of NFs, SALAD-Nets generates both the deployment plan and the acceleration code for each target device, respecting infrastructure constraints and user objectives. The poster presents the architecture and workflow of SALAD-Nets, showing how it addresses the dual challenges of automatic NF code generation and distributed deployment across diverse programmable hardware.

Smart farming efficiency has increased through IoT adoption, but the technology raises crucial security and privacy threats that affect resource-limited devices. Smart farming networks experience vulnerability to cyber threats like unauthorized access, data tampering, and Distributed Denial-of-Service attacks because standard security approaches do not provide adaptive protection and energy-efficient security. This paper proposes the Energy-Aware Adaptive Security Framework (EAASF), a multilayered, intelligent security approach designed to safeguard IoTdriven agriculture. The framework is dynamic in terms of security settings, depending on real-time threats and device energy capabilities, and Amount of processing capacity through hybrid Intrusion Detection Systems (IDS), Intrusion Prevention Systems (IPS), Software-Defined Networking (SDN), fog computing. This dynamic security system offers greater protection with minimal waste of resources; thus, it is suitable in rural and energy-limited settings. Focusing on the combined problem of security and energy efficiency, EAASF will increase the cyber resilience of smart farming, the integrity of data and network security, and contribute to sustainable agriculture.

The success of the Internet is undeniable, but so are its limitations. Over the past two decades, the research community has responded with clean-slate redesigns, proposing innovative architectures focused on issues like security and information dissemination, among others. Unfortunately, these efforts have had limited impact on the commercial Internet, if any. The reason is that the Internet architecture is deeply entrenched, making a complete replacement elusive.

We present the design and implementation of Vigor, a software stack and toolchain for building and running software network middleboxes that are guaranteed to be correct, while preserving competitive performance and developer productivity. Developers write the core of the middlebox---the network function (NF)---in C, on top of a standard packet-processing framework, putting persistent state in data structures from Vigor's library; the Vigor toolchain then automatically verifies that the resulting software stack correctly implements a specification, which is written in Python.

Software network functions promise to simplify the deployment of network services and reduce network operation cost. However, they face the challenge of unpredictable performance. Given this performance variability, it is imperative that during deployment, network operators consider the performance of the NF not only for typical but also adversarial workloads. We contribute a tool that helps solve this challenge: it takes as input the LLVM code of a network function and outputs packet sequences that trigger slow execution paths. Under the covers, it combines directed symbolic execution with a sophisticated cache model to look for execution paths that incur many CPU cycles and involve adversarial memory-access patterns. We used our tool on 11 network functions that implement a variety of data structures and discovered workloads that can in some cases triple latency and cut throughput by 19% relative to typical testing workloads.

We present a Network Address Translator (NAT) written in C and proven to be semantically correct according to RFC 3022, as well as crash-free and memory-safe. There exists a lot of recent work on network verification, but it mostly assumes models of network functions and proves properties specific to network configuration, such as reachability and absence of loops. Our proof applies directly to the C code of a network function, and it demonstrates the absence of implementation bugs. Prior work argued that this is not feasible (i.e., that verifying a real, stateful network function written in C does not scale) but we demonstrate otherwise: NAT is one of the most popular network functions and maintains per-flow state that needs to be properly updated and expired, which is a typical source of verification challenges. We tackle the scalability challenge with a new combination of symbolic execution and proof checking using separation logic; this combination matches well the typical structure of a network function. We then demonstrate that formally proven correctness in this case does not come at the cost of performance. The NAT code, proof toolchain, and proofs are available at [58].

Large flows like videos consume significant bandwidth. Some ISPs actively manage these high volume flows with techniques like policing, which enforces a flow rate by dropping excess traffic. While the existence of policing is well known, our contribution is an Internet-wide study quantifying its prevalence and impact on video quality metrics. We developed a heuristic to identify policing from server-side traces and built a pipeline to deploy it at scale on traces from a large online content provider, collected from hundreds of servers worldwide. Using a dataset of 270 billion packets served to 28,400 client ASes, we find that, depending on region, up to 7% of lossy transfers are policed. Loss rates are on average six times higher when a trace is policed, and it impacts video playback quality. We show that alternatives to policing, like pacing and shaping, can achieve traffic management goals while avoiding the deleterious effects of policing.

Google's Borg system is a cluster manager that runs hundreds of thousands of jobs, from many thousands of different applications, across a number of clusters each with up to tens of thousands of machines.

Wireless sensing and actuation have been explored in many contexts, but the automotive setting has received relatively little attention. Automobiles have tens of onboard sensors and expose several hundred engine parameters which can be tuned (a form of actuation). The optimal tuning for a vehicle can depend upon terrain, traffic, and road conditions, but the ability to tune a vehicle has only been available to mechanics and enthusiasts. In this paper, we describe the design and implementation of CarMA (Car Mobile Assistant), a system that provides high-level abstractions for sensing automobile parameters and tuning them. Using these abstractions, developers can easily write smart-phone "apps" to achieve fuel efficiency, responsiveness, or safety goals. Users of CarMA can tune their vehicles at the granularity of individual trips, a capability we call personalized tuning. We demonstrate through a variety of applications written on top of CarMA that personalized tuning can result in over 10% gains in fuel efficiency. We achieve this through route-specific or driver-specific customizations. Furthermore, CarMA is capable of improving user satisfaction by increasing responsiveness when necessary, and promoting vehicular safety by appropriately limiting the range of performance available to novice or unsafe drivers.

From agriculture to industry, from the office to our homes, Wireless Sensor Networks (WSNs) are becoming a part of everyday life in many application areas. In typical WSN applications, the sensor nodes are fixed and interconnected amongst each other and to the outside world on a permanent basis. However, in certain types of applications, where the area to sense is wide and sensors are sparsely distributed, a different approach can be used. A mobile node can roam in the sensor field to collect and exchange information with disconnected clusters of nodes. This paper addresses the limitations of real world sensor networks with such moving nodes. To understand the behavior of a typical WSN node in these situations, two types of experiments were conducted. To begin with, the communication performance was measured, in a static scenario, establishing the base-line behavior. Afterwards, a second set of experiments was carried out with fast moving nodes at different speeds. Finally, the results of the two experiments were compared and analyzed.

A flexible wireless sensor network platform for easier implementation of diverse applications has been developed and deployed at the Institute Superior Tecnico - Technical University of Lisbon (IST-TUL). This test-bed integrates multiple projects into a single common network, thus creating an expandable platform that facilitates the development of future applications. To achieve this flexibility, a dedicated software framework was developed that not only provides a centralized configuration panel that is accessible over the Internet, allowing the administrator to configure common network parameters, but also supports application programmability, enabling fine-grained control of in-network sensing, processing, and actuation. On top of this platform, three initial applications have been developed and are currently coexisting within the same network, thus demonstrating the new platform's capabilities. The paper discusses the main issues related with the test-bed architecture and the development of an environmental interaction application, with an illustrative purpose, along with the deployment challenges. Results of the experimental evaluation of the test-bed are also shown, focusing on the performance of the environmental interaction application's in-network processing system. A particularly relevant result is denoted by the minimum time the network needs to complete its processing tasks (approximately 200 ms in our test topology).