This work addresses the problem of delay-sensitive job scheduling in cloud computing systems that offer two compute options: (i) low-cost, high-demand spot servers and (ii) high-cost on-demand servers. While prior research has focused on scheduling a single job, we consider a more practical scenario where a continuous stream of jobs, categorized into n different classes, must be managed. Each class i is characterized by an on-demand cost ki, an arrival rate λi, and an average delay constraint δi. With Poisson job arrivals and spot server availability modeled as an exponential service process, we optimize two key aspects: (i) the wait-time distribution for each job class and (ii) the precedence order for processing classes in case of scheduling conflicts. By modeling the system as a Markov chain, we formulate constrained optimization problems for two cases: (i) equal treatment of all job classes and (ii) priority-based scheduling, the latter introducing a combinatorial challenge. We propose algorithms to determine optimal wait-time distributions in both cases and demonstrate through numerical experiments that precedence-order optimization significantly improves performance, especially when delay constraints are not overly strict.

Traditional data center architectures, such as Clos-based topologies, can sometimes encounter challenges with scalability and latency. The Direct Interconnect Data Center (DIDC) architecture offers a solution to these issues by enabling direct, low-latency MEMS-based optical connections between servers. This architecture is gaining popularity among web scalers, particularly in data centers that handle low-latency workloads. We introduce a novel machine learning-based algorithm, JIRO, for optimal traffic management in DIDC, considering the unique constraints of this architecture. During the development of this algorithm, we created new techniques for handling integer constraints within the Pytorch gradient descent framework, which can also be applied to other combinatorial optimization problems. Through extensive experiments and comparisons to lower bounds, we demonstrate that JIRO offers performance guarantees for multiple traffic patterns without significant over-provisioning.

The convergence of Software-Defined Networking (SDN) and Network Function Virtualization (NFV) has transformed wide area network operations. A critical challenge in these networks is the strategic deployment of Virtual Network Functions (VNFs) to optimize performance, resource utilization, and cost, amidst varying and unpredictable traffic patterns. Traditional methods often assume a single, static traffic pattern, but this approach is impractical due to the dynamic nature of network traffic. This paper presents a robust machine learningbased approach (PLANAR) for VNF placement and routing that accommodates multiple traffic patterns, providing worst-case performance guarantees. Our gradient descent-based stochastic optimization algorithm efficiently scales to handle hundreds of traffic patterns, significantly enhancing network resilience and resource management. The technique is effective and scalable and works well on a wide variety of network topologies.

With the growing adoption of network function virtualization, telco core network elements and network functions will increasingly be designed and deployed as cloud-native application instances. To ensure the efficient use of virtualised resources and meet diverse requirements for quality of services a resource scaling algorithm is used to scale the number of application instances up or down depending on variations in offered traffic from customers. Most of the observed performance metrics for a service are a function of the current customer traffic and the current number of application instances providing the service. The ubiquitous use of Kubernetes, the popular open-source framework for deployment and management of cloud-native functions, has resulted in variants of the Kubernetes Horizontal Pod Autoscaling (HPA) algorithm being widely used to change the number of application instances providing network functions as traffic demands vary. This change is done by determining whether a selected performance metric of interest is outside a range set by two input parameters (the desired metric value and the tolerance parameter). In this paper, we investigate the characteristics of the HPA algorithms and prove that there are only a finite number of intervals for its tolerance parameter. Further any choice of the tolerance parameter from each interval leads to similar computational decisions on the recommended number of application instances. As a consequence, the number of parameter setting choices is finite due to the rule that the desired metric value can only be an integer in specific ranges. Additionally, we investigate the use of HPA for scaling application instances that provide session-based services and establish lower and the upper bounds for the performance of the HPA scaling algorithms in this scenario. Our contributions can help operators find appropriate parameter settings efficiently - administrators of Kubernetes clusters only need to select parameters from a limited and finite number of choices (instead of infinite) for scaling cloud-native applications.

This paper presents a novel approach to telemetry-based routing, aiming to minimize network congestion using multiple link load measurements collected at different points in time at a centralized management system. The objective is to determine a fixed routing policy that optimizes network performance by minimizing the maximum link utilization for any traffic matrix that could have generated any link load measurement. The key idea is to develop a routing mechanism that has the flexibility to handle a wide variety of traffic conditions without reconfiguration. We use a routing mechanism called deflection routing and develop a machine learning based gradient algorithm (LASER) to compute the deflection routing parameters. We use a combination of variable transformation and Lagrangian based techniques to transform the parameter optimization problem into an unconstrained loss minimization problem which is solved using a structured neural network in the PyTorch framework.

Oblivious routing of network traffic uses predetermined paths that do not change with changing traffic patterns. It has the benefit of using a fixed network configuration while robustly handling a range of varying and unpredictable traffic. Theoretical advances have shown that the benefits of oblivious routing are achievable without compromising much capacity efficiency. For oblivious routing, we only assume knowledge of the ingress/egress capacities of the edge nodes through which traffic enters or leaves the network. All traffic patterns possible subject to the ingress/egress capacity constraints (also known as the hose constraints) are permissible and are to be handled using oblivious routing. We use the widely deployed segment routing method for route control. Furthermore, for ease of deployment and to not deviate too much from conventional shortest path routing, we restrict paths to be 2-segment paths (the composition of two shortest path routed segments). We solve the 2-segment oblivious routing problem for all permissible traffic matrices (which can be infinitely-many). We develop a new adversarial and machine-learning driven approach that uses an iterative gradient descent method to solve the routing problem with worst-case performance guarantees. Additionally, the parallelism involved in descent methods allows this method to scale well with the network size making it amenable for use in practice.

In the new industrial Internet, a wide variety of industrial applications are expected to rely on high-performance data communication between a multitude of sensors and actuators that are deployed on a large scale. Publish-subscribe-based communication model is well-suited to handle such large-scale data gathering and dissemination among data sources and sinks. To support publish-subscribe-based data delivery, the newly standardized Segmented Routing over IPv6 (SRv6) can provide non-disruptive network programming primitives for building and maintaining network-efficient, shareable data distribution trees within the network. We study optimal algorithms for setting up different types of multicasting in the SRv6-capable network. In particular, we show, both theoretically and experimentally, that splitting multicast streams into multiple sub-streams, as well as using end-to-end application-layer coding without any network participation can provide significant benefits in terms of multicast throughput compared to traditional single stream multicasting.

It is commonly assumed that the end-to-end networking performance of edge offloading is purely dictated by that of the network connectivity between end devices and edge computing facilities, where ongoing innovation in 5G/6G networking can help. However, with the growing complexity of edge-offloaded computation and dynamic load balancing requirements, an offloaded task often goes through a multi-stage pipeline that spans across multiple compute nodes and proxies interconnected via a dedicated network fabric within a given edge computing facility. As the latest hardware-accelerated transport technologies such as RDMA and GPUDirect RDMA are adopted to build such network fabric, there is a need for good understanding of the full potential of these technologies in the context of computation offload and the effect of different factors such as GPU scheduling and characteristics of computation on the net performance gain achievable by these technologies. This paper unveils detailed insights into the latency overhead in typical machine learning (ML)-based computation pipelines and analyzes the potential benefits of adopting hardware-accelerated communication. To this end, we build a model-serving framework that supports various communication mechanisms. Using the framework, we identify performance bottlenecks in state-of-the-art model-serving pipelines and show how hardware-accelerated communication can alleviate them. For example, we show that GPUDirect RDMA can save 15-50% of model-serving latency, which amounts to 70–160 ms.

Modern data centers are witnessing fast-growing east-west traffic on their network infrastructure due to the highly distributed data center applications. Motivated by the heterogeneity of such application workloads, we propose in this article an extensible network management architecture calledMAGNetwhich enables application-aware intra-data center networking. The crux ofMAGNetis the smart endpoint residing within end-hosts, which is empowered by machine learning combined with lightweight workload tracing to detect workload identities and enable workload-dependent packet tagging. The centralized management plane interface ofMAGNetallows network functions to interpret packet tags and perform application-aware packet processing. We demonstrate the feasibility of the architecture via prototype implementation and extensive use case evaluation. Our experiments show that the smart endpoint can fingerprint many real-world applications with 99 percent accuracy only at 1–2 percent additional CPU, and that application-aware data plane can potentially bring substantial benefits in terms of security (e.g., via identity-based microsegmentation), CPU usage (e.g., for intrusion detection) and network latency (e.g., via TCP stack customization).

Multiplexing resources is the core savings principle upon which the economic model of the Cloud is built. Cloud customers can flexibly purchase additional resources when needed, and trim these down when the need has past, while Cloud providers can direct resources when and where customers might require. One aspect which poses a challenge to this capability is the allocation process itself, which can be costly in terms of time and energy. Indeed, both provider and customer would prefer if resource allocation would be continuous, fast and with low energy overhead. Since this is not the case, there is an inherent tension between limiting the number of allocation events and efficient resource utilization.This paper considers this tension using several different models, and proposes a history-based dynamic allocation scheme that minimizes the number of resource allocation transition points for both average and adversarial use cases. We prove performance bounds and use extensive simulation to study the performance of our scheme.

Internet routing protocols like OSPF and ISIS use shortest path routing to route traffic from ingress nodes to egress nodes in a network. These shortest paths are computed with respect to the weights assigned to links in the underlying network. Since the routed paths depend on the assigned link weights, a fundamental problem in optimizing network routing is the determination of the set of weights that minimizes congestion in the network. This is an NP-hard combinatorial optimization problem. Consequently, several heuristics have been developed to determine the set of link weights to minimize congestion. In this paper, we develop a machine-learning based approach by formulating a smoothed version of the weight setting problem and using gradient descent in the PyTorch framework to derive approximate solutions to this problem. We demonstrate the improvement in performance compared to traditional approaches using several benchmark network topologies.

With the increasing success of machine learning based approaches for prediction problems, there has been recent effort in improving the performance of online algorithms by augmenting them with machine learning predictions. Since machine learning predictions typically do not offer any performance guarantees, the new approach has to take into consideration the possibility that the machine learning prediction can be inaccurate. The idea is to develop approaches that give good results when the prediction is accurate (consistency) while ensuring that the performance is still acceptable in the worst case, when the prediction is not accurate (robustness). Segment routing is now being widely deployed and used for traffic engineering in IP networks. The key idea in segment routing is to break up the routing path into segments to better control routing paths and improve network utilization. We consider the problem of designing the segments in a network to minimize congestion. This is typically done for a predicted traffic matrix. We use the ideas of consistency and robustness to design a parametrized algorithm that gives good performance when the actual traffic matrix is exactly the predicted traffic matrix (consistency) while giving good performance in the worst case if the actual traffic matrix deviates significantly from the predicted traffic matrix (robustness).

Motivated by important industrial automation use cases, such as closed loop motion control and autonomous mobile robots, we study wait-free scheduling of periodic flows with stringent delay and jitter requirements in time sensitive networks. The goal is to assign initial transmission time-slots to periodic flows so that network queuing delays are eliminated or are very small. We make use of Bézour's Identity to develop simple and fast scheduling algorithms for this NP-hard problem. Operating in an online mode, our algorithms can quickly allocate contention free start time-slots to new flows, without changing allocations of already scheduled flows. Our main results are greedy and random scheduling algorithms that can trade speed for solution quality. Our simulations on different network topologies show that these algorithms are computationally efficient and can easily schedule a large number of flows, thus meeting the requirements of many industrial automation use cases.

Dynamic resource allocation to satisfy varying, concurrent and unpredictable demands from multiple applications is a key need in cloud systems. A fundamental challenge is the need to find the right balance between over-allocation, which satisfies each application’s varying needs without requiring frequent allocation changes, and system efficiency which requires that the allocation exactly matches the application needs. However, allocating resources close to current needs will result in frequent allocation changes. This can be detrimental to applications since there may be fixed costs (state replication, policy reconfiguration, etc.) that need to be incurred by applications for each allocation change. In this paper, we develop an MDP-based dynamic allocation scheme that uses reinforcement learning to satisfy unpredictable application demands. It minimizes the overall resource allocation needed to satisfy varying application demands while meeting application constraints on the rate of allocation changes. We prove convergence bounds and use real-world traces to study the performance.

In this paper, we propose a general framework for combining deep neural networks (DNNs) with dynamic programming to solve combinatorial optimization problems. For problems that can be broken into smaller subproblems and solved by dynamic programming, we train a set of neural networks to replace value or policy functions at each decision step. Two variants of the neural network approximated dynamic programming (NDP) methods are proposed; in the value-based NDP method, the networks learn to estimate the value of each choice at the corresponding step, while in the policy-based NDP method the DNNs only estimate the best decision at each step. The training procedure of the NDP starts from the smallest problem size and a new DNN for the next size is trained to cooperate with previous DNNs. After all the DNNs are trained, the networks are fine-tuned together to further improve overall performance. We test NDP on the linear sum assignment problem, the traveling salesman problem and the talent scheduling problem. Experimental results show that NDP can achieve considerable computation time reduction on hard problems with reasonable performance loss. In general, NDP can be applied to reducible combinatorial optimization problems for the purpose of computation time reduction.

Mobile Augmented Reality (MAR) is going to play an important role in industrial automation. In order to tag a physical object in the MAR world, a smart phone running MAR-based applications must know the precise location of an object in the real world. Tracking and localizing a large number of objects in an industrial environment can become a huge burden for the smart phone due to compute and battery requirements. In this paper we propose GLAMAR, a novel framework that leverages externally provided geo-location of the objects and IMU sensor information (both of which can be noisy) from the objects to 10-cate them precisely in the MAR world. GLAMAR offloads heavy-duty computation to the edge and supports building MAR-based applications using commercial development packages. We develop a regenerative particle filter and a continuously improving transformation matrix computation methodology to dramatically improve the positional accuracy of objects in the real and the AR world. Our prototype implementation on Android platform using ARCore shows the practicality of GLAMAR in developing MAR-based applications with high precision, efficiency, and more realistic experience. GLAMAR is able to achieve less then 10cm error compared to the ground truth for both stationary and moving objects and reduces the CPU overhead by 83% and battery consumption by 80% for mobile devices.

Application aware data centers promise various benefits for data center management, in terms of resource provisioning, power estimation, network management, security protection, etc. However, the emerging microservices make it challenging for data center operators to accurately identify what applications are deployed by tenants, due to their highly dynamic and heterogeneous nature. In this paper, we address the problem of fingerprinting microservices in a unified, efficient, accurate and non-intrusive fashion. To this end, we characterize the runtime behaviors of microservices using eBPF-based lightweight system call tracing. To accurately fingerprint a diverse set of microservices based on their system call activities, we utilize the machine learning approach which combines Bayesian learning and LSTM autoencoders. We demonstrate that our approach can fingerprint many real-world microservices with 99% accuracy, using 1-2% additional CPU resource, and can detect the presence of previously unseen microservices with near perfect accuracy.

The Bitcoin blockchain is a secure, distributed ledger that enables trusted transactions across untrusted entities. However, many applications need much faster transaction confirmation than that of the current Bitcoin blockchain. In this paper, we present a high-throughput, low-latency, deterministic confirmation mechanism called ACCEL for accelerating Bitcoin's block confirmation mechanism. Our key idea for achieving faster confirmation is the quick identification of singular blocks that provably belong to the blockchain. While it is impossible to determine with certainty if a block belongs to a blockchain when network delays are unbounded, singular block detection exploits the fact that the end-to-end latency between Bitcoin miners is substantially lower than the inter-block spacing and can be assumed to be upper bounded. ACCEL is especially suitable for low-latency, permissioned blockchains, where the block spacing can be optimized to the blockchain's small latencies to greatly improve throughput. We evaluate ACCEL's performance with extensive simulations and with a real implementation built with minimal changes to and fully compatible with the Bitcoin blockchain. We show that with appropriate bounds on the end-to-end latency, it is possible to reduce transaction confirmation latencies to milliseconds with ACCEL, and so meet the performance needs of a wide range of applications.

This paper proposes Muppet, an edge-based multi-protocol architecture for large-scale Internet of Things (IoT) deployment and service automation. The crux of Muppet is a P4-based switch that inserts itself in between communicating IoT devices that can use different protocols. The switches are networked over IP to support wide area deployment and managed using centralized SDN control for scalability. Muppet provides many of the benefits of both native peer-to-peer and widely used cloud-centric approaches while avoiding their drawbacks. For example, Muppet offers low-latency and low-energy benefits of the peer-to-peer approach, while enabling wide-area, cross-protocol automation similar to the cloud-based solutions. We describe the P4 design and prototype realization of the switch using two very popular, but widely disparate, IoT protocols, namely, Bluetooth low energy and Zigbee. Through experiments, we show that Muppet is as efficient as peer-to-peer in terms of delay and energy usage, and scalable and programmable as cloud-based solutions. We illustrate its utility through practical use cases.

