Early decision-making at the network device is crucial for network security. This entails moving beyond traditional forwarding functions towards more intelligent network devices. One possible strategy to speed up decision-making is to incorporate intelligent traffic analysis functionality directly into the data plane, such that traffic can be analyzed before forwarding. Integrating Artificial Intelligence/Machine Learning (AI/ML) models into the data plane enables quicker processing and reduced reliance on the control plane. We address the development of an AI/ML-driven Intrusion Detection System (IDS) where network devices autonomously make security decisions or defer to an expert oracle, relying on in-band and off-band traffic analysis. Programmable devices, such as those using P4, are essential to enable these functionalities and allow for network device retraining to adapt to changing traffic patterns. We introduce HALIDS, a prototype for in-band AI/ML-IDS using P4, complemented with off-band oracles which support in-network ML-driven classification with more confident classifications, targeting an active learning logic for more accurate in-band analysis. We implement HALIDS using the open source software switch BMv2, and show its operation with real traffic traces publicly available. Evaluation results show that the proposed system is sound and could be implemented in a real network as an efficient and highly adaptive security mechanism.

State-of-the-art Data Center Networks (DCNs) adopt fat-tree topologies based on the original Clos networks due to their non-blocking and constant bisection bandwidth characteristics. Massive Scale Data Center networks comprise thousands of switches, and demand deploying a routing protocol to build Equal Cost Multi-Path connectivity among end nodes. Routing protocol overhead is one of the foremost important parameters to consider in DCN design. Existing approaches to measuring this overhead are based on large emulations or simulations that capture the packets exchanged under certain scenarios and then process them to obtain this measurement. This requires a lot of development effort and may not always be possible at large scales. In this work, using an analytical approach, we analyze the control plane overhead for BGP in the data center. Our proposal manages to measure the overhead injected by BGP in failure and recovery scenarios without the need to develop and deploy large emulations or simulations. The main idea is to use an analytical methodology to obtain mathematical formulas from the expected behavior of BGP. The results show that it is possible to adequately model the load injected by BGP under a set of failure and recovery scenarios. The validation was performed in a simulated environment over the ns-3 simulator.

Several data centers adopt fat-tree topologies, where high bisection bandwidth is achieved by interconnecting commodity hardware and by using specific routing solutions. These solutions, which include protocol implementations and configurations, are difficult to evaluate and test both for the density of fat-trees and for the complexity of the protocols. Also, since most issues show up only when a fault happens, it is unfeasible to perform such tests in a production environment. Additionally, the lack of standard testing procedures motivates an effort in developing solutions for such a critical task. In this paper, we propose a methodology devised for testing fat-tree routing protocol implementations. It adopts a wall-clock independent method to establish metrics, which permits normalizing the results of different routing protocol implementations independently from the execution environment. The methodology is implemented by Sibyl, a software framework developed to perform repeatable tests on arbitrary fat-tree topologies automatically. Sibyl also provides a set of tools to analyze the results and investigate implementation behaviors. We evaluate the methodology and Sibyl in three use cases. Such use cases witness a wide spectrum of situations where Sibyl is effective for analyzing, comparing, developing, and debugging routing protocol implementations.

The exploding volume of network traffic and expanding Quality of Service (QoS) requirements from emerging multimedia and interactive applications in the last decade demand improved internet traffic engineering techniques. In particular, traffic classification and packet marking became essential components for end-to-end QoS assurance of different traffic classes. In this paper we present WekaTIE, a TIE (traffic Identification Engine) plugin for network traffic classification, which integrates TIE and Weka (Waikato Environment for Knowledge Analysis), enabling the construction of classification methodologies based on machine learning techniques on the fly. Weka implements many well known machine learning algorithms such as bayesian methods, naïve bayes, bayesian networks, and decision tree learners, among others. This tool is integrated in our proposal to generate a model which is directly used by WekaTIE plugin for internet traffic classification using machine learning methodologies. The plugin architecture is described, including an example of its usage, and a preliminary evaluation is presented.

The scalability of the global routing system is critical for the evolution of the Internet, and consequently, BGP scalability has been part of the Internet research agenda from long ago. The original concern was the growth of the routing table size, and more recently, the research community has also been considering the growth of the BGP churn, i.e. the number of messages that are generated by the BGP protocol. Some relevant studies have characterized the evolution of the external BGP (eBGP) churn for the last few years and have shown a moderated increase. There is evidence that part of such growth is caused by important changes in inter-AS connectivity patterns, along with some unexpected behaviour of internal BGP (iBGP), in particular, intra-AS duplication of BGP updates due to Route Reflectors (RR). There are many vantage points in the Internet that record BGP traces, which permit to study eBGP behaviour, but there exist no public iBGP traces nor internal AS topology repositories, limiting the exploration of iBGP influence in the global scalability problem. In this paper we analyse route reflection benefits and caveats, and present RRLOC, an Open Source tool developed to facilitate research on this matter. The tool supports the location of Route Reflectors in a given AS topology using well-known algorithms, enabling the experimentation on iBGP dynamics, with the aid of network simulators. It also allows network planners to test different scenarios for RR placement.

