It has become increasingly clear that recommender systems that overly focus on short-term engagement prevents users from exploring diverse interests, ultimately hurting long-term user experience. To tackle this challenge, numerous diversification algorithms have been proposed as the final stage of recommender systems. These algorithms typically rely on measures of item similarity, aiming to maximize the dissimilarity across items in the final set of recommendations. However, in this work, we demonstrate the benefits of going beyond item-level similarities by utilizing higher-level user understanding-specifically, user intents that persist across multiple interactions or recommendation sessions-in diversification. Our approach is motivated by the observation that user behaviors on online platforms are largely driven by their underlying intents. Therefore, final recommendations should ensure that a diverse set of user intents is accurately represented. While user intent has primarily been studied in the context of search, it is less clear how to incorporate real-time dynamic intent predictions in recommender systems.

In this paper we present a data-driven framework for detecting machine-generated traffic based on the IP size, i.e., the number of users sharing the same source IP. Our main observation is that diverse machine-generated traffic attacks share a common characteristic: they induce an anomalous deviation from the expected IP size distribution. We develop a principled framework that automatically detects and classifies these deviations using statistical tests and ensemble learning. We evaluate our approach on a massive dataset collected at Google for 90 consecutive days. We argue that our approach combines desirable characteristics: it can accurately detect fraudulent machine-generated traffic; it is based on a fundamental characteristic of these attacks and is thus robust (e.g., to DHCP re-assignment) and hard to evade; it has low complexity and is easy to parallelize, making it suitable for large-scale detection; and finally, it does not entail profiling users, but leverages only aggregate statistics of network traffic.

In this paper, we consider the problem of blocking malicious traffic on the Internet via source-based filtering. In particular, we consider filtering via access control lists (ACLs): These are already available at the routers today, but are a scarce resource because they are stored in the expensive ternary content addressable memory (TCAM). Aggregation (by filtering source prefixes instead of individual IP addresses) helps reduce the number of filters, but comes also at the cost of blocking legitimate traffic originating from the filtered prefixes. We show how to optimally choose which source prefixes to filter for a variety of realistic attack scenarios and operators' policies. In each scenario, we design optimal, yet computationally efficient, algorithms. Using logs from Dshield.org, we evaluate the algorithms and demonstrate that they bring significant benefit in practice.

In this paper, we study the problem of forecasting attack sources based on past attack logs from several contributors. We formulate this problem as an implicit recommendation system, and we propose a multi-level prediction model to solve it. Our model evaluates and combines various factors, namely: (i) attacker-victim history using time-series, (ii) attackers and/or victims interactions using neighborhood models and (iii) global patterns using singular value decomposition. We evaluate our combined method, referred to as Blacklisting Recommendation System (or BRS), on one month of logs from Dshield, and we demonstrate that it improves significantly the prediction rate over state-of-the-art methods as well as the robustness against poisoning attacks. Along the way, we analyze the Dshield dataset, and we reveal dominant patterns of malicious traffic.

Streaming applications will rapidly develop and contribute a significant amount of traffic in the near future. A problem, scarcely addressed so far, is how to distribute video streaming traffic from one source to all nodes in an urban vehicular network. This problem significantly differs from previous work on broadcast and multicast in ad hoc networks because of the highly dynamic topology of vehicular networks and the strict delay requirements of streaming applications. We present a solution for intervehicular communications, called Streaming Urban Video (SUV), that 1) is fully distributed and dynamically adapts to topology changes, and 2) leverages the characteristics of streaming applications to yield a highly efficient, cross-layer solution.

A widely used defense practice against malicious traffic on the Internet is through blacklists: lists of prolific attack sources are compiled and shared. The goal of blacklists is to predict and block future attack sources. Existing blacklisting techniques have focused on the most prolific attack sources and, more recently, on collaborative blacklisting. In this paper, we formulate the problem of forecasting attack sources (also referred to as "predictive blacklisting") based on shared attack logs, as an implicit recommendation system. We compare the performance of existing approaches against the upper bound for prediction and we demonstrate that there is much room for improvement. Inspired by the recent NetFlix competition, we propose a multi-level collaborative filtering model that is adjusted and tuned specifically for the attack forecasting problem. Our model captures and combines various factors namely: attacker-victim history (using time-series) and attackers and/or victims interactions (using neighborhood models). We evaluate our combined method on one month of logs from Dshield.org and demonstrate that it improves significantly the prediction rate over state-of-the-art methods as well as the robustness against poisoning attacks.

How can we protect the network infrastructure from malicious traffic, such as scanning, malicious code propagation, and distributed denial-of-service (DDoS) attacks? One mechanism for blocking malicious traffic is filtering: access control lists (ACLs) can selectively block traffic based on fields of the IP header. Filters (ACLs) are already available in the routers today but are a scarce resource because they are stored in expensive ternary content addressable memory (TCAM). In this paper, we develop, for the first time, a framework for studying filter selection as a resource allocation problem. Within this framework, we study four practical cases of source address/prefix filtering, which correspond to different attack scenarios and operator's policies. We show that filter selection optimization leads to novel variations of the multidimensional knapsack problem and we design optimal, yet computationally efficient, algorithms to solve them. We also evaluate our approach using data from Dshield.org and demonstrate that it brings significant benefits in practice. Our set of algorithms is a building block that can be immediately used by operators and manufacturers to block malicious traffic in a cost-efficient way.

Streaming applications will rapidly develop and contribute a significant amount of traffic in the near future. A problem, scarcely addressed so far, is how to support streaming traffic in vehicular networks (VANETs). This problem significantly differs from previous work on broadcast and multicast in ad hoc networks, because of the highly-dynamic topology of VANETs and the strict delay requirements of streaming applications. Our solution, completely relies on inter-vehicular communication for the distribution of multimedia content in a urban environment and it has the following appealing features: (i) it is fully distributed and dynamically adapts to topology changes; (ii) it leverages the characteristics of streaming applications to yield a highly-efficient, cross-layer solution. After optimally dimensioning the network system, we compare the performance of our solution against theoretical results for broadcast capacity in multihop networks.

In this paper we propose PiggyCode, a network-coding based scheme specifically designed to enhance TCP performance over IEEE 802.11 multi-hop wireless networks. The root of this approach is a network coding module operating between the network and the MAC layer. Each node running PiggyCode encodes, whenever it is possible, TCP-DATA and TCP-ACK packets belonging to the same information flow. The coding approach is conceptually analogous to piggyback the TCP- ACK packet within the TCP-DATA packet, with the substantial difference that, by performing network coding operations, the actual packet size remains unchanged. The proposed scheme is simple and effective. It leverages the benefits of network coding in the wireless environment, to jointly reduce the overall number of transmissions on the channel and speed up the delivery process of TCP-ACK packets, thus achieving significant improvements in terms of TCP performance.