Increasingly, smart Network Interface Cards (sNICs) are being used in data centers to offload networking functions (NFs) from host processors thereby making these processors available for tenant applications. Modern sNICs have fully programmable, energy-efficient multi-core processors on which many packet processing functions, including a full-blown programmable switch, can run. However, having multiple switch instances deployed across the host hypervisor and the attached sNICs makes controlling them difficult and data plane operations more complex.

Stream processing pipelines operated by current big data streaming frameworks present two problems. First, the pipelines are not flexible, controllable, and programmable enough to accommodate dynamic streaming application needs. Second, the application-level data routing over the pipelines do not exhibit optimal performance for increasingly common one-to-many communication. To address these problems, we propose an SDN-based real-time big data streaming framework called Typhoon, that tightly integrates SDN functionality into a real-time stream framework. By partially offloading application-layer data routing and control to the network layer via SDN interfaces and protocols, Typhoon provides on-the-fly programmability of both the application and network layers, and achieve high-performance data routing. In addition, Typhoon SDN controller exposes cross-layer information, from both the application and the network, to SDN control plane applications to extend the framework's functionality. We introduce several SDN control plane applications to illustrate these benefits.

Bluetooth Low Energy (BLE) is a personal area wireless network technology that is of increasing importance for emerging Internet of Things (IoT) deployments. By design, BLE supports short-range, single-hop communication between a pair of BLE devices. As such, native BLE does not allow network-based policy control or in-network functions for service enhancement. These limitations are impediments to any large-scale BLE based IoT deployment (e.g., in hospital environments), where such sophisticated network-based visibility and control may be required. Relying on cloud-based solutions to meet these requirements has many known shortcomings. This paper proposes an SDN-based architecture for enabling wide area IoT deployments using BLE devices at the edge. We introduce a programmable BLE service switch (BLESS) that is transparently inserted between two communicating BLE devices. BLESS can be programmed at the service layer by a central controller to enable flexible, policy-based switching, as well as various in-network operations in BLE networks. We describe the design of BLESS, its implementation using P4 and OVS, and illustrate its utility through practical use cases.

While being critical to the network management, the current state of the art in network measurement is inadequate, providing surprisingly little visibility into detailed network behaviors and often requiring high level of manual intervention to operate. Such a practice becomes increasingly ineffective as the networks grow both in size and complexity. In this paper, we propose vPROM, a vSwitch enhanced SDN programmable measurement framework that automates the measurement process, minimizes the measurement resource usage, and addresses several significant technical challenges faced by early works. vPROM leverages the SDN programmability and extends the Pyretic runtime system and OpenFlow network interface to achieve the measurement automation. The required measurement resources are minimized by only acquiring the necessary statistics, made possible with instrumented Open vSwitches1with user defined monitoring capability. By decoupling monitoring from routing, vPROM reduces the interference between the measurement applications and other applications, and eliminates the frequent involvement of the controller. A vPROM prototype is implemented with DDoS and port-scan detection applications. The performance of vPROM is evaluated and the comparison results with other existing programmable measurement approaches are also presented.

Software Defined Networking (SDN) can benefit a Network Function Virtualization solution by chaining a set of network functions (NF) to create a network service. Currently, control on NFs is isolated from the SDN, which creates routing inflexibility, flow imbalance and choke points in the network as the controller remains oblivious to the number, capacity and placement of NFs. Moreover, a NF may modify packets in the middle, which makes flow identification at a SDN switch challenging. In this paper, we postulate native NFs within the SDN data plane, where the same logical controller controls both network services and routing. This is enabled by extending SDN to support stateful flow handling based on higher layers in the packet beyond layers 2-4. As a result, NF instances can be chained on demand, directly on the data plane. We present an implementation of this architecture based on Open vSwitch, and show that it enables popular NFs effectively using detailed evaluation and comparison with other alternative solutions.

It is well established that physical layer impairments significantly affect the performance of optical networks. The management of these impairments is critical for successful transmission, and may significantly affect network layer routing decisions. Hence, the traditional divide-and-conquer layered approach is sub-optimal, which has led to work on cross-layer techniques for routing in optical networks. Apart from fiber loss, one critical physical layer impairment that limits the capacity of optical networks is fiber nonlinearity. Handling nonlinearity introduces significant complexity to the traditional cross-layer approaches. We formulate and solve a joint routing and power control problem to optimize the system throughput that takes into consideration both fiber loss and nonlinearity. The joint power control and routing problem considered is a nonlinear integer programming problem. By characterizing the feasible solution space of the power control problem, we find a set of universal power settings that transform the complex power control and routing problem into a constrained path routing problem. We then propose an efficient fully polynomial time approximation scheme to solve the constrained path routing problem. Simulation results show that our proposed algorithm significantly improves network throughput and greatly outperforms greedy heuristics by providing a guaranteed performance bound.

In the past decade, mobile devices and applications have experienced an explosive growth, and users are expecting higher data rates and better quality services every year. In this paper, we propose several ideas to increase the functionality and capacity of wireless networks using software-defined networking (SDN) and cloud computing technologies. Connections between users and services in mobile networks typically have to pass through a required set of middleboxes. The complex routing is one of the major impetus for the SDN paradigm, which enables flexible policy-aware routing in the next generation mobile networks. In addition, the high costs of middleboxes and limited capabilities of mobile devices call for revolutionary virtualization technologies enabled by cloud computing. Based on these, we consider an online routing problem for mobile networks with SDN and cloud computing. In this problem, connection requests are given one at a time (as in a real mobile system), and the objective is to steer traffic flows to maximize the total amount of traffic accepted over time, subject to capacity, budget, policy, and quality of service constraints. A fast log-competitive approximation algorithm is developed based on time-dependent duals.

One of the primary functions of a cloud service provider is to allocate cloud resources to users upon request. Requests arrive in real-time and resource placement decisions must be made as and when a request arrives, without any prior knowledge of future arrivals. In addition, when a cloud service provider operates a geographically diversified cloud that consists of a large number of small data centers, the resource allocation problem becomes even more complex. This is due to the fact that resource request can have additional constraints on data center location, service delay guarantee, and so on, which is especially true for the emerging network function virtualization application. In this paper, we propose a generalized resource placement methodology that can work across different cloud architectures, resource request constraints, with real-time request arrivals and departures. The proposed algorithms are online in the sense that allocations are made without any knowledge of resource requests that arrive in the future, and the current resource allocations are made in such a manner as to permit the acceptance of as many future arrivals as possible. We derive worst case competitive ratio for the algorithms. We show through experiments and case studies the superior performance of the algorithms in practice.

Existing security mechanisms for managing the Internet infrastructural resources like IP addresses, AS numbers, BGP advertisements and DNS mappings rely on a Public Key Infrastructure (PKI) that can be potentially compromised by state actors and Advanced Persistent Threats (APTs). Ideally the Internet infrastructure needs a distributed and tamper-resistant resource management framework which cannot be subverted by any single entity. A secure, distributed ledger enables such a mechanism and the blockchain is the best known example of distributed ledgers.

Segment routing is a new proposed routing mechanism for simplified and flexible path control in IP/MPLS networks. It builds on existing network routing and connection management protocols and one of its important features is the automatic rerouting of connections upon failure. Re-routing can be done with available restoration mechanisms including IGP-based rerouting and fast reroute with loop-free alternates. This is particularly attractive for use in Software Defined Networks (SDN) because the central controller need only be involved at connection set-up time and failures are handled automatically in a distributed manner. A significant challenge in restoration optimization in segment routed networks is the centralized determination of connections primary paths so as to enable the best sharing of restoration bandwidth over non-simultaneous network failures. We formulate this problem as a linear programming problem and develop an efficient primal-dual algorithm for the solution. We also develop a simple randomized rounding scheme for cases when there are additional constraints on segment routing. We demonstrate the significant capacity benefits achievable from this optimized restoration with segment routing.

Multipath TCP (MPTCP) is a promising technique for boosting application throughput while using well-known and versatile network socket interfaces. Recently, many interesting applications of MPTCP in various environments such as wireless networks and data centers have been proposed, but little work has been done to investigate the impact of this protocol on conventional network devices. For example, MPTCP throughput advantage can be better achieved if all MPTCP subflows are routed on disjoint paths, but this is currently not feasible since routers are not designed to recognize the membership of MPTCP subflows. In this paper, we take a first step to address this issue by proposing SAMPO, an online algorithm to detect and associate MPTCP subflows in network. The main challenge is that sampling techniques and network dynamics may cause a network device to only obtain partial flow records. SAMPO takes advantage of both protocol information and statistical characteristics of MPTCP data sequence number to overcome the challenge in network. Through analysis and experimentation, we show that SAMPO is able to detect and associate MPTCP subflows with high accuracy even when a small portion of the entire flow records are available.

The advent and continued growth of large data centers has led to much interest in switch architectures that can economically meet the high capacities needed for interconnecting the thousands of servers in these data centers. Various multilayer architectures employing thousands of switches have been proposed in the literature. We make use of the observation that the traffic in a data center is a mixture of relatively static and rapidly fluctuating components, and develop a combined scheduler for both these components using a generalization of the load-balanced scheduler. The presence of the known static component introduces asymmetries in the ingress-egress capacities, which preclude the use of a load-balanced scheduler as is. We generalize the load-balanced scheduler and also incorporate an opportunistic scheduler that sends traffic on a direct path when feasible to enhance the overall switch throughput. Our evaluations show that this scheduler works very well despite avoiding the use of a central scheduler for making packet-by-packet scheduling decisions.

The rapid growth of server virtualization has ignited a wide adoption of software-based virtual switches, with significant interest in speeding up their performance. In a similar trend, software-defined networking (SDN), with its strong reliance on rule-based flow classification, has also created renewed interest in multi-dimensional packet classification. However, despite these recent advances, the performance of current software-based packet classifiers is still limited, mostly by the low parallelism of general-purpose CPUs. In this paper, we explore how to accelerate packet classification using the high parallelism and latency-hiding capabilities of graphic processing units (GPUs). We implement GPU-accelerated versions for both linear and tuple search, currently deployed in virtual switches, and also introduce a novel algorithm called Bloom search. These algorithms are integrated with high-speed packet I/O to build GSwitch, a GPU-accelerated software switch, and also to extend Open vSwitch. Our experimental evaluation indicates that, under realistic rule sets, GSwitch is at least 7 × faster than an equally-priced CPU classifier. We also show that our GPU-accelerated Open vSwitch outperforms the classic Open vSwitch implementation by a factor of 10, on average.

The advent of virtualization, containerization and the Internet of Things (IoT) is leading to an explosive growth in the number of endpoints. Ideally with Software Defined Networking (SDN), one would like to customize packet handling for each of these endpoints or applications. However this typically leads to a large growth in forwarding state. This growth is avoided in current networks by using aggregation which trades off fine-grained control of micro-flows for reduced forwarding state. It is worthwhile to ask whether the benefits of micro-flow control can be retained without a large growth in forwarding state and without using aggregation. In this paper we describe an incrementally deployable SDN-friendly packet forwarding mechanism called Path Switching that achieves this by compactly encoding a packet's path through the network in the packet's existing address fields. Path Switching provides the same reduction in forwarding state as source routing while retaining the benefits and use of fixed size packet headers and existing protocols.

We study how to provide fine-grained, flexible traffic monitoring in the Open vSwitch (OVS). We argue that the existing OVS monitoring tools are neither flexible nor sufficient for supporting many monitoring applications. We propose UMON, a mechanism that decouples monitoring from forwarding, and offers flexible and fine-grained traffic stats. We describe a prototype implementation of UMON that integrates well with the OVS architecture. Finally, we evaluate the performance using the prototype, and illustrate UMON's efficiency with the example use cases such as detecting port scans.

Segment Routing is a proposed IETF protocol to improve traffic engineering and online route selection in IP networks. The key idea in segment routing is to break up the routing path into segments in order to enable better network utilization. Segment routing also enables finer control of the routing paths and can be used to route traffic through middle boxes. This paper considers the problem of determining the optimal parameters for segment routing in the offline and online cases. We develop a traffic matrix oblivious algorithm for robust segment routing in the offline case and a competitive algorithm for online segment routing. We also show that both these algorithms work well in practice.

It is well established that physical layer impairments significantly affect the performance of optical networks. The management of these impairments is critical for successful transmission, and may significantly affect network layer routing decisions. Hence the traditional divide-and-conquer layered approach is sub-optimal, which has led to work on cross-layer techniques for routing in optical networks. Apart from fiber loss, one critical physical layer impairment that limits the capacity of optical networks is fiber nonlinearity. Handling nonlinearity introduces significant complexity to the traditional cross-layer approaches. We formulate and solve a joint routing and power control problem to optimize the system throughput that takes into consideration both fiber loss and nonlinearity. The joint power control and routing problem considered is a nonlinear integer programming problem. By characterizing the feasible solution space of the power control problem we find a set of universal power settings that transforms the complex power control and routing problem into a constrained path routing problem. We then propose an efficient Fully Polynomial Time Approximation Scheme (FPTAS) to solve the constrained path routing problem. Simulation results show that our proposed algorithm significantly improves network throughput and greatly outperforms greedy heuristics by providing a guaranteed performance bound.

Software Defined Networking (SDN) has become a popular paradigm for centralized control in many modern networking scenarios such as data centers and cloud. For large data centers hosting many hundreds of thousands of servers, there are few thousands of switches that need to be managed in a centralized fashion, which cannot be done using a single controller node. Previous works have proposed distributed controller architectures to address scalability issues. A key limitation of these works, however, is that the mapping between a switch and a controller is statically configured, which may result in uneven load distribution among the controllers as traffic conditions change dynamically. To address this problem, we propose ElastiCon, an elastic distributed controller architecture in which the controller pool is dynamically grown or shrunk according to traffic conditions. To address the load imbalance caused due to spatial and temporal variations in the traffic conditions, ElastiCon automatically balances the load across controllers thus ensuring good performance at all times irrespective of the traffic dynamics. We propose a novel switch migration protocol for enabling such load shifting, which conforms with the Openflow standard. We further design the algorithms for controller load balancing and elasticity. We also build a prototype of ElastiCon and evaluate it extensively to demonstrate the efficacy of our design.

The rapid growth of server virtualization has ignited a wide adoption of software-based virtual switches, with significant interest in speeding up their performance. In a similar trend, software-defined networking (SDN), with its strong reliance on rule-based flow classification, has also created renewed interest in multi-dimensional packet classification. However, despite these recent advances, the performance of current software-based packet classifiers is still limited, mostly by the low parallelism of general-purpose CPUs. In this paper, we explore how to accelerate packet classification using the high parallelism and latency-hiding capabilities of graphic processing units (GPUs). We implement GPU-accelerated versions for both linear and tuple search, currently deployed in virtual switches, and also introduce a novel algorithm called Bloom search. These algorithms are integrated with high-speed packet I/O to build GSwitch, a GPU-accelerated software switch. Our experimental evaluation shows that GSwitch is at least 7x faster than an equally-priced CPU classifier and is able to reach 10 Gbps with minimum-sized packets and a rule set containing 128K OpenFlow entries with 512 different wildcard patterns.

Software Defined Networks use logically centralized control due to its benefits in maintaining a global network view and in simplifying programmability. However, the use of centralized controllers can affect network performance if the control path between the switches and their associated controllers becomes a bottleneck. We find from measurements that the software control agents on some of the switches have very limited throughput. This can cause performance degradation if the switch has to handle a high traffic load, as for instance due to flash crowds or DDoS attacks. This degradation can occur even when the data plane capacity is under-utilized. The goal of our paper is to design new mechanisms to enable the network to scale up its ability to handle high control traffic loads. For this purpose, we design, implement, and experimentally evaluate Scotch, a solution that elastically scales up the control plane capacity by using a vSwitch based overlay. Scotch takes advantage of both the high control plane capacity of a large number of vSwitches and the high data plane capacity of commodity physical switches to increase the SDN network scalability and resiliency under normal (e.g., flash crowds) or abnormal (e.g., DDoS attacks) traffic surge.

The rapid growth in multimedia traffic is straining mobile networks thus necessitating the need for efficient content delivery mechanisms. In this paper we present the design and analysis of a scheme for streaming non-live, pre-recorded content (e.g. Video on Demand) that opportunistically takes advantage of the “slow fading” variations in the wireless link quality. The proposed scheme works by selectively sending more content to sessions at times when they have better link quality while providing sufficient rate guarantees to keep their buffers from under-flowing. We establish analytically that the performance of such scheme is within two times that of any optimal scheme and that it results in throughput gains, per user and aggregate, that increase in proportion to the number of streaming users. Our performance evaluations indicate that by exploiting slow time-varying channels the streaming capacity can more than double with significant benefits to the users at the edge of the cell.