Several countries such as Uruguay and Brazil are implementing the well-known One Laptop Per Child Program (OLPC) by which every child that assists to the primary school obtains in property a laptop with wireless capabilities. They carry their laptops from home to school and back every day and, as seen in the experience, they also carry their laptops to parks, community centers etc. This provides a wide platform for the deployment of Disruption Tolerant network applications. This paper presents a self-managed, opportunistic and content-based routing protocol that supports a network of environmental sensors implemented using consumer-grade wireless routers working together with OLPC laptops. We evaluate the impact of the density, diversity and connectivity of the mobile network on the performance of the protocol and we show how it self-configures it parameters to adapt to changing network conditions.

There are several network traffic classification methodologies which differ in their assurance and computational complexity.

During the last years there has been a strong research effort on the autonomic communications and self-management paradigms. Following this impulse, the academic community and the industry have proposed several architectures and techniques to allow network devices to make their own configuration decisions. Those proposals often include resource-expensive technologies such as complex inference machines, ontological modeling and probabilistic prediction that may not be suitable for the most pervasive and inexpensive network-enabled devices. This paper addresses this facet of the autonomic systems introducing RAN. This system aims to be a complete rule-based, distributed system specially designed and implemented to enable autonomic behavior on very constrained devices, such as domestic wireless routers with resources as low as 16 MB of RAM and 4 MB of storage memory. The RAN system was developed to serve the objectives of rural ambient networks, a project that targets the so-called digital divide deploying low-cost wireless mesh infrastructure in rural communities. In this context, RAN, in autonomic and distributed manners, optimizes the network configuration to minimize the monetary cost that the community has to pay for using the IT infrastructure. Finally, this work presents an evaluation of RAN that shows how it makes possible to perform sophisticated optimization decisions with a very small overhead in terms of CPU and memory.

The Locator/Identifier Separation Protocol (LISP) is one of the candidate solutions to address the scalability issues in inter-domain routing. The current proposals for its control plane (e.g., ALT, CONS, NERD) have various shortcomings, including the potential dropping of packets at LISP routers during the resolution of the EID-to-RLOC mapping. In this paper, we introduce a new Control Plane (CP) for LISP supported by an architecture that borrows concepts from both the Path Computation Element (PCE) and Intelligent Route Control (IRC). Our CP is able to tackle three different problems simultaneously: (i) packets sourced from end-hosts are neither dropped nor queued during the mapping resolution; (ii) the EID-to-RLOC mapping can be obtained and configured approximately within the DNS resolution time needed to fetch the destination EID address; and (iii) our approach can blend IRC with the PCE capabilities, to perform upstream/downstream Traffic Engineering (TE) through the dynamic management of the mappings. In particular, our CP supports the utilization of different LISP ingress and egress local routers for the same flow sourced from a domain.

This paper presents an alternative method to setup label switched paths (LSPs) with quality of service (QoS) constraints in multiprotocol label switching (MPLS) enabled networks. The motivation behind this work is to gather the advantages of the control plane based approach and the management plane based approach to establish LSPs. In other words we aim for a mechanism with setup times as shorter as those realizable by control plane signalling and with traffic engineering capabilities as powerful as in management systems. The concept has been prototyped and initial tests have been performed in a simulated network environment. The outcome of these tests show that our system can be nearly as fast as conventional control plane setup mechanisms and by construction it can take advantage of all the network information got by the management plane for constrained-based routing (CBR) purposes. Therefore, a trade-off between speed and resource optimisation is feasible. The implementation of the concept in real networks requires platforms with standard control and management interfaces, that have the role of peer network nodes and management agents at a time.

This paper describes the policy-based management architecture devised for management of IP over WDM networks and is part of the work carried out in the IST Project WINMAN, whose aim is to develop and validate an open and flexible integrated management system for this type of networks. The IETF has been working in the policy based management area, through two of its groups, in order to provide the means for managing IP based networks, offering some QoS guarantees. At the same time hybrid networks such as those placing IP directly over WDM are emerging as the solution to the increasing need for bandwidth. Management of such networks in an integrated fashion is a large research area. We are interested in integrating the policy management paradigm for managing integrated networks, such as IP over WDM networks.

This paper outlines the initial architectural results of WINMAN, an European research and development project started in July 2000, whose aim is to offer an integrated network management solution for the provisioning and maintenance of IP over WDM end-to-end transport services derived from service level agreements (SLAs). Management requirements for IP over WDM have been identified and a two-tier architecture has been conceived for the system that is intended for proof concept of the WINMAN solution. The first layer contains the technology dependent managers, that is one for the IP technology and another manager for the WDM. These two management systems will interact with existing network element management systems the southbound WINMAN interface. On top of this layer there is a second interface whose purpose is the integration of the above mentioned management systems. This system will be in turn integrated in different experimental test beds and fully tested in real life conditions.