The advent and continued growth of large data centers has led to much interest in switch architectures that can economically meet the high capacities needed for interconnecting the thousands of servers in these data centers. Various multilayer architectures employing thousands of switches have been proposed in the literature. We make use of the observation that the traffic in a data center is a mixture of relatively static and rapidly fluctuating components, and develop a combined scheduler for both these components using a generalization of the load-balanced scheduler. The presence of the known static component introduces asymmetries in the ingress-egress capacities, which preclude the use of a load-balanced scheduler as is. We generalize the load-balanced scheduler and also incorporate an opportunistic scheduler which sends traffic on a direct path when feasible to enhance the overall switch throughput. Our evaluations show that this scheduler works very well despite avoiding the use of a central scheduler for making packet-by-packet scheduling decisions.

One of the primary functions of a cloud service provider is to allocate cloud resources to users upon request. Requests arrive in real-time and resource placement decisions must be made as and when a request arrives, without any prior knowledge of future arrivals. In addition, when a cloud service provider operates a geographically diversified cloud that consists of large number of small data centers, the resource allocation problem becomes even more complex. This is due to the fact that resource request can have additional constraints on data center location, service delay guarantee, etc. In this paper, we propose a generalized resource placement methodology that can work across different cloud architectures, resource request constraints, with real-time request arrivals and departures. The proposed algorithms are online in the sense that allocations are made without any knowledge of resource requests that arrive in the future, and the current resource allocations are made in such a manner as to permit the acceptance of as many future arrivals as possible. We derive worst case competitive ratio for the algorithms. We show through experiments and case studies the superior performance of the algorithms in practice.

In a vision-based 3D indoor localization system, conducting localization of user's device at a high frame rate is important to support real-time augment reality applications. However, vision-based 3D localization typically involves 2D keypoint detection and 2D-3D matching processes, which are in general too computationally intensive to be carried out at a high frame rate (e.g., 30 fps) on commodity hardware such as laptops or smartphones. In order to reduce per-frame computation time for 3D localization, we present a new method that distributes required computation over space and time, by splitting a video frame region into multiple sub-blocks, and processing only a sub-block in a rotating sequence at each video frame. The proposed method is general enough that it can be applied to any keypoint detection and 2D-3D matching schemes. We apply the method in a prototype 3D indoor localization system, and evaluate its performance in a 120m long indoor hallway environment using 5,200 video frames of 640x480 (VGA) resolution and a commodity laptop. When SIFT-based keypoint detection is used, our method reduces average and maximum computation time per frame by a factor of 10 and 7 respectively, with a marginal increase of positioning error (e.g., 0.17 m). This improvement enables the frame processing rate to increase from 3.2 fps to 23.3 fps.

Software Defined Networking is a new networking paradigm that separates the network control plane from the packet forwarding plane and provides applications with an abstracted centralized view of the distributed network state. A logically centralized controller that has a global network view is responsible for all the control decisions and it communicates with the network-wide distributed forwarding elements via standardized interfaces. Google recently announced [5] that it is using a Software Defined Network (SDN) to interconnect its data centers due to the ease, efficiency and flexibility in performing traffic engineering functions. It expects the SDN architecture to result in better network capacity utilization and improved delay and loss performance. The contribution of this paper is on the effective use of SDNs for traffic engineering especially when SDNs are incrementally introduced into an existing network. In particular, we show how to leverage the centralized controller to get significant improvements in network utilization as well as to reduce packet losses and delays. We show that these improvements are possible even in cases where there is only a partial deployment of SDN capability in a network. We formulate the SDN controller's optimization problem for traffic engineering with partial deployment and develop fast Fully Polynomial Time Approximation Schemes (FPTAS) for solving these problems. We show, by both analysis and ns-2 simulations, the performance gains that are achievable using these algorithms even with an incrementally deployed SDN.

Many cloud applications are data intensive requiring the processing of large data sets and the MapReduce/Hadoop architecture has become the de facto processing framework for these applications. Large data sets are stored in data nodes in the cloud which are typically SAN or NAS devices. Cloud applications process these data sets using a large number of application virtual machines (VMs), with the total completion time being an important performance metric. There are many factors that affect the total completion time of the processing task such as the load on the individual servers, the task scheduling mechanism, communication and data access bottlenecks, etc. One dominating factor that affects completion times for data intensive applications is the access latencies from processing nodes to data nodes. Ideally, one would like to keep all data access local to minimize access latency but this is often not possible due to the size of the data sets, capacity constraints in processing nodes which constrain VMs from being placed in their ideal location and so on. When it is not possible to keep all data access local, one would like to optimize the placement of VMs so that the impact of data access latencies on completion times is minimized. We address this problem of optimized VM placement - given the location of the data sets, we need to determine the locations for placing the VMs so as to minimize data access latencies while satisfying system constraints. We present optimal algorithms for determining the VM locations satisfying various constraints and with objectives that capture natural tradeoffs between minimizing latencies and incurring bandwidth costs. We also consider the problem of incorporating inter-VM latency constraints. In this case, the associated location problem is NP-hard with no effective approximation within a factor of 2 - ϵ for any ϵ > 0. We discuss an effective heuristic for this case and evaluate by simulation the impact of the various tradeoffs in the optimization objectives.

Preventing flow of confidential data out of a network is a fundamental problem faced by network operators. This problem gets even more complex in the context of Cloud Computing, where multiple distrusting customers share the same underlying infrastructure, and data is often replicated and moved across regions. Despite the significance of this problem, existing solutions are based on generic search for keywords in outgoing data, and hence severely lack the ability to control data flow at a fine granularity with low false positives. In this paper, we advocate a fine-grained approach to prevent confidential data from leaking out of the cloud. We propose a solution using document-level fingerprint checks. We show via analysis and experiments that our algorithm for checking the fingerprints on-the-fly scale to a large amount of documents at very low cost. For example, for one TB of documents, our solution only requires 340 MB memory to achieve worst case expected detection lag (i.e. leakage length) of 1000 bytes.

The Software Defined Network (SDN) model depends on abstractions to separate the control plane from the packet forwarding plane. Applications can interact with the control plane to receive a global network view, upon which they can operate. By having access to network topology information, applications can optimize decisions related to service rendezvous, service fulfillment, service placement and service removal. The network is in the best position to provide guidance to a broad class of applications, including peer-to-peer systems, Content Distribution Network (CDN), and datacenter applications. In all these use cases proximity matters as peers need to rendezvous with other peers and users need to rendezvous with the best cloud application or best CDN server. We maintain that a solution for such a rendezvous problem should be an intrinsic component of the emerging SDN model. A specific instance of a protocol that abstracts network topology is the Application Layer Traffic Optimization (ALTO) protocol. ALTO provides applications an abstract view of the network and thus enables applications to leverage a network without exposing the network provider's internal details or policies. We argue that ALTO provides a clean, mature, standards-based and powerful abstraction, which can be used by SDNs today to obtain network information for solving the rendezvous problem.

We consider resource allocation algorithms for distributed cloud systems, which deploy cloud-computing resources that are geographically distributed over a large number of locations in a wide-area network. This distribution of cloud-computing resources over many locations in the network may be done for several reasons, such as to locate resources closer to users, to reduce bandwidth costs, to increase availability, etc. To get the maximum benefit from a distributed cloud system, we need efficient algorithms for resource allocation which minimize communication costs and latency. In this paper, we develop efficient resource allocation algorithms for use in distributed clouds. Our contributions are as follows: Assuming that users specify their resource needs, such as the number of virtual machines needed for a large computational task, we develop an efficient 2-approximation algorithm for the optimal selection of data centers in the distributed cloud. Our objective is to minimize the maximum distance, or latency, between the selected data centers. Next, we consider use of a similar algorithm to select, within each data center, the racks and servers where the requested virtual machines for the task will be located. Since the network inside a data center is structured and typically a tree, we make use of this structure to develop an optimal algorithm for rack and server selection. Finally, we develop a heuristic for partitioning the requested resources for the task amongst the chosen data centers and racks. We use simulations to evaluate the performance of our algorithms over example distributed cloud systems and find that our algorithms provide significant gains over other simpler allocation algorithms.

MapReduce has emerged as an important paradigm for processing data in large data centers. MapReduce is a three phase algorithm comprising of Map, Shuffle and Reduce phases. Due to its widespread deployment, there have been several recent papers outlining practical schemes to improve the performance of MapReduce systems. All these efforts focus on one of the three phases to obtain performance improvement. In this paper, we consider the problem of jointly scheduling all three phases of the MapReduce process with a view of understanding the theoretical complexity of the joint scheduling and working towards practical heuristics for scheduling the tasks. We give guaranteed approximation algorithms and outline several heuristics to solve the joint scheduling problem.

In an ad targeting system, an advertiser specifies the profiles of the users to whom it is interested in showing an ad. The underlying ad distribution system would like to use profiles of users, if available, to match advertisers to users in an optimal manner. Availability of the needed profile information very much depends on whether users opt-in to have their profile information revealed. When some set of users opt-out of having their profile information revealed, possibly for privacy reasons, an ad distribution system needs methods to match advertisers to the right users despite the system itself not having full knowledge of the users' profiles. In this paper, we propose solutions to this problem thereby expanding the universe of users to whom ad targeting becomes feasible. Ads can be targeted to opt-in users, whose profiles are therefore known to the ad targeting system, using now known approaches. Our solution enables targeting of ads to users who have chosen to not opt-in to reveal their profiles. Such users keep their true interest profiles to themselves (locally on their equipment). Ads to be displayed are selected locally and ad scheduling is done using a guaranteed approximation online algorithm that uses only statistically falsified profile information and not the true profiles. Despite the use of statistically falsified information, accurate targeting can be done. We show both analytically and experimentally that the performance of the ad scheduler is quite close to optimal.

In this paper, we consider the problem of designing a data structure that can perform fast multiple-set membership testing in deterministic time. Our primary goal is to develop a hardware implementation of the data structure that uses only embedded memory blocks. Prior efforts to solve this problem involve hashing into multiple Bloom filters. Such approach needs a priori knowledge of the number of elements in each set in order to size the Bloom filter. We use a single-Bloom-filter-based approach and use multiple sets of hash functions to code for the set (group) id. Since a single Bloom filter is used, it does not need a priori knowledge of the distribution of the elements across the different sets. We show how to improve the performance of the data structure by using constant-weight error-correcting codes for coding the group id. Using error-correcting codes improves the performance of these data structures especially when there are a large number of sets. We also outline an efficient hardware-based approach to generate the large number of hash functions that we need for this data structure. The resulting data structure, COMB, is amenable to a variety of time-critical network applications.

Many popular algorithms for fast packet forwarding and filtering rely on the tree data structure. Examples are the trie-based IP lookup and packet classification algorithms. With the recent interest in network virtualization, the ability to run multiple virtual router instances on a common physical router platform is essential. An important scaling issue is the number of virtual router instances that can run on the platform. One limiting factor is the amount of high-speed memory and caches available for storing the packet forwarding and filtering data structures. An ideal goal is to achieve good scaling while maintaining total isolation among the virtual routers. However, total isolation requires maintaining separate data structures in high-speed memory for each virtual router. In this paper, we study the case where some sharing of the forwarding and filtering data structures is permissible and develop algorithms for combining tries used for IP lookup and packet classification. Specifically, we develop a mechanism called trie braiding that allows us to combine tries from the data structures of different virtual routers into just one compact trie. Two optimal braiding algorithms and a faster heuristic algorithm are presented, and the effectiveness is demonstrated using the real-world data sets.

Large-scale data processing needs of enterprises today are primarily met with distributed and parallel computing in data centers. MapReduce has emerged as an important programming model for these environments. Since today's data centers run many MapReduce jobs in parallel, it is important to find a good scheduling algorithm that can optimize the completion times of these jobs. While several recent papers focused on optimizing the scheduler, there exists very little theoretical understanding of the scheduling problem in the context of MapReduce. In this paper, we seek to address this problem by first presenting a simplified abstraction of the MapReduce scheduling problem, and then formulate the scheduling problem as an optimization problem.We devise various online and offline algorithms to arrive at a good ordering of jobs to minimize the overall job completion times. Since optimal solutions are hard to compute (NP-hard), we propose approximation algorithms that work within a factor of 3 of the optimal. Using simulations, we also compare our online algorithm with standard scheduling strategies such as FIFO, Shortest Job First and show that our algorithm consistently outperforms these across different job distributions.

Behavioral targeting of content to users is a huge and lucrative business, valued as a $20 billion industry that is growing rapidly. So far, the dominant players in this field like Google and Yahoo! examine the user requests coming to their servers and place appropriate ads based on the user's search keywords. Triple-play service providers have access to all the traffic generated by the users and can generate more comprehensive profiles of users based on their TV, broadband, and mobile usage. Using such multisource profile information, they can generate new revenue streams by smart targeting of ads to their users over multiple screens (computer, TV, and mobile handset). This paper proposes methods to place targeted ads to a TV based on user's interests. It proposes an ad auction model that can leverage multisource profile and can handle dynamic profile-based targeting like Google's AdWords vis-à-vis static demography-based targeting of legacy TV. We then present a 0.502-competitive revenue maximizing scheduling algorithm that chooses a set of ads in each time slot and assigns users to one of these selected ads.

Two-phase routing, where traffic is first distributed to intermediate nodes before being routed to the final destination, has been recently proposed for handling widely fluctuating traffic without the need to adapt network routing to changing traffic. Preconfiguring the network in a traffic-independent manner using two-phase routing simplifies network operation considerably. In this paper, we extend this routing scheme by providing resiliency against link failures through end-to-end shared backup path restoration. We view this as important progress toward adding carrier-class reliability to the robustness of the scheme so as to facilitate its future deployment in Internet service provider (ISP) networks. In shared backup path restoration, each connection consists of a link-disjoint primary and backup path pair; two backup paths can share bandwidth on their common links if their primary paths are link-disjoint. We show that the optimization problem for maximum throughput two-phase routing with shared backup path restoration is NP-hard. Assuming an approximation oracle for a certain disjoint paths problem (called SBPR-DISJOINT-PATHS, which is also NP-hard) involving the dual variables of a path indexed linear programming formulation for the problem, we design a combinatorial algorithm with provable guarantees. We also provide heuristics for finding approximating solutions to the SBPR-DISJOINT-PATHS problem. We evaluate the throughput performance and number of intermediate nodes in two-phase routing for the above and other restoration mechanisms for two-phase routing on actual ISP topologies collected for the Rocketfuel project and three research network topologies.

Routing traffic subject to hose model constraints has been of much recent research interest. Two-phase routing has been proposed as a mechanism for routing traffic in the hose model. It has desirable properties in being able to statically preconfigure the transport network and in being able to handle constraints imposed by specialized service overlays. In this paper, we investigate whether the desirable properties of two-phase routing come with any resource overhead compared to: 1) direct source-destination path routing; and 2) optimal scheme among the class of all schemes that are allowed to even make the routing dynamically dependent on the traffic matrix. In the pursuit of this endeavor, we achieve several milestones. First, we develop a polynomial-size linear programming (LP) formulation for maximum throughput routing of hose traffic along direct source-destination paths. Second, we develop a polynomial-size LP formulation for maximum throughput two-phase routing of hose traffic for a generalized version of the scheme proposed in our previous work. Third, we develop a polynomial-size LP formulation for minimum-cost two-phase routing of hose traffic for the generalized version of the scheme. We also give a second (simpler) LP formulation and fast combinatorial algorithm for this problem using an upper bound on the end-to-end traffic demand. Fourth, we prove that the throughput (and cost) of two-phase routing is within a factor of 2 of that of the optimal scheme. Using the polynomial-size LP formulations developed, we compare the throughput of two-phase routing to that of direct source-destination path routing and optimal scheme on actual Internet service provider topologies collected for the Rocketfuel project and three research network topologies. The throughput of two-phase routing matches that of direct source-destination path routing and is close to that of the optimal scheme on all evaluated topologies. We conclude that two-phase routing achieves its robustness to traffic variation without imposing any appreciable additional resource requirements over previous approaches.

Behavioral targeting of content to users is a huge and lucrative business, valued as a $20 billion industry that is growing rapidly. So far dominant players in this field like Google and Yahoo examine the user requests coming to their servers and place appropriate ads based on the user's search keywords. Triple play service providers have access to all the traffic generated by the users and can generate more comprehensive profiles of users based on their TV, broadband and mobile usage. Using such multi-source profile information they can generate new revenue streams by smart targeting of ads to their users over multiple screens (computer, TV and mobile handset). This paper proposes methods to place targeted ads to a TV based on user's interests. It proposes an ad auction model that can leverage multi-source profile and can handle dynamic profile-based targeting like Google's AdWords vis-a-vis static demography-based targeting of legacy TV. We then propose a 0.502-competitive revenue maximizing scheduling algorithm that chooses a set of ads in each time slot and assigns users to one of these selected ads.

Many popular algorithms for fast packet forwarding and filtering rely on the tree data structure. Examples are the trie-based IP lookup and packet classification algorithms. With the recent interest in network virtualization, the ability to run multiple virtual router instances on a common physical router platform is essential. An important scaling issue is the number of virtual router instances that can run on the platform. One limiting factor is the amount of high-speed memory and caches available for storing the packet forwarding and filtering data structures. An ideal goal is to achieve good scaling while maintaining total isolation amongst the virtual routers. However, total isolation requires maintaining separate data structures in high-speed memory for each virtual router. In this paper, we study the case where some sharing of the forwarding and filtering data structures is permissible and develop algorithms for combining tries used for IP lookup and packet classification. Specifically, we develop a mechanism called trie-braiding that allows us to combine tries from the data structures of different virtual routers into just one compact trie. Two optimal braiding algorithms are presented and the effectiveness is demonstrated using the real world data sets.

With the increasing volume of VoIP, IPTV, and other real-time traffic on the Internet in recent years, service providers and operators demand tools to effectively detect and manage such traffic in their networks. However, many such applications are not easy to detect by using conventional approaches based on packet header and payload inspections since they may use random ports and data encryption. In this paper, we propose a simple yet effective approach that can detect constant or near constant rate traffic based on statistical inference on packet timing behaviors. Through experiments with traffic collected from both lab controlled environment and actual field networks, we show that this approach is easier to implement and has much better performance compared to existing approaches.

Two-phase routing, where traffic is first distributed to intermediate nodes before being routed to the final destination, has been proposed for handling widely fluctuating traffic without the need to adapt network routing to changing traffic. Pre-configuring the network in a traffic independent manner using two-phase routing simplifies network operation considerably. In this paper, we extend this routing scheme by providing resiliency against link failures through shared backup path restoration. We view this as important progress towards adding carrier-class reliability to the robustness of the scheme so as to facilitate its future deployment in Internet service provider (ISP) networks. In shared backup path restoration, each connection consists of a link-disjoint primary and backup path pair - two backup paths can share bandwidth on their common links if their primary paths are link disjoint. We show that the optimization problem for maximum throughput two-phase routing with shared backup path restoration is NP-hard. Assuming an approximation oracle for a certain disjoint paths problem (called SBPR-DISJOINT-PATHS, which is also NP-hard) involving the dual variables of a path indexed linear programming formulation for the problem, we design a combinatorial algorithm with provable guarantees. We also provide heuristics for finding approximating solutions to the SBPR-DISJOINT-PATHS problem. We evaluate the throughput performance and number of intermediate nodes in two-phase routing for the above and other restoration mechanisms for two-phase routing on actual ISP topologies collected for the Rocketfuel project.

Recently, there has been much renewed interest in developing compact data structures for packet processing functions such as longest prefix-match for IP lookups. This has been motivated by several factors: (1) The advent of 100 Gbps interfaces necessitating correspondingly fast packet processing algorithms with a compact memory footprint; (2) network virtualization leading to virtualization of physical router platforms making it critical to reduce high-speed memory needs per virtual router; (3) software routers built on multi-core processors requiring the use of compact data-structures that fit in on-chip caches for good performance. In this paper, we revisit this issue of developing compact data structures for key packet-processing functions. We develop a new data structure, called the shape graph, that significantly compacts the trie data-structure used for IP lookups. We accomplish this by identifying considerable structural similarities in IP lookup tries that have not previously been used in the literature for scalable IP lookups. We use these similarities to store lookup tries in a new graph data structure that has a significantly lower memory-footprint. Using real IP forwarding tables, we compare the memory usage of this new data structure to that of multi-bit tries and of Bloom filters used for IP lookups. The shape graph requires significantly less memory and allows the far more effective use of on-chip memory. This effective use of on-chip memory combined with multi-threading on a multi-core processor makes shape-graph-based IP lookups well suited for 100 Gbps lookups. The small footprint also makes it well suited for use in router platforms that host a large number of virtual routers.

In this paper we consider the problem of designing a data structure that can perform fast multiset membership testing in deterministic time. Our primary goal is to develop a hardware implementation of the data structure which uses only embedded memory blocks. Prior efforts to solve this problem involve hashing into multiple bloom filters. Such approach needs a priori knowledge of the number of elements in each set in order to size the bloom filter. We use a single bloom filter based approach and use multiple sets of hash functions to code for the set (group) id. Since a single bloom filter is used, it does not need a priori knowledge of the distribution of the elements across the different sets. We show how to improve the performance of the data structure by using constant weight error correcting codes for coding the group id. Using error correcting codes improves the performance of these data structures especially when there are large number of sets. We also outline an efficient hardware based approach to generate the the large number of hash functions that we need for this data structure. The resulting data structure, COMB, is amenable to a variety of time-critical network applications.

Abstract—Accelerating multi-pattern matching is a critical is-sue in building high-performance deep packet inspection systems. Achieving high-throughputs while reducing both memory-usage and memory-bandwidth needs is inherently difficult. In this paper, we propose a pattern (string) matching algorithm that achieves high throughput while limiting both memory-usage and memory-bandwidth. We achieve this by moving away from a byte-oriented processing of patterns to a block-oriented scheme. However, different from previous block-oriented approaches, our scheme uses variable-stride blocks. These blocks can be uniquely identified in both the pattern and the input stream, hence avoid-ing the multiplied memory costs which is intrinsic in previous approaches. We present the algorithm, tradeoffs, optimizations, and implementation details. Performance evaluation is done using the Snort and ClamAV pattern sets. Using our algorithm, the throughput of a single search engine can easily have a many-fold increase at a small storage cost, typically less than three bytes per pattern character. I.

The capacity of wireless channels has been studied extensively by the information theory community over the years. There have been several efforts to extend this theory to multi-hop wireless networks. One approach to estimating the capacity of multihop wireless networks is to determine asymptotically how the capacity scales as the number of nodes in the network increases. In these models, the traffic is typically assumed to be uniform. Another approach assumes that node locations and channel conditions are known and the question is to determine whether a given traffic matrix can be routed on the wireless network. This usually involves solving jointly, routing, scheduling and power control problems to achieve the given traffic matrix. In practice, it is quite difficult to estimate the traffic matrix and further, the traffic matrix typically changes over time. In this paper, we are given the location of the nodes and the inter-node channel parameters. Instead of being provided a traffic matrix, we are provided with only the total amount of traffic that can originate and terminate at each node in the network. The objective is to determine if there exists a joint routing and scheduling policy that can handle any traffic matrix that satisfies these ingress/egress constraints. We derive necessary and sufficiency conditions for the problem for both the directional and omni-directional antenna cases. We solve the joint routing and scheduling problem for all traffic matrices that satisfy the ingress-egress constraints.

Internet line speeds are expected to reach 100 Gbps in a few years. To match these line rates, a single router line card needs to forward more than 150 million packets per second. This requires a corresponding amount of longest prefix match operations. Furthermore, the increased use of IPv6 requires core routers to perform the longest prefix match on several hundred thousand prefixes varying in length up to 64 bits. It is a challenge to scale existing algorithms simultaneously in the three dimensions of increased throughput, table size and prefix length. Recently, Bloom filter-based IP lookup algorithms have been proposed. While these algorithms can take advantage of hardware parallelism and fast on-chip memory to achieve high performance, they have significant drawbacks (discussed in the paper) that impede their use in practice. In this paper, we present the distributed and load balanced bloom filters to address these drawbacks. We develop the practical IP lookup algorithm for use in 100 Gbps line cards. The regular and modular hardware architecture of our scheme directly maps to the state-of-art ASICs and FPGAs with reasonable resource consumption. Also, our scheme outperforms TCAMs on most metrics including cost, power dissipation, and board footprint.

High-speed organizational networks running over leased fiber-optic lines or VPNs suffer from the well-known limitations of TCP over long-fat pipes. High-performance protocols like XCP require changes in the network. Other protocols like FastTCP assume nothing about the network but may not perform as well as network-aware protocols. In this paper, we present a new transport protocol that exploits the fact that these networks can offer priority queuing, thus finding the sweet spot between assuming too much and too little about the network. Our protocol splits a given transport flow into two prioritized flows. The higher priority flow operates with the legacy congestion control while the lower priority flow aggressively exploits spare capacity in the network while not interfering with the other participating flows. This isolation of the aggressive flow into strictly lower priority queues gives us more latitude in how to operate the aggressive component. We show through Emulab experiments of our implementation as well as simulations that this protocol can produce near-perfect goodputs in lossy networks, can considerably improve the completion time of short flows, and can sustain a high bottleneck utilization even in changing network conditions.

A bloom filter is a randomized data structure for performing approximate membership queries. It is being increasingly used in networking applications ranging from security to routing in peer to peer networks. In order to meet a given false positive rate, the amount of memory required by a bloom filter is a function of the number of elements in the set. We consider the problem of minimizing the memory requirements in cases where the number of elements in the set is not known in advance but the distribution or moment information of the number of elements is known. We show how to exploit such information to minimize the expected amount of memory required for the filter. We also show how this approach can significantly reduce memory requirement when bloom filters are constructed for multiple sets in parallel. We show analytically as well as experiments on synthetic and trace data that our approach leads to one to three orders of magnitude reduction in memory compared to a standard bloom filter.

Unbounded growth in the number of active flows can lead to severe service quality degradation to existing flows in a network . To guarantee minimum service quality for individual flows, specially for multimedia traffic, it is necessary to estimate and bound the number of active flows in the network. Prior work on estimating the number of active flows has been difficult without maintaining per-flow state. In this paper, we propose a light weight (not requiring per flow state) mechanism to estimate the number of active flows. This estimate is then used to determine the probability of admitting a new flow into the network with the goal of preventing extreme degradation of throughput to existing flows. The key idea here is that the number of active flows can be inferred from the frequency at which a newly arriving packet is part of the same flow as a randomly selected packet in the buffer. Since this scheme relies on information already available in the buffer, no per-flow state is maintained in the network. This mechanism requires very little per-packet processing, even less than a forwarding table lookup. Simulation results show that the proposed scheme can stabilize an overloaded network by bounding the number of active flows without significantly impairing link utilization. This scheme also gives good performance when buffer sizes are small and when the network has a mix of TCP and UDP traffic.

In this paper, we propose DATALITE, a Distributed Architecture for Traffic Analysis via LIght-weight Traffic digEst, which introduces a set of new distributed algorithms and protocols to support general Traffic Measurement and Analysis (TMA) functions for large-scale, 10Gbps+ packet-switched networks. We formulate the network-wide traffic measurement/ analysis problem as a series of set-cardinality-determination (SCD) problems. By leveraging recent advances in probabilistic distinct sample counting techniques, the set-cardinalities, and thus, the network-wide traffic measurements of interest can be computed in a distributed manner via the exchange of extremely light-weight traffic digests (TD’s) amongst the network nodes. A TD for N packets only requires O(loglog N) bits of memory storage.

We consider a wireless system comprising of multiple users that communicate with a base station. When there are a large number of users with time varying channels, it has been shown that multiuser diversity can be exploited to achieve high throughput in these systems. In a system employing multiuser diversity, the base station estimates the channel quality for each user during each time slot, and schedules the user with the best channel condition for that time slot. There has been a considerable amount of work towards developing scheduling mechanisms to provide quality of service guarantees to the individual users in addition to maximizing total throughput. In this paper, we consider the achievable rate region of a multiuser TDM system when the average transmit power is bounded. Our objective is to develop efficient algorithms to determine if a given rate vector is achievable within the average power bound. We characterize the achievable rate region when the channel behavior can be approximated by the on-off Gilbert-Elliot channel model. We first show that the problem of determining if a rate vector is achievable can be formulated as a convex optimization problem over a suitably denned polymatroid. We derive optimal waterfilling algorithms for solving the achievable rate region problem.

The growing importance of operations such as packet-content inspection, packet classification based on non-IP headers, maintaining flow-state, etc. has led to increased interest in the networking applications of Bloom filters. This is because Bloom filters provide a relatively easy method for hardware implementation of set-membership queries. However, the tradeoff is that Bloom filters only provide a probabilistic test and membership queries can result in false positives. Ideally, we would like this false positive probability to be very low. The main contribution of this paper is a method for significantly reducing this false positive probability in comparison to existing schemes. This is done by developing a partitioned hashing method which results in a choice of hash functions that set far fewer bits in the Bloom filter bit vector than would be the case otherwise. This lower fill factor of the bit vector translates to a much lower false positive probability. We show experimentally that this improved choice can result in as much as a ten-fold increase in accuracy over standard Bloom filters. We also show that the scheme performs much better than other proposed schemes for improving Bloom filters.

Abstract — We consider the realization of traffic-oblivious routing in IP-over-Optical networks where routers are interconnected over a switched optical backbone, also called IP-over-OTN (Optical Transport Network). The traffic-oblivious routing we consider is a scheme where incoming traffic is first distributed in a preset manner to a set of intermediate nodes. The traffic is then routed from the intermediate nodes to the final destination. This splitting of the routing into two-phases simplifies network configuration significantly [8], [17]. In implementing this scheme, the first and second phase paths are realized at the optical layer with router packet grooming at a single intermediate node only. Studies like [10] indicate that IP routers are 200 times more unreliable than traditional carrier-grade switches and average 1219 minutes of down time per year. Given this unreliability of routers, we consider how two-phase routing in IP-over-OTN can be made resilient against router node failures. We propose two different schemes for provisioning the optical layer to handle router node failures – one that is failure node independent and static, and the other that is failure node dependent and dynamic. We develop linear programming formulations for both schemes and a fast combinatorial algorithm for the second scheme so as to maximize network throughput. In each case, we determine (i) the optimal distribution of traffic to various intermediate routers for both normal (no-failure) and failure conditions, and (ii) provisioning of optical layer circuits to provide the needed inter-router links. We evaluate the performance of the two router failure protection schemes (in terms of throughput) and compare it with that of unprotected routing. For our experiments, we use actual ISP network topologies collected for the Rocketfuel project. I.

Packet content scanning at high speed has become extremely important due to its applications in network security, network monitoring, HTTP load balancing, etc. In content scanning, the packet payload is compared against a set of patterns specified as regular expressions. In this paper, we first show that memory requirements using traditional methods are prohibitively high for many patterns used in packet scanning applications. We then propose regular expression rewrite techniques that can effectively reduce memory usage. Further, we develop a grouping scheme that can strategically compile a set of regular expressions into several engines, resulting in remarkable improvement of regular expression matching speed without much increase in memory usage. We implement a new DFA-based packet scanner using the above techniques. Our experimental results using real-world traffic and patterns show that our implementation achieves a factor of 12 to 42 performance improvement over a commonly used DFA-based scanner. Compared to the state-of-art NFA-based implementation, our DFA-based packet scanner achieves 50 to 700 times speedup.

Two-phase routing, where traffic is first distributed to intermediate nodes before being routed to the final destination, has been recently proposed for handling widely fluctuating traffic without the need to adapt network routing to changing traffic. Pre-configuring the network in a traffic independent manner using two-phase routing simplifies network operation considerably. In this paper, we extend this routing scheme by providing resiliency against link failures through two different fast restoration mechanisms - local (link/span) based and end-to-end (path) based. We view this as important progress towards adding carrier-class reliability to the robustness of the scheme so as to facilitate its future deployment in Internet service provider (ISP) networks. The main contribution of the paper is the development of fast combinatorial algorithms for routing under the scheme with link and path restoration mechanisms so as to minimize the maximum utilization of any link in the network, or equivalently, maximize the throughput. The algorithms developed are fully polynomial time approximation schemes (FPTAS) - for any given epsi > 0, an FPTAS guarantees a solution that is within a (1 + epsi) -factor of the optimum and runs in time polynomial in the input size and 1/epsi. To the best of our knowledge, this is the first work in the literature that considers making the scheme resilient to link failures through pre-provisioned fast restoration mechanisms. We evaluate the performance of link and path restoration (in terms of throughput) and compare it with that of unprotected routing. For our experiments, we use actual ISP network topologies collected for the Rocketfuel project.

Fast IP flow rate estimation has many potential applications in network management, monitoring, security, and traffic engineering. Recently, low cost and memory efficient techniques to accurately estimate flow-rates in real-time have been developed. These techniques rely on flow definitions being constrained to being subsets of the fields in the packet header making flow-membership tests relatively inexpensive. In this paper, we consider a more general flow-rate estimation problem where flow membership testing is non-trivial and may involve more complex processing such as packet-payload based tests. An example is to estimate the amount of traffic that contains a given set of patterns (e.g., virus or worm signatures). We design new flow estimation techniques to reduce the number of membership tests. These techniques track pairs of arrivals that have the given property of interest and use lazy membership testing to avoid complex property testing unless absolutely necessary. The efficiency of the new schemes is evaluated by both analysis and simulation. I.

The emergence of new applications on the Internet like voice-over-IP, peer-to-peer, and video-on-demand has created highly dynamic and changing traffic patterns. In order to route such traffic with Quality-of-Service (QoS) guarantees without requiring detection of traffic changes in real-time or reconfiguring the network in response to it, we consider a routing and bandwidth allocation scheme that allows preconfiguration of the network such that all traffic patterns permissible within the network’s natural ingress-egress capacity constraints can be handled in a capacity efficient manner. The scheme routes traffic in two phases. In the first phase, incoming traffic is sent from the source to a set of intermediate nodes and then, in the second phase, from the intermediate nodes to the final destination. The traffic in the first phase is distributed to the intermediate nodes in predetermined proportions that depend on the intermediate nodes. In this paper, we develop linear programming formulations and a fast combinatorial algorithm for routing under the scheme so as to maximize throughput (or, minimize maximum link utilization). We compare the throughput performance of the scheme with that of the optimal scheme among the class of all schemes that are allowed to even make the routing dependent on the traffic matrix. For our evaluations, we use actual Internet Service Provider topologies collected for the Rocketfuel project. We also bring out the versatility of the scheme in not only handling widely fluctuating traffic but also accommodating applicability to several widely differing networking scenarios, including (i) economical Virtual Private Networks (VPNs), (ii) supporting indirection in specialized service overlay models like Internet Indirection Infrastructure (i3), (iii) adding QoS guarantees to services that require routing through a network-based middlebox, and (iv) reducing IP layer transit traffic and handling extreme traffic variability in IP-over-Optical networks without dynamic reconfiguration of the optical layer. The two desirable properties of supporting indirection in specialized service overlay models and static optical layer provisioning in IP-over-Optical networks are not present in other approaches for routing variable traffic, such as direct source-destination routing along fixed paths.

We consider the realization of traffic-oblivious rout- ing in IP-over-Optical networks where routers are interconnected over a switched optical backbone. The traffic-oblivious routing we consider is a scheme where incoming traffic is first distributed in a preset manner to a set of intermediate nodes. The traffic is then routed from the intermediate nodes to the final destination. This splitting of the routing into two phases simplifies network configuration significantly. In implementing this scheme, the first and second phase paths are realized at the optical layer with router packet grooming at a single intermediate node only. Stud- ies like (13) indicate that IP routers are 200 times more unreliable than traditional carrier-grade switches and average 1219 minutes of down time per year. Given this unreliability of routers, we consider how two-phase routing in IP-over-Optical networks can be made resilient against router node failures. We propose two different schemes for provisioning the optical layer to handle router node failures - one that is failure node independent and static, and the other that is failure node dependent and dynamic. We develop linear programming formulations for both schemes and a fast combinatorial algorithm for the second scheme so as to maximize network throughput. In each case, we determine (i) the optimal distribution of traffic to various intermediate routers for both normal (no-failure) and failure conditions, and (ii) provisioning of optical layer circuits to provide the needed inter-router links. We evaluate the performance of the two router failure protection schemes (in terms of throughput) and compare it with that of unprotected routing.

A computer-implemented method of computing throughput of a data-routing scheme for a network of nodes interconnected by links and having at least one ingress point and at least one egress point. The method includes: deriving a polynomial-size linear program from a combination of a first linear program and a second linear program and solving the polynomial-size linear program. The first linear program has infinite constraints and minimizes maximum-link utilization of a link in a path between the ingress point and the egress point. The second linear program determines whether any constraint of the first linear program is violated.

New network applications like intrusion detection systems and packet-level accounting require multimatch packet classification, where all matching filters need to be reported. Ternary content addressable memories (TCAMs) have been adopted to solve the multimatch classification problem due to their ability to perform fast parallel matching. However, TCAMs are expensive and consume large amounts of power. None of the previously published multimatch classification schemes are both memory and power efficient. In this paper, we develop a novel scheme that meets both requirements by using a new set splitting algorithm (SSA). The main idea behind SSA is that it splits filters into multiple groups and performs separate TCAM lookups into these groups. It guarantees the removal of at least 1/2 the intersections when a filter set is split into two sets, thus resulting in low TCAM memory usage. SSA also accesses filters in the TCAM only once per packet, leading to low-power consumption. We compare SSA with two best known schemes: multimatch using discriminators (MUD) (Lakshminarayanan and Rangarajan, 2005) and geometric intersection-based solutions (Yu and Katz, 2004). Simulation results based on the SNORT filter sets show that SSA uses approximately the same amount of TCAM memory as MUD, but yields a 75%-95% reduction in power consumption. Compared with geometric intersection-based solutions, SSA uses 90% less TCAM memory and power at the cost of one additional TCAM lookup per packet. We also show that SSA can be combined with SRAM/TCAM hybrid approaches to further reduce energy consumption

Real-time IP flow estimation has many potential applications in network management, monitoring, security, and traffic engineering. Existing techniques typically rely on flow definitions being constrained as subsets of the fields in packet headers. This makes flow-membership tests relatively inexpensive. In this paper, we consider a more general flow estimation problem that needs complex packet-payload based tests for flow-membership. An example is to estimate traffic with common strings in the payload and detect potential virus signatures for early alarm generation. We develop a fast, memory efficient algorithm for solving this problem as a variant of the longest common subsequence problem. This is done via an application of Rabin fingerprinting in combination with bloom filters. Both analysis and simulation show the effectiveness of the developed method.

New network applications like intrusion detection systems and packet-level accounting require multi-match packet classification, where all matching filters need to be reported. Ternary Content Addressable Memories (TCAMs) have been adopted to solve the multi-match classification problem due to their ability to perform fast parallel matching. However, TCAM is expensive and consumes large amounts of power. None of the previously published multi-match classification schemes is both memory and power efficient. In this paper, we develop a novel scheme that meets both requirements by using a new Set Splitting Algorithm (SSA). The main idea of SSA is that it splits filters into multiple groups and performs separate TCAM lookups into these groups. It guarantees the removal of at least half the intersections when a filter set is split into two sets, thus resulting in low TCAM memory usage. SSA also accesses filters in the TCAM only once per packet, leading to low power consumption. We compare SSA with two best known schemes: MUD [1] and Geometric Intersection-based solutions [2]. Simulation results based on the SNORT filter sets show that SSA uses approximately the same amount of TCAM memory as MUD, but yields a 75% to 95% reduction in power consumption. Compared with Geometric Intersection-based solutions, SSA uses 90% less TCAM memory and power at the cost of one additional TCAM lookup per packet.

An important feature of MPLS networks is local restoration where detour paths are set-up a priori. The detour is such that failed links or nodes can be bypassed locally from the first node that is upstream from the failures. This local bypass activation from the first detection point for failures permits much faster recovery than end-to-end path based mechanisms that require failure information to propagate to the network edges. However, local restoration of bandwidth guaranteed connections can be expensive in the additional network capacity needed. Hence, it is important to minimize and share restoration capacity. The problem of routing with local restoration requirements has been studied previously in a dynamic on-line setting. However, there are no satisfactory algorithms for the problem of pre-provisioning fast restorable connections when the aggregate traffic demands are known (as would be the case when a set of routers are to be interconnected over an optical network or for pre-provisioned ATM over MPLS overlays). The contribution of this paper is a fast combinatorial approximation algorithm for maximizing throughput when the routed traffic is required to be locally restorable. To the best of our knowledge, this is the first combinatorial algorithm for the problem with a performance guarantee. Our algorithm is a fully polynomial time approximation scheme (FPTAS), i.e., for any given /spl epsi/>0, it guarantees (1+/spl epsi/)-factor closeness to the optimal solution, and runs in time polynomial in the network size and 1//spl epsi/. We compare the throughput of locally restorable routing with that of unprotected routing and 1+1-dedicated path protection on representative ISP topologies.

We consider the problem of fast, estimation of flow rates in backbone network links with possibly millions of flows. Accurate flow rate estimation is necessary for network traffic management, network planning, measuring compliance to service level agreements, and network security. Ideally, a rate estimation scheme should have short estimation times with provable bounds on estimation error, be low in memory usage, and be easily implementable in hardware for operation at high speeds. We develop such a scheme, and achieve up to two orders of magnitude speed-up in estimation time over the previously proposed two-runs-based RATE scheme [Kodialam, M et al., 2004]. The speedups are achieved without a significant increase in memory usage, by using coincidences instead of runs. Counting coincidences has a higher processing overhead than detecting two-runs, but this higher overhead is not significant for a hardware implementation. We show that the proposed scheme is faster and more accurate than other recently proposed schemes such as ACCEL-RATE [Hao, F et al., 2004] and smart sampling [Duffield, N et al., 2004]. The faster estimation time of the new scheme has many benefits including quicker detection of incipient denial of service attacks. We prove bounds on the scheme's accuracy, memory needs, and also show that it performs well by simulations that use both synthetic and real traffic traces.

With the rapid increase in the frequency of worm attacks, there has been significant interest in developing network based mechanisms that slow or contain worm propagation. One suggested network-based approach is the use of special content filtering nodes that examine the complete content of each packet and block traffic that contain strings matching a pre-specified set of worm signatures. To be effective, containment systems need to have fast reaction times (content filtering with the appropriate signatures must be activated very soon after the start of an attack) and need to be comprehensive in the sense that every packet routed through the network must be examined at least once. Since network-based content filtering is expensive, it is desirable to make the best use of deployable content filtering capability. This requires intelligent placement of the content filtering nodes in the network and use of appropriate network routing to maximize the carried traffic. In this paper, we study the impact of the content filtering requirement on network capacity. First, we develop an intelligent heuristic for deployment of content filtering nodes in the network. Next, given a set of deployed content filtering nodes, we develop a fully polynomial time approximation scheme (FP-TAS) that maximizes the traffic carried by the network subject to the constraint that all traffic passes through a content filtering node at least once. Simulation studies using the developed schemes show that for large networks, most of the traffic can be examined even when only 10% of the network nodes are content filtering capable.

Input-queued switches are used extensively in the design of high-speed routers. As switch speeds and sizes increase, the design of the switch scheduler becomes a primary challenge, because the time interval for the matching computations needed for determining switch configurations becomes very small. Possible alternatives in scheduler design include increasing the scheduling interval by using envelopes , and using a frame-based scheduler that guarantees fixed rates between input-output pairs. However, both these alternatives have significant jitter drawbacks: the jitter increases with the envelope size in the first alternative, and previously-known methods do not guarantee tight jitter bounds in the second. In this paper, we propose a hybrid approach to switch scheduling. Traffic with tight jitter constraints is first scheduled using a frame-based scheduler that achieves low jitter bounds. Jitter-insensitive traffic is later scheduled using an envelope-based scheduler. The main contribution of this paper is a scheduler design for generating low-jitter schedules. The scheduler uses a rate matrix decomposition designed for low jitter and different from the minimum-bandwidth Birkhoff-Von Neumann (BV) decomposition. In addition to generating low-jitter schedules, this decomposition in the worst case yields fewer switch configuration matrices (O(n)) than the BV decomposition (O(n/sup 2/)), and so requires far less high-speed switch memory. We develop an efficient algorithm for decomposing the rate matrix and for scheduling the permutation matrices. We prove that our low-jitter algorithm has an O(logn) factor bound on its bandwidth consumption in comparison to the minimum-bandwidth BV decomposition. Experimentally, we find that the bandwidth increase in practice is much lower than the theoretical bound. We also prove several related performance bounds for our scheduler. Finally, we propose a practical algorithm for bandwidth-guaranteed algorithm, and show how our findings could even be extended to systems with large tuning time.

In today's Internet, worms and viruses cause service disruptions with enormous economic impact. Current attack prevention mechanisms rely on end-user cooperation to install new system patches or upgrade security software, yielding slow reaction time. However, malicious attacks spread much faster than users can respond, making effective attack prevention difficult network-based mechanisms, by avoiding end-user coordination, can respond rapidly to new attacks. Such mechanisms require the network to inspect the packet payload at line rates to detect and filter those packets containing worm signatures. These signature sets are large (e.g., thousands) and complex. Software-only implementations are unlikely to meet the performance goals. Therefore, making a network-based scheme practical requires efficient algorithms suitable for hardware implementations. This work develops a ternary content addressable memory (TCAM) based multiple-pattern matching scheme. The scheme can handle complex patterns; such as arbitrarily long patterns, correlated patterns, and patterns with negation. For the ClamAv virus database with 1768 patterns whose sizes vary from 6 bytes to 2189 bytes, the proposed scheme can operate at a 2 Gbps rate with a 240 KB TCAM.

We address the problem of fast automatic identification of traffic patterns in core networks with high speed links carrying large numbers of flows. This problem has applications in detecting DoS attacks, traffic management, and network security. The typical measurement and identification objective is to determine flows that use up a disproportionate fraction of network resources. Several schemes have been devised to measure large flows efficiently assuming that the notion of what constitutes a flow is well defined a priori. However, there are many scenarios where traffic patterns are hidden in the sense that there is no clear knowledge of what exactly to look for and there is no natural a priori definition of flow. In This work, we develop an effective scheme to identify and measure hidden traffic patterns. The approach is flexible enough to automatically identify interesting traffic patterns for further evaluation. The basic idea is to extend the runs based approach proposed in (Kodialam, M. et al., 2004) to the case where flow definitions are not known a priori. A straightforward extension is both memory and processing intensive. We develop an efficient scheme that has good theoretical properties and does extremely well in practice.

Per-flow network traffic measurements are needed for effective network traffic management, network performance assessment, and detection of anomalous network events such as incipient DoS attacks. Explicit measurement of per-flow traffic statistics is difficult in backbone networks because tracking the possibly hundreds of thousands of flows needs correspondingly large high-speed memories. To reduce the measurement overhead, many previous papers have proposed the use of random sampling and this is also used in commercial routers (Cisco's Net Flow). Our goal is to develop a new scheme that has very low memory requirements and has quick convergence to within a prespecified accuracy. We achieve this by use of a novel approach based on sampling two-runs to estimate per-flow traffic. (A flow has a two-run when two consecutive samples belong to the same flow). Sampling two-runs automatically biases the samples towards the larger flows thereby making the estimation of these sources more accurate. This biased sampling leads to significantly smaller memory requirement compared to random sampling schemes. The scheme is very simple to implement and performs extremely well

Fast restoration is an important feature of both MPLS and optical networks. The main mechanism for achieving fast restoration is by locally routing around failures using pre-setup detour paths. Signaling and routing protocol extensions to implement this local bypass ability are currently being standardized. To make use of this ability, dynamic schemes that jointly route primary paths and all link detours for links used by the primary paths have been previously proposed. These schemes also permit sharing of reserved restoration capacity for achieving efficiency. However, this joint computation places a significantly larger computational load on the network elements than that imposed by the shortest path computation variants typically used for unprotected network connection routing. We propose a new scheme that is operationally much simpler, shares capacity used for restoration, and permits the network to route the primary paths in a manner that is oblivious to restoration needs. Restoration of all carried traffic is guaranteed by a new link capacity partitioning scheme that maximizes the working capacity of the network without requiring any knowledge of the traffic that will be imposed on the network. Being traffic independent for a priori link capacity partitioning and being oblivious to restoration needs for on-line network routing makes this scheme operationally simple and desirable in the sense of placing no additional routing load on the constrained computing resources at the network nodes. To compute the link capacity partitions, we develop a fast combinatorial algorithm that uses only iterative shortest path computations, and is a fully polynomial time approximation scheme (FPTAS), i.e., it achieves a (1 + /spl epsi/)-factor approximation for any /spl epsi/> 0 and runs in time polynomial in the input size and 1//spl epsi/.The approximation scheme also allows link detour paths to be hop constrained if needed so as to bound restoration latency in optical networks.

Per-flow network traffic measurement is an important component of network traffic management, network performance assessment, and detection of anomalous network events such as incipient DoS attacks. In [1], the authors developed a mechanism called RATE where the focus was on developing a memory efficient scheme for estimating per-flow traffic rates to a specified level of accuracy. The time taken by RATE to estimate the per-flow rates is a function of the specified estimation accuracy and this time is acceptable for several applications. However some applications, such as quickly detecting worm related activity or the tracking of transient traffic, demand faster estimation times. The main contribution of this paper is a new scheme called ACCEL-RATE that, for a specified level of accuracy, can achieve orders of magnitude decrease in per-flow rate estimation times. It achieves this by using a hashing scheme to split the incoming traffic into several sub-streams, estimating the per-flow traffic rates in each of the substreams and then relating it back to the original per-flow traffic rates. We show both theoretically and experimentally that the estimation time of ACCEL-RATE is at least one to two orders of magnitude lower than RATE without any significant increase in the memory size.

A new algorithm for routing of messages in ad-hoc networks where the nodes are energy-constrained is presented. The routing objective is to maximize the total number of messages that can be successfully sent over the network without knowing any information regarding future message arrivals or message generation rates. From a theoretical perspective, we show that if admission control of messages is permitted, then the worst-case performance of our algorithm is within a factor of O(log(network size)) of the best achievable solution. In other words, our algorithm achieves a logarithmic competitive ratio. Our approach provides sound theoretical backing for several observations that have been made by previous researchers. From a practical perspective, we show by extensive simulations that the performance of the algorithm is very good even in the absence of admission control (the admission control being necessary only to prove the competitive ratio result), and that it also performs better than previously proposed algorithms for other suggested metrics such as network lifetime maximization. Our algorithm uses a single shortest path computation, and is amenable to efficient implementation. We also evaluate by simulations the performance impact of inexact knowledge of residual battery energy, and the impact of energy drain due to dissemination of residual energy information.

Input-queued switches are used extensively in the design of high-speed routers. As switch speeds and sizes increase, the design of the switch scheduler becomes a primary challenge, because the time interval for the matching computations needed for determining switch configurations becomes very small. Possible alternatives in scheduler design include increasing the scheduling interval by using envelopes, and using a frame-based scheduler that guarantees fixed rates between input-output pairs. However, both these alternatives have significant jitter drawbacks: the jitter increases with the envelope size in the first alternative, and previously-known methods do not guarantee tight jitter bounds in the second. In this paper, we propose a hybrid approach to switch scheduling. Traffic with tight jitter constraints is first scheduled using a frame-based scheduler that achieves low jitter bounds. Jitter-insensitive traffic is later scheduled using an envelope-based scheduler. The main contribution of this paper is a scheduler design for generating low-jitter schedules. The scheduler uses a rate matrix decomposition designed for low jitter and different from the minimum-bandwidth Birkhoff-Von Neumann (BV) decomposition. In addition to generating low-jitter schedules, this decomposition yields fewer switch configuration matrices (O(n)) than the BV decomposition (O(n/sup 2/)), and so uses far less high-speed switch memory. We develop an efficient algorithm for decomposing the rate matrix and for scheduling the permutation matrices. We prove that our low-jitter algorithm has an O(log n) factor bound on its bandwidth consumption in comparison to the minimum-bandwidth BV decomposition. Experimentally, we find that the bandwidth increase in practice is much lower than the theoretical bound. We also prove several related performance bounds for our scheduler. Finally, we propose a practical bandwidth-guaranteed algorithm, and show how our findings could even be extended to systems with large tuning time.

In this paper, we consider the problem of detecting an intruding packet in a communication network. Detection is accomplished by sampling a portion of the packets transiting selected network links (or router interfaces). Since sampling entails incurring network costs for real-time packet sampling and packet examination hardware, we would like to develop a network packet sampling strategy to effectively detect network intrusions while not exceeding a given total sampling budget. We consider this problem in a game theoretic framework, where the intruder picks paths (or the network ingress point if only shortest path routing is possible) to minimize chances of detection and where the network operator chooses a sampling strategy to maximize the chances of detection. We formulate the game theoretic problem, and develop sampling schemes that are optimal in this game theoretic setting.

Utilizing optical technologies to build packet fabrics for high-capacity switches and routers has several advantages in terms of scalability, power consumption, and cost. However, several technology related problems have to be overcome to be able to use such an approach. The reconfiguration times of optical crossbars are longer than those of electronic fabrics and end-to-end clock recovery in such systems add to the reconfiguration overheads. Both these problems can limit the efficiency of optical packet fabrics. In addition, existing work on input-buffered switches mostly assumes fixed size packets (referred as envelopes in this paper). When fixed size switching is used for Internet protocol networks where packets are of variable size, the incoming packets need to be fragmented to fit the fixed size envelopes. This fragmentation can lead to, possibly large loss of bandwidth and even instability. This paper addresses all of the above issues by presenting packetization and scheduling techniques that allow optical packet fabrics to be used within switches and routers. The proposed scheme aggregates multiple packets in a single envelope and when used in combination with proper scheduling algorithms, it can provide system stability as well as bandwidth and delay guarantees. As a result of the aggregation method, the reconfiguration frequency required from the optics is reduced, facilitating the use of optical technologies in implementing packet switch fabrics.

Routing with service restorability is of much importance in Multi-Protocol Label Switched (MPLS) networks, and is a necessity in optical networks. For restoration, each connection has an active path and a link-disjoint backup path. The backup path enables service restoration upon active path failure. For bandwidth efficiency, backups may be shared. This requires that at least the aggregate backup bandwidth used on each link be distributed to nodes performing route computations. If this information is not available, sharing is not possible. Also, one scheme in use for restorability in optical networks is for the sender to transmit simultaneously on the two disjoint paths and for the receiver to choose data from the path with stronger signal. This has the advantage of fast receiver-initiated recovery upon failure but it does not allow backup sharing. In this paper, we consider the problem of efficient dynamic routing of restorable connections when backup sharing is not allowed. Our objective is to be able to route as many connections as possible for one-at-a-time arrivals and no knowledge of future arrivals. Since sharing cannot be used for achieving efficiency, the goal is to achieve efficiency by improved path selection. We show that by using the minimum-interference ideas used for nonrestorable routing, we can develop efficient algorithms that outperform previously proposed algorithms for restorable routing such as routing with the min-hop like objective of finding two disjoint paths with minimum total hop-count. We present two new and efficient algorithms for restorable routing without sharing, and one of them requires only shortest path computations. We demonstrate that both algorithms perform very well in comparison to previously proposed algorithms.

The paper presents new algorithms for dynamic routing of restorable bandwidth-guaranteed paths. We assume that connections are requested one-by-one and there is no prior knowledge of future arrivals. In order to guarantee restorability an alternate link (node) disjoint backup (restoration) path has to be determined, as well as an active path, when the connection is initiated. This joint on-line routing problem is particularly important in optical networks and in MPLS networks for dynamic provisioning of bandwidth-guaranteed or wavelength paths. A simple solution is to find two disjoint paths, but this results in excessive resource usage. Backup path bandwidth usage can be reduced by judicious sharing of backup paths amongst certain active paths while still maintaining restorability. The best sharing performance is achieved if the routing of every path in progress in the network is known to the routing algorithm at the time of a new path setup. We give a new integer programming formulation for this problem. Complete path routing knowledge is a reasonable assumption for a centralized routing algorithm, but is not often desirable, particularly when distributed routing is preferred. We show that a suitably developed algorithm which uses only aggregated information, and not per-path information, is able to perform almost as well as one using complete information. Disseminating this aggregate information is feasible using proposed traffic engineering extensions to routing protocols. We formulate the dynamic restorable bandwidth routing problem in this aggregate information scenario and develop efficient routing algorithms. The performance of our algorithm is close to the complete information bound.

We present a new algorithm for online routing of bandwidth-guaranteed multicasts where routing requests arrive one by one without any prior knowledge of future requests. A multicast routing request consists of a source, a set of receivers, and a bandwidth requirement. Two multicast applications of interest are routing of point-to-multipoint label-switched paths in multiprotocol label switched (MPLS) networks, and the provision of bandwidth-guaranteed virtual private network (VPN) services under the "hose" service model. Without prior knowledge of multicast requests, offline multicast routing algorithms cannot be used. Online algorithms are needed to handle requests arriving one by one and to satisfy as many potential future demands as possible. Our new online algorithm is based on the idea that a newly routed multicast must follow a route that does not interfere too much with network paths that may be critical to satisfy future demands. We develop a multicast tree selection heuristic based on the idea of deferred loading of certain critical links. The algorithm identifies them as links that, if heavily loaded, would make it impossible to satisfy future demands between certain ingress-egress pairs. The algorithm uses link-state information and some auxiliary capacity information for multicast tree selection and is amenable to distributed implementation. Unlike previous algorithms, our algorithm exploits any available knowledge of the network ingress-egress points of potential future demands, even though the demands themselves are unknown. It performs very well.

This paper presents a new algorithm for dynamic routing of bandwidth guaranteed multicast tunnels with failure backup. The multicast routing problem arises in many contexts such as the routing of point-to-multipoint label switched paths in Multi-Protocol Label Switched (MPLS) networks, and the provision of bandwidth guaranteed services under the "hose" model. Failure backup implies that when a multicast tree is set-up alternate backup paths be also set-up so that the multicast is unaffected by single link or node failures. For dynamic routing, the multicast routing requests arrive one-by-one and there is no a priori knowledge regarding future requests. We believe that this is the first paper that addresses the issue of multicast routing with failure backup. Each multicast request consists of a source s, a set of receivers R, and a bandwidth requirement b. Offline multicast routing algorithms cannot be used since they require a priori knowledge of all multicast tunnel requests that are to be routed. The newly developed algorithm is an on-line algorithm that generates a reserved-bandwidth multicast tree with additional backup links that make the multicast tree resilient to single element failures in the network. It shares backup bandwidth when possible and only uses link usage information obtainable in a distributed manner.

Routing with service restorability is very important in multiprotocol label switched (MPLS) networks, and is a necessity in optical networks. For restoration, each connection has an active path and a disjoint backup path. The backup path enables service restoration upon active path failure. For bandwidth efficiency, backups may be shared. This requires that at least the aggregate backup bandwidth used on each link be distributed to nodes performing route computations. If this information is not available, sharing is not possible. Also, one scheme in use for restorability in optical networks is for the sender to transmit simultaneously on the two disjoint paths and for the receiver to choose data from the path with stronger signal. This has the advantage of fast receiver-initiated recovery upon failure but it does not allow backup sharing. We consider the problem of efficient dynamic routing of restorable connections when backup sharing is not allowed. Our objective is to be able to route as many connections as possible for one-at-a-time arrivals and no knowledge of future arrivals. Since sharing cannot be used for achieving efficiency, the goal is to achieve efficiency by improved path selection. We show that by using the minimum-interference ideas used for non-restorable routing, we can develop efficient algorithms that outperform previously proposed algorithms for restorable routing such as routing with the min-hop like objective of finding two disjoint paths with minimum total hop-count. We present two new and efficient algorithms for restorable routing without sharing, and one of them requires only shortest path computations. We demonstrate that both algorithms perform very well in comparison to previously proposed algorithms.

Service restorability is a key requirement in optical networks. This means that when wavelength paths are established. both a primary path and a secondary disjoint path have to be set-up, with the secondary path being used for service restoration upon primary path failure. The secondary path may possibly be shared for efficiency. The need for secondary paths imposed by the restorability requirement has to be explicitly taken into consideration in the capacity design of optical networks. However, to our knowledge, there does not exist any algorithm for network capacity design that explicitly accounts for fast restoration requirements. The contribution of this paper is the development of algorithms for optical network capacity determination with restoration being directly taken into account. The problem is formulated as a generalization of the maximum concurrent flow problem that includes restoration requirements for the two different restoration models which are commonly used in optical networks with fast restoration requirements. We then develop fully polynomial approximation schemes that solve the restorable network capacity design problem.

This paper develops an algorithm for integrated dynamic routing of bandwidth guaranteed paths in IP over WDM networks. By integrated routing, we mean routing taking into account the combined topology and resource usage information at the IP and optical layers. Typically, routing in IP over WDM networks has been separated into routing at the IP layer taking only IP layer information into account, and wavelength routing at the optical layer taking only optical network information into account. The motivation for integrated routing is the potential for better network usage, and this is a topic which has not been been studied extensively. We develop an integrated routing algorithm that determines (1) whether to route an arriving request over the existing topology or whether it is better to open new wavelength paths. Sometimes it is better to open new wavelength paths even if it feasible to route the current demand over the existing IP topology due to previously set-up wavelength paths. 2) For routing over the existing IP-level topology, compute "good" routes. (3) If new wavelength paths are to be set-up, determine the routers amongst which new wavelength paths are to be set-up and compute "good" routes for these new wavelength paths. The performance objective is the accomodation of as many requests as possible without requiring any a priori knowledge regarding future arrivals. The route computations account for the presence or absence of wavelength conversion capabilities at optical crossconnects. We show that the developed scheme performs very well in terms of performance metrics such as the number of rejected demands.

We consider a new QoS routing problem which requires the on-line routing of a bandwidth guaranteed path along with the setting up of bypass paths for every link or node traversed by the primary active path. The bypass paths are used for fast local restoration where upon a link or node failure, the first upstream node re-establishes path continuity (with bandwidth guarantees) by switching to the bypass path for the failed node or link, The routing objective is to minimize the bandwidth usage for each connection so as optimize use of network resources while protecting against single node or link failure. Bandwidth efficiency is achieved by exploiting the potential for inter-demand and intra-demand backup bandwidth sharing. We develop a new algorithm for this routing problem which only uses aggregated link usage information (total bandwidth consumed on each link by active paths, total bandwidth consumed on each link by backup paths, and the residual bandwidths) that is easily obtainable by proposed routing protocol extensions. We show that the algorithm performs well in terms of the number of rejected requests and the total bandwidth used, The main use of this algorithm is for MPLS network routing and for wavelength routing in optical networks with wavelength conversion.

This paper presents a new algorithm for dynamic routing of bandwidth-guaranteed tunnels when tunnel routing requests arrive one-by-one and there is no a priori knowledge regarding future requests. This problem is motivated by service provider needs for fast deployment of bandwidth-guaranteed services and the consequent need in backbone networks for fast provisioning of bandwidth-guaranteed paths. Offline routing algorithms cannot be used since they require a priori knowledge of all tunnel requests that are to be routed. Instead, on-line algorithms that handle requests arriving one-by-one and that satisfy as many potential future demands as possible are needed. The newly developed algorithm is an on-line algorithm and is based on the idea that a newly routed tunnel must follow a route that does not "interfere too much" with a route that may be critical to satisfy a future demand. We show that this problem is NP-hard. We then develop a path selection heuristic that is based on the idea of deferred loading of certain "critical" links. These critical links are identified by the algorithm as links that, if heavily loaded, would make it impossible to satisfy future demands between certain ingress-egress pairs. Like min-hop routing, the presented algorithm uses link-state information and some auxiliary capacity information for path selection. Unlike previous algorithms, the proposed algorithm exploits any available knowledge of the network ingress-egress points of potential future demands even though the demands themselves are unknown.

This paper presents new algorithms for dynamic routing of restorable bandwidth-guaranteed paths. A straightforward solution for the restoration problem is to find two disjoint paths. However, this results in excessive resource usage for backup paths and does not satisfy the implicit service provider requirement of optimizing network resource utilization so as to increase the number of potential future demands that can be routed. We give an integer programming formulation for this problem which is new. Complete path routing knowledge is a reasonable assumption for a centralized routing algorithm. However, it requires maintenance of non-aggregated or per-path information which is not often desirable particularly when distributed routing is preferred. We show that a partial information scenario which uses only aggregated and not per-path information provides sufficient information for a suitably developed algorithm to be able to perform almost as well as the complete information scenario. In this partial information scenario the routing algorithm only knows what fraction of each link's bandwidth, is currently used by active paths, and is currently used by backup paths. Obtaining this information is feasible using proposed traffic engineering extensions to routing protocols. We formulate the dynamic restorable bandwidth routing problem in this partial information scenario and develop efficient routing algorithms. We compare there routing performance of this algorithm to a bound obtained using complete information. Our partial information-based algorithm performs very well and its performance in terms of the number of rejected requests is very close to the full information bound.

This paper presents a new algorithm for on-line routing of bandwidth-guaranteed multicasts where routing requests arrive one-by-one without there being any a priori knowledge of future requests. A multicast routing request consists of a source s, a set of receivers R, and a bandwidth requirement b. This multicast routing problem arises in many contexts. Two applications of interest are routing of point-to-multipoint label-switched paths in Multi-Protocol Label Switched (MPLS) networks, and the provision of bandwidth guaranteed Virtual Private Network (VPN) services under the “hose” service model [17]. Offline multicast routing algorithms cannot be used since they require a priori knowledge of all multicast requests that are to be routed. Instead, on-line algorithms that handle requests arriving one-by-one and that satisfy as many potential future demands as possible are needed. The newly developed algorithm is an on-line algorithm and is based on the idea that a newly routed multicast must follow a route that does not “interfere too much” with network paths that may be critical to satisfy future demands. We develop a multicast tree selection heuristic that is based on the idea of deferred loading of certain “critical” links. These critical links are identified by the algorithm as links that, if heavily loaded, would make it impossible to satisfy future demands between certain ingress-egress pairs. The presented algorithm uses link-state information and some auxilliary capacity information for multicast tree selection and is amenable to distributed implementation. Unlike previous algorithms, the proposed algorithm exploits any available knowledge of the network ingress-egress points of potential future demands even though the demands themselves are unknown and performs very well.

This paper presents new algorithms for dynamic routing of bandwidth guaranteed tunnels, where tunnel routing requests arrive one by one and there is no a priori knowledge regarding future requests. This problem is motivated by the service provider needs for fast deployment of bandwidth guaranteed services. Offline routing algorithms cannot be used since they require a priori knowledge of all tunnel requests that are to be rooted. Instead, on-line algorithms that handle requests arriving one by one and that satisfy as many potential future demands as possible are needed. The newly developed algorithms are on-line algorithms and are based on the idea that a newly routed tunnel must follow a route that does not "interfere too much" with a route that may he critical to satisfy a future demand. We show that this problem is NP-hard. We then develop path selection heuristics which are based on the idea of deferred loading of certain "critical" links. These critical links are identified by the algorithm as links that, if heavily loaded, would make it impossible to satisfy future demands between certain ingress-egress pairs. Like min-hop routing, the presented algorithm uses link-state information and some auxiliary capacity information for path selection. Unlike previous algorithms, the proposed algorithm exploits any available knowledge of the network ingress-egress points of potential future demands, even though the demands themselves are unknown. If all nodes are ingress-egress nodes, the algorithm can still be used, particularly to reduce the rejection rate of requests between a specified subset of important ingress-egress pairs. The algorithm performs well in comparison to previously proposed algorithms on several metrics like the number of rejected demands and successful rerouting of demands upon link failure.

With the growth in Internet access services over networks with asymmetric links such as asymmetric digital subscriber line (ADSL) and cable-based access networks, it becomes crucial to evaluate the performance of TCP/IP over systems in which the bottleneck link speed on the reverse path is considerably slower than that on the forward path. In this paper, we provide guidelines for designing network control mechanisms for supporting TCP/IP. We determine the throughput as a function of buffering, round-trip times, and normalized asymmetry (defined as the ratio of the transmission time of acknowledgment (ACK) in the reverse path to that of data packets in the forward path). We identify three modes of operation which are dependent on the forward buffer size and the normalized asymmetry, and determine the conditions under which the forward link is fully utilized. We also show that drop-from-front discarding of ACKs on the reverse link provides performance advantages over other drop mechanisms in use. Asymmetry increases the TCP already high sensitivity to random packet losses that occur on a time scale faster than the connection round-trip time. We generalize the by-now well-known relation relating the square root of the random loss probability to obtained TCP throughput, originally derived considering only data path congestion. Specifically, random loss leads to significant throughput deterioration when the product of the loss probability, the normalized asymmetry and the square of the bandwidth delay product is large. Congestion in the reverse path adds considerably to TCP unfairness when multiple connections share the reverse bottleneck link. We show how such problems can be alleviated by per-connection buffer and bandwidth allocation on the reverse path.

This paper describes a mechanism we call "SRED" (stabilized random early drop). Like RED (random early detection) SRED pre-emptively discards packets with a load-dependent probability when a buffer in a router in the Internet or an intranet seems congested. SRED has an additional feature that over a wide range of load levels helps it stabilize its buffer occupation at a level independent of the number of active connections. SRED does this by estimating the number of active connections or flows. This estimate is obtained without collecting or analyzing state information on individual flows. The same mechanism can be used to identify flows that may be misbehaving, i.e. are taking more than their fair share of bandwidth. Since the mechanism is statistical in nature, the next step must be to collect state information of the candidates for "misbehaving", and to analyze that information. We show that candidate rows thus identified indeed have a high posterior probability of taking a larger than average amount of bandwidth.

There has been much interest in using active queue management in routers in order to protect users from connections that are not very responsive to congestion notification. An Internet draft recommends schemes based on random early detection for achieving these goals, to the extent that it is possible, in a system without "per-flow" state. However, a "stateless" system with first-in/first-out (FIFO) queueing is very much handicapped in the degree to which flow isolation and fairness can be achieved. Starting with the observation that a "stateless" system is but one extreme in a spectrum of design choices and that per-flow queueing for a large number of flows is possible, we present active queue management mechanisms that are tailored to provide a high degree of isolation and fairness for TCP connections in a gigabit IP router using per-flow queueing. We show that IP flow state in a router can be bounded if the scheduling discipline used has finite memory, and we investigate the performance implications of different buffer management strategies in such a system. We show that merely using per-flow scheduling is not sufficient to achieve effective isolation and fairness, and it must be combined with appropriate buffer management strategies.

This paper considers the problem of supporting TCP, the Internet data transport protocol, over a lossy wireless link whose quality varies over time. In order to prevent throughput degradation, it is necessary to "hide" the losses and the time variations of the wireless link from TCP. A number of solutions to this problem have been proposed in previous studies, but their performance was studied on a purely experimental basis. This paper presents an approximate analysis, validated by computer simulations, for TCP performance over wireless links. The analysis provides the basis for a systematic approach to supporting TCP over wireless links. The specific case of a Rayleigh-faded wireless link and automatic repeat request-based link-layer recovery is considered for the purpose of illustration. The numerical results presented for this case show that a simple solution, that of using an appropriately designed link-layer error-recovery scheme, prevents excessive deterioration of TCP throughput on wireless links.

We propose a scheme for transmission of variable bit rate (VBR) compressed video for interactive applications using the explicit-rate congestion-control mechanisms proposed for the available bit rate (ABR) service in asynchronous transfer mode networks. Compressed video is inherently bursty, with rate fluctuations over both short and long time scales. This source behavior can be accommodated by the ABR service, since the explicit-rate scheme allows sources to request varying amounts of bandwidth over time. Moreover, when the bandwidth demand cannot be met, the network provides feedback indicating the bandwidth currently available to a connection. In our scheme, the video source rate is matched to the available bandwidth by modifying the quantization level used during compression. We use trace-driven simulations to examine how effective the enhanced explicit-rate scheme is in "rate matching" between the network and the source and the effect on end-to-end delay. We also look at the sensitivity of the proposed scheme to the estimates of the network round-trip times and to inaccuracies in the rate requests made by sources.

The objective of research in fair queueing schemes has been to efficiently emulate a fluid-flow generalized (weighted) processor sharing (GPS) system as closely as possible. A primary motivation for the use of fair queueing has been its use as a means of providing bandwidth guarantees and as a consequence end-to-end delay bounds for traffic with bounded burstiness. The rate guarantees translate to scheduling weights which are set when admission control is done. A consequence of fair queueing systems closely emulating GPS is that when one or more connections are not back-logged, any "excess" bandwidth is distributed to back-logged connections in proportion to their weights. However weights are set based on the long-term requirements of traffic flows and not in any state-dependent manner that reflects instantaneous needs. We question the notion that the queueing system should closely emulate a GPS system. Instead of emulating GPS, we propose three modified scheduling schemes which preserve the rate guarantees of fair queueing (and hence preserve deterministic delay bounds) but adaptively redistribute the excess bandwidth such that either losses are reduced or delays equalized. We compare the performance of the proposed schemes to that of fair queueing using different traffic sources such as voice and video, as well as sources which have aggregate long-range dependent behavior. We find that the proposed schemes, in comparison to packet GPS (PGPS), reduce packet losses and curtail the tails of delay distributions for real-time traffic and hence permit the use of significantly smaller playout buffers for the same network load.

In this paper, we investigate the extent to which fair queueing (and its variants), in conjunction with appropriately tailored buffer management schemes, can be used to achieve the following goals for TCP traffic: (1) alleviate the inherent unfairness of TCP towards connections with long round-trip times, (2) provide isolation when connections using different TCP versions share a bottleneck link (3) provide protection from TCP-unfriendly traffic sources (which might include TCP ACKs since they are not loss-responsive) and misbehaving users, (4) alleviate the effects of ACK compression in the presence of two-way traffic, (5) prevent users experiencing ACK loss (which causes their traffic to be bursty) from significantly affecting other connections, (6) provide low latency to interactive connections which share a bottleneck with "greedy" connections without reducing overall link utilization. The paper proposes new buffer management schemes to be used in conjunction with fair queueing, so as to achieve the above goals for TCP, and compares the performance of the proposed schemes to the performance obtained using random early detection (RED) for packet dropping.

The ability to provide differentiated services to users with widely varying requirements is becoming increasingly important, and Internet Service Providers would like to provide these differentiated services using the same shared network infrastructure. The key mechanism, that enables differentiation in a connectionless network, is the packet classification function that parses the headers of the packets, and after determining their context, classifies them based on administrative policies or real-time reservation decisions. Packet classification, however, is a complex operation that can become the bottleneck in routers that try to support gigabit link capacities. Hence, many proposals for differentiated services only require classification at lower speed edge routers and also avoid classification based on multiple fields in the packet header even if it might be advantageous to service providers. In this paper, we present new packet classification schemes that, with a worst-case and trafficindependent performance metric, can classify packets, by checking amongst a few thousand filtering rules, at rates of a million packets per second using range matches on more than 4 packet header fields. For a special case of classification in two dimensions, we present an algorithm that can handle more than 128K rules at these speeds in a traffic independent manner. We emphasize worst-case performance over average case performance because providing differentiated services requires intelligent queueing and scheduling of packets that precludes any significant queueing before the differentiating step (i.e., before packet classification). The presented filtering or classification schemes can be used to classify packets for security policy enforcement, applying resource management decisions, flow identification for RSVP reservations, multicast look-ups, and for source-destination and policy based routing. The scalability and performance of the algorithms have been demonstrated by implementation and testing in a prototype system. 1

End-to-end data transport protocols have two main functions: error recovery and congestion control. The information required by the sender to perform these functions is provided by acknowledgements (ACKs) from the receiver. The Internet transport protocol, TCP/IP, uses cumulative acknowledgements (CACKs), which provide a robust but minimal mechanism for error recovery which is inadequate for heterogeneous networks with random loss. Furthermore, TCP's congestion control mechanism is based on counting ACKs, and is therefore vulnerable to loss of ACKs on the reverse path, particularly when the latter may be slower than the forward path, as in asymmetric networks. The contributions of this paper are as follows:(a) We show that a simple enhancement of CACK provides sufficient information for end-to-end congestion control. We term this ACK format total ACKs (TACKs).(b) We devise a novel ACK format that uses TACKs for congestion control, and negative ACKs (NACKs) for efficient error recovery. Typically, the main concern with NACKs is that of robustness to ACK loss, and we address this using an implementation that provides enough redundancy to provide such robustness.(c) We use the TACK+NACK acknowledgement format as the basis for a new transport protocol that provides efficient error recovery and dynamic congestion control. The protocol provides large performance gains over TCP in an environment with random loss, and is robust against loss of ACKs in the reverse path. In particular, the protocol gives high throughput upto a designed level of random loss, independent of the bandwidth-delay product. This is in contrast to TCP, whose throughput deteriorates drastically if the random loss probability is higher than the inverse square of the bandwidth-delay product.

The authors examine the transport and storage of video compressed with a variable bit rate (VBR). They focus primarily on networked video, although they also briefly consider other applications of VBR video, including satellite transmission (channel sharing), playback of stored video, and wireless transport. Packet video research requires careful integration between the network and the video systems; however, a major stumbling block has resulted because commonly used terms are often interpreted differently by the video and networking communities. The paper then, has two main goals: (i) to clarify the definitions of terms that are often used with different meaning by networking and video-coding researchers and (ii) to explore the tradeoffs entailed by each of the various modalities of VBR transmission (unconstrained, shaped, constrained, and feedback). In particular, they evaluate the tradeoff among the advantages (better video quality, less delay, and more calls) that were identified by early proponents of VBR video transmission. An underlying theme of this paper is that increased interaction between the video and network design has potential for improving overall decoded video quality without changing the network capacity.

We propose a scheme for transmission of variable-bit-rate compressed video over ATM networks using the explicit-rate congestion control mechanisms proposed for the available bit rate (ABR) service. Compressed video is inherently bursty with rate fluctuations over both short and long time scales. We feel that this source behavior can naturally take advantage of the ABR service, since the ABR explicit-rate schemes allow sources to request varying amounts of bandwidth over time, while reserving a minimum for the entire duration of the connection. Moreover when the bandwidth demand cannot be met, the network provides feedback indicating the bandwidth currently available to a connection. This information can be used to match the video source rate to the available bandwidth by modifying the quantization level used during compression. We use trace driven simulations to examine how effective the enhanced explicit rate scheme is in "rate matching" between the network and the source and the effect on end-end delay. We also look at the sensitivity of the proposed scheme to the estimates of the network round-trip times and to inaccuracies in the rate requests made by sources.

With the envisaged growth in Internet access services over networks with asymmetric links such as asymmetric digital subscriber line (ADSL) and hybrid fiber coax (HFC), it becomes crucial to evaluate the performance of window-based protocols over systems in which the reverse link is considerably slower than the forward link. Even if the actual bandwidth asymmetry is moderate, high effective asymmetries can result because of bidirectional traffic. Our objective is to determine, whether TCP/IP performs reasonably in a setting in which the reverse link is the primary bottleneck. Our main results are as follows. (1) For both the prevalent Tahoe version with Fast Retransmit and the Reno version of TCP we determine the throughput as a function of buffering, round-trip times and normalized asymmetry (taken to be the ratio of the transmission time of ACKs in the reverse path to that of data packets in the forward path). We identify three modes of operation which are dependent on the forward buffer sizes and the normalized asymmetry. (2) Asymmetry increases the TCP's already high sensitivity to random packet losses that might be caused by transient bursts in real-time traffic. Specifically, random loss leads to significant throughput deterioration when the product of the loss probability, the asymmetry and the square of the bandwidth delay product is large. (3) Congestion in the reverse path adds considerably to the TCP's unfairness when multiple connections share the reverse link. Link bandwidth sharing is unfair even for connections with identical round-trip times and hence use of per connection buffer allocation on the reverse path appears essential.

Most of the studies of feedback-based flow and congestion control consider only persistent sources which always have data to send. However, with the rapid growth of Internet applications built on TCP/IP such as the World Wide Web and the standardization of traffic management schemes such as Available Bit Rate (ABR) in Asynchronous Transfer Mode (ATM) networks, it is essential to evaluate the performance of feedback-based protocols using traffic models which are specific to dominant applications. This paper presents a method for analysing feedback-based protocols with a Web-user-like input traffic where the source alternates between "transfer" periods followed by "think" periods. Our key results, which are presented for the TCP protocol, are:(1) The goodputs and the fraction of time that the system has some given number of transferring sources are insensitive to the distributions of transfer (file or page) sizes and think times except through the ratio of their means. Thus, apart from network round-trip times, only the ratio of average transfer sizes and think times of users need be known to size the network for achieving a specific quality of service.(2) The Engset model can be adapted to accurately compute goodputs for TCP and TCP over ATM, with different buffer management schemes. Though only these adaptations are given in the paper, the method based on the Engset model can be applied to analyze other feedback systems, such as ATM ABR, by finding a protocol specific adaptation. Hence, the method we develop is useful not only for analysing TCP using a source model significantly different from the commonly used persistent sources, but also can be useful for analysing other feedback schemes.(3) Comparisons of simulated TCP traffic to measured Ethernet traffic shows qualitatively similar autocorrelation when think times follow a Pareto distribution with infinite variance. Also, the simulated and measured traffic have long range dependence. In this sense our traffic model, which purports to be Web-user-like, also agrees with measured traffic.

This paper examines the performance of TCP/IP, the Internet data transport protocol, over wide-area networks (WANs) in which data traffic could coexist with real-time traffic such as voice and video. Specifically, we attempt to develop a basic understanding, using analysis and simulation, of the properties of TCP/IP in a regime where: (1) the bandwidth-delay product of the network is high compared to the buffering in the network and (2) packets may incur random loss (e.g., due to transient congestion caused by fluctuations in real-time traffic, or wireless links in the path of the connection). The following key results are obtained. First, random loss leads to significant throughput deterioration when the product of the loss probability and the square of the bandwidth-delay product is larger than one. Second, for multiple connections sharing a bottleneck link, TCP is grossly unfair toward connections with higher round-trip delays. This means that a simple first in first out (FIFO) queueing discipline might not suffice for data traffic in WANs. Finally, while the Reno version of TCP produces less bursty traffic than the original Tahoe version, it is less robust than the latter when successive losses are closely spaced. We conclude by indicating modifications that may be required both at the transport and network layers to provide good end-to-end performance over high-speed WANs.

This paper proposes the use of a "drop from front" scheme for improving TCP performance in high bandwidth-delay product networks. In particular, for "TCP over ATM" we compare the performance when drop from front is used at the output port of ATM switches with the performance under tail drop, its variations, and with variations of random early detection (RED). In drop from front, when a cell arrives at a full buffer, the cell closest to being transmitted is dropped, thus creating space for the arriving cell. This policy causes duplicate acknowledgements to be sent one whole buffer drain time earlier than is the case under tail drop. These quicker duplicate acknowledgements cause TCP with fast retransmit to recognize losses faster and invoke congestion control actions earlier than would be the case under tail drop. This earlier reaction translates into considerable performance improvement. Hence, drop from front successfully utilizes the ability of TCP with fast retransmit to quickly recognize and react to congestion information (at the third repeat acknowledgement, as opposed to time-out). Roughly, the earlier action by the sources causes the congestion not to grow quite as severe, which prevents later over-reaction by the sources, and thus increases throughput.

Traffic from video services is expected to be a substantial portion of the traffic carried by emerging broadband integrated networks. For variable bit rate (VBR) coded video, statistical source models are needed to design networks that achieve acceptable picture quality at minimum cost and to design traffic shaping and control mechanisms. For video teleconference traffic Heyman et al. (1992) showed that traffic is sufficiently accurately characterized by a multistate Markov chain model that can be derived from three traffic parameters (mean, correlation, and variance). The present authors describe modeling results for sequences with frequent scene changes (the previously studied video teleconferences have very little scene variation) such as entertainment television, news, and sports broadcasts. The authors analyze 11 long sequences of broadcast video traffic data. Unlike video teleconferences, the different sequences studied have different details regarding distributions of cells per frame. The authors present source models applicable to the different sequences and evaluate their accuracy as predictors of cell losses in asynchronous transfer mode (ATM) networks. The modeling approach is the same for all of the sequences but use of a single model based on a few physically meaningful parameters and applicable to all sequences does not seem to be possible.

The authors explore the influence of long-range dependence in broadband traffic engineering. The classification of stochastic processes {X/sub t/} into those with short or long-range dependence is based on the asymptotic properties of the variance of the sum S/sub m/=X/sub 1/+X/sub 2/+/spl middot//spl middot//spl middot/+X/sub m/. Suppose this process describes the number of packets (or ATM cells) that arrive at a buffer; X/sub t/ is the number that arrive in the tth time slice (e.g., 10 ms). We use a generic buffer model to show how the distribution of S/sub m/ (for all values of m) determines the buffer occupancy. From this model we show that long-range dependence does not affect the buffer occupancy when the busy periods are not large. Numerical experiments show this property is present when data from four video conferences and two entertainment video sequences (which have long-range dependence) are used as the arrival process, even when the transmitting times are long enough to make the probability of buffer overflow 0.07. We generated sample paths from Markov chain models of the video traffic (these have short-range dependence). Various operating characteristics, computed over a wide range of loadings, closely agree when the data trace and the Markov chain paths are used to drive the model. From this, we conclude that long-range dependence is not a crucial property in determining the buffer behavior of variable bit rate (VBR)-video sources.

The main contributions of this paper are two-fold. First, we prove fundamental, similarly behaving lower and upper bounds, and give an approximation based on the bounds, which is effective for analyzing ATM multiplexers, even when the traffic has many, possibly heterogeneous, sources and their models are of high dimension. Second, we apply our analytic approximation to statistical models of video teleconference traffic, obtain the multiplexing system's capacity as determined by the number of admissible sources for given cell loss probability, buffer size and trunk bandwidth, and, finally, compare with results from simulations, which are driven by actual data from coders. The results are surprisingly close. Our bounds are based on Large Deviations theory. Our approximation has two easily calculated parameters, one is from Chernoff's theorem and the other is the system's dominant eigenvalue. A broad range of systems are analyzed and the time for analysis in each case is a fraction of a second.

Recent measurement studies in Bellcore and elsewhere have convincingly established the presence of statistical self similarity in high-speed network traffic. What is less clear --- and as such the subject of intense current research --- is the impact of the self-similarity on network performance. Given that traditional queueing models of network performance do not model self-similarity, the validity of traditional models to predict network performance would be supported if it is shown that self-similarity does not have measurable impacts on performance. On the other hand, if the converse of this assertion were true, it would have significant impacts on the way networks are designed and analyzed, as well as open up new areas of research in mathematical modeling, queueing analysis, network design and control. The issues addressed in this session are therefore of fundamental importance in high-speed network research.Given that queueing behavior is dominated by traffic characteristics over the time scales of busy periods, it has been argued that phenomena that span many time scales, such as self-similarity, should not be relevant for queueing performance. However, the paper by Narayan, Erramilli and Willinger presents evidence that for data traffic, the long range dependence (which is related to the self-similarity in traffic) can dominate queueing behavior under a variety of conditions. Specifically, it is shown based on a series of carefully designed simulation experiments with actual traffic traces, that the queueing behavior with actual traces is considerably heavier than that predicted by traditional theory, and that these differences are attributable to long range dependence. The paper by Heyman and Lakshman investigates modeling of video traffic to predict cell loss performance with finite buffer systems, and they conclude that long-range dependence is not a crucial property in determining the finite buffer behavior of video conferences. In particular, a Markov chain model that does not model long-range dependence is nevertheless able to reproduce various operating characteristics over a wide range of loadings obtained with the actual video trace. Mukherjee, Adas, Klivansky and Song investigate the performance impacts of short-range and long-range correlation components using simulations with a fractional ARIMA model. They also discuss a strategy to provide quality of service guarantees with long range dependent traffic, as well as recent results on NSFNET traffic. Finally, the paper by Li describes a frequency-domain based analytical tool that matches a special class of Markov chains with traces exhibiting a variety of characteristics, including long-range dependence. Good agreement is reported between analytical queueing solutions of the matched Markov chains, and simulation results obtained video and data traffic traces.This session therefore brings together a wide range of viewpoints on this issue. Resolution of such seemingly conflicting conclusions lies in the fact that in performance analysis, answers sensitively depend on the specific details of a problem. Thus the proper question to ask is not whether or not self-similarity matters in queueing; but under what conditions it matters. Likewise, the question to ask is not whether a class of models is invalid; but to identify the conditions under which traditional Markov or self-similar traffic models are expected to be valid. Finally, given an understanding of statistical features that are relevant to a given problem, the challenge is to model these accurately and parsimoniously so that the model is useful in practical performance analysis. The work outlined in the abstracts below adds significantly to our understanding of these issues.

No abstract available.

The main contributions of this paper are two-fold. First, we prove fundamental, similarly behaving lower and upper bounds, and give an approximation based on the bounds, which is effective for analyzing ATM multiplexers, even when the traffic has many, possibly heterogeneous, sources and their models are of high dimension. Second, we apply our analytic approximation to statistical models of video teleconference traffic, obtain the multiplexing system's capacity as determined by the number of admissible sources for given cell-loss probability, buffer size and trunk bandwidth, and, finally, compare with results from simulations, which are driven by actual data from coders. The results are surprisingly close. Our bounds are based on large deviations theory. The main assumption is that the sources are Markovian and time-reversible. Our approximation to the steady-state buffer distribution is called Chenoff-dominant eigenvalue since one parameter is obtained from Chernoffs theorem and the other is the system's dominant eigenvalue. Fast, effective techniques are given for their computation. In our application we process the output of variable bit rate coders to obtain DAR(1) source models which, while of high dimension, require only knowledge of the mean, variance, and correlation. We require cell-loss probability not to exceed 10/sup -6/, trunk bandwidth ranges from 45 to 150 Mb/s, buffer sizes are such that maximum delays range from 1 to 60 ms, and the number of coder-sources ranges from 15 to 150. Even for the largest systems, the time for analysis is a fraction of a second, while each simulation takes many hours. Thus, the real-time administration of admission control based on our analytic techniques is feasible.>

We study the effectiveness of different parallel architectures for achieving the high throughputs and low latencies needed in processing signaling protocols for high speed networks. A key performance issue is the trade off between the load balancing gains and the call record management overhead. Arranging processors in large groups potentially yields higher load balancing gains but also incurs higher overhead in maintaining consistency among the replicated copies of the call records. We study this tradeoff and its impact on the design of protocol processing systems for two generic classes of parallel architectures, namely, shared memory and distributed memory architectures. In shared memory architectures, maintaining a common message queue in the shared memory can provide the maximal load balancing gains. We show, however, in order to optimize performance it is necessary to organize the processors in small groups since large groups result in higher call record management overhead. In distributed memory architectures with each processor maintaining its own message queue there is no inherent provision for load balancing. Based on a detailed simulation analysis we show that organizing the processors into small groups and using a simple distributed load balancing scheme yields modest performance gains even after call record management overheads are taken into account. We find that the common message queue architecture outperforms the distributed architecture in terms of lower response time due to its improved load balancing capability. Finally, we do a fault-tolerance analysis with respect to the call-record data structure. Using a simple failure recovery model of the processors and the local memory, we show that in the case of shared memory architecture, the availability is also optimized when processors are organized in small groups. This is because when comparing architectures the higher call record management overhead incurred for larger group sizes must be accounted for as system unavailability.

The authors study the effectiveness of different parallel architectures for achieving high throughputs necessary for processing signaling traffic in high speed networks. They consider shared memory and distributed memory parallel architectures for processing signaling messages. A key performance issue is the trade-off between load balancing gains and call record management overhead; arranging processors in large groups potentially yields higher load balancing gains but also incurs higher overhead in maintaining consistency amongst the replicated copies of the call records. They study this tradeoff and its impact on the choice of optimal parallel architectures for protocol processing. The results show that for shared memory architectures, which provide the maximal load balancing gains, organizing the processors in small groups optimizes the performance for a wide range of traffic loads. For distributed memory architectures, which do not inherently provide any load balancing, organizing the processors into small groups and using a simple distributed load balancing scheme yields modest performance gains even after call record management overheads are taken into account. A good architecture is a hybrid one using a distributed architecture in which each node is a small processing group with shared memory.>

Traffic from video services is expected to be a substantial portion of the traffic carried by emerging broadband integrated networks. For variable bit rate (VBR) coded video, statistical source models are needed to design networks that achieve acceptable picture quality at minimum cost, and to design traffic shaping and control mechanisms. For video teleconference traffic, the authors have previously shown that traffic is sufficiently accurately characterized by a multi-state Markov chain model that can be derived from three traffic parameters (mean, correlation, and variance). In the present paper, they describe modeling results for sequences with frequent scene changes (the previously studied video teleconferences have very little scene variation) such as entertainment television, news, and sports broadcasts. They analyze eleven long sequences of broadcast video traffic data. Unlike video teleconferences, the different sequences studied have different details regarding distributions of cells per frame. The authors present source models applicable to the different sequences and evaluate their accuracy as predictors of cell losses in asynchronous transfer mode (ATM) networks.>

The viability of distributed control restoration using digital cross-connect systems (DCS) depends on its capability for restoring services within specified time requirements, and its economics for providing restoration compared to other alternatives. The authors report a Bellcore study for the impact of the DCS architecture on distributed restoration. This study concludes that currently proposed distributed control DCS self-healing schemes may not meet the 2 second restoration objective for large metropolitan local exchange carrier's networks, regardless of the distributed algorithm used, if the present DCS system architecture which uses serial message processing and serial path cross-connection remains unchanged. They also discuss several DCS architecture enhancement options, including a parallel processing/cross-connect DCS architecture, which may improve the service restoration time.>

Presents efficient algorithms for collecting information distributed among indistinguishable (anonymous) processors while performing certain operations on the information being collected. The efficiency objective is to minimize the communication-delay product and to obtain trade-offs between the two. The main contribution of the paper is a new efficient algorithm for performing sumlike operations (such as Abelian group operations and elementary symmetric functions) and the use of metrically regular graphs (which include the widely used hypercube interconnections) for information dissemination in distributed computations. The best algorithm has a communication-delay product of O(Nlog/sup 3/ N) (for W nodes), and obtaining an optimal /spl Omega/(Nlog/sup 2/N) algorithm remains an open problem.>

The authors present a scheme for scheduling cell-transmissions in an ATM switch capable of atomic multicasts. In an atomic multicast, partial transmissions to subsets of the requested output ports are not allowed. In any transmission slot, a cell at an input port is either successfully (without output contention) transmitted to all requested destinations or it is not transmitted at all. Scheduling is needed because many cells (due to the uncoordinated nature of their arrivals at the switch input ports) can request transmission to the same switch output port at the same time even though the switch may not have the ability to simultaneously satisfy all these requests. The problem is to devise an implementable scheme for scheduling atomic multicast requests such that all requests present at the beginning of a scheduling interval are satisfied in a minimum number of cell transmission slots. However, finding this minimum transmission schedule is equivalent to finding the minimum vertex coloring of a "contention graph" derived from the input requests. Since finding the minimum vertex coloring is an NP-hard problem, it is not feasible to find the minimum schedule. They present a scheduling scheme which uses a heuristic coloring algorithm with a known upper bound on the number of transmission slots used. This scheme can also schedule a mix of request types (unicasts, atomic and non-atomic multicasts). They describe two methods for photonic implementation of the scheduler and also methods to incorporate fairness and priorities.>

A well-known algorithm for updating multiple copies is the Thomas majority consensus algorithm. This algorithm, before performing an update, needs to obtain permission from a majority of the nodes in the system. We study the response-time behavior of a symmetric (each node seeks permission from the same number of other nodes and each node receives requests for update permission from the same number of other nodes) distributed update-synchronization algorithm where nodes need to obtain permission from only O(/spl radic/N) (N being the number of database copies) other nodes before performing an update. The algorithm we use is an adaptation of Maekawa's O(/spl radic/N) distributed mutual exclusion algorithm to multiple-copy update-synchronization. This increase in the efficiency of the update-synchronization algorithm enhances performance in two ways. First, the reduction in transaction service time reduces the response time. Second, for a given arrival rate of transactions, the decrease in response time reduces the number of waiting transactions in the system. This reduces the probability of conflict between transactions. To capture the interaction between the probability of conflict and the transaction response time, we define a new measure called the conflict response-time product. Based on the solution of a queueing model we show that optimizing this measure yields a different and more appropriate choice of system parameters than simply minimizing the mean transaction response time.>

The authors present a scheme for smoothing delay-sensitive traffic offered to an asynchronous transfer mode (ATM) network. They outline such a smoothing scheme, which, when applied to variable bit rate (VBR) coded video traffic, is both optimal and avoids violation of delay constraints. The scheme is based on the assumption that recent behavior of the traffic stream can be used to predict the behavior of the input stream in the near future. The effectiveness of the scheme was evaluated by simulation. The conclusion is that even with a rudimentary forecasting rule, smoothing can lower cell losses and increase the effectiveness of VBR schemes for video transmission.>

Source modeling and performance issues are studied using a long (30 min) sequence of real video teleconference data. It is found that traffic periodicity can cause different sources with identical statistical characteristics to experience differing cell-loss rates. For a single-stage multiplexer model, some of this source-periodicity effect can be mitigated by appropriate buffer scheduling and one effective scheduling policy is presented. For the sequence analyzed, the number of cells per frame follows a gamma (or negative binomial) distribution. The number of cells per frame is a stationary stochastic process. For traffic studies, neither an autoregressive model of order two nor a two-state Markov chain model is good because they do not model correctly the occurrence of frames with a large number of cells, which are a primary factor in determining cell-loss rates. The order two autoregressive model, however, fits the data well in a statistical sense. A multistate Markov chain model that can be derived from three traffic parameters is sufficiently accurate for use in traffic studies.>

Decentralized consensus protocols are characterized by successive rounds of message interchanges. Protocols which achieve a consensus in one round of message interchange require O(N2) messages, whereNis the number of participants. A communication scheme based on finite projective planes is presented which requires only O(N√N) messages for each round. Using this communication scheme, decentralized consensus protocols which achieve a consensus within two rounds of message interchange are developed. The protocols are symmetric, and the communication scheme does not impose any hierarchical structure. The scheme is illustrated using blocking and nonblocking commit protocols, decentralized extrema finding, and computation of the sum function.