This paper investigates the rating of network paths, i.e., acquiring quantized measures of path properties such as round-trip time and available bandwidth. Compared to fine-grained measurements, coarse-grained ratings are appealing in that they are not only informative but also cheap to obtain. Motivated by this insight, we first address the scalable acquisition of path ratings by statistical inference. By observing similarities to recommender systems, we examine the applicability of solutions to a recommender system and show that our inference problem can be solved by a class of matrix factorization techniques. A technical contribution is an active and progressive inference framework that not only improves the accuracy by selectively measuring more informative paths, but also speeds up the convergence for available bandwidth by incorporating its measurement methodology. Then, we investigate the usability of rating-based network measurement and inference in applications. A case study is performed on whether locality awareness can be achieved for overlay networks of Pastry and BitTorrent using inferred ratings. We show that such coarse-grained knowledge can improve the performance of peer selection and that finer granularities do not always lead to larger improvements.

The knowledge of end-to-end network distances is essential to many Internet applications. As active probing of all pairwise distances is infeasible in large-scale networks, a natural idea is to measure a few pairs and to predict the other ones without actually measuring them. This paper formulates the prediction problem as matrix completion where the unknown entries in a pairwise distance matrix constructed from a network are to be predicted. By assuming that the distance matrix has low-rank characteristics, the problem is solvable by low-rank approximation based on matrix factorization. The new formulation circumvents the well-known drawbacks of existing approaches based on Euclidean embedding. A new algorithm, so-called Decentralized Matrix Factorization by Stochastic Gradient Descent (DMFSGD), is proposed. By letting network nodes exchange messages with each other, the algorithm is fully decentralized and only requires each node to collect and to process local measurements, with neither explicit matrix constructions nor special nodes such as landmarks and central servers. In addition, we compared comprehensively matrix factorization and Euclidean embedding to demonstrate the suitability of the former on network distance prediction. We further studied the incorporation of a robust loss function and of nonnegativity constraints. Extensive experiments on various publicly available datasets of network delays show not only the scalability and the accuracy of our approach, but also its usability in real Internet applications.

In this paper we argue that contextual multi-armed bandit algorithms could open avenues for designing self-learning security modules for computer networks and related tasks. The paper has two contributions: a conceptual and an algorithmical one. The conceptual contribution is to formulate the real-world problem of preventing HTTP-based attacks on web servers as a one-shot sequential learning problem, namely as a contextual multi-armed bandit. Our second contribution is to present CMABFAS, a new and computationally very cheap algorithm for general contextual multi-armed bandit learning that specifically targets domains with finite actions. We illustrate how CMABFAS could be used to design a fully self-learning meta filter for web servers that does not rely on feedback from the end-user (i.e., does not require labeled data) and report first convincing simulation results.

We present the design of DISco, a storage and communication middleware that enables distributed and task-centric autonomic control of networks. DISco allows multi-agent identification of anomalous situations (challenges) and assists coordinated remediation that will maintain service at an acceptable level, although degraded. The history of agents decisions, their context and outcomes is tracked as the situation evolves, and information is automatically gathered and organised to ease further human-assisted diagnosis. We then explore the feasibility of using state of the art peer-to-peer publish/subscribe and storage systems as building blocks for this service. The ability of those systems to support range queries and aggregation will be a key factor for their suitability to the task.

In large-scale networks, full-mesh active probing of end-to-end performance metrics is infeasible. Measuring a small set of pairs and predicting the others is more scalable. Under this framework, we formulate the prediction problem as matrix completion, whereby unknown entries of an incomplete matrix of pairwise measurements are to be predicted. This problem can be solved by matrix factorization because performance matrices have a low rank, thanks to the correlations among measurements. Moreover, its resolution can be fully decentralized without actually building matrices nor relying on special landmarks or central servers.

With the spread of new and innovative Internet services such as SIP-based communications, the challenge of protecting and defending these critical applications has been raised. In particular, SIP firewalls attempt to filter the signaling unwanted activities and attacks based on the knowledge of the SIP protocol. Optimizing the SIP firewall configuration at real-time by selecting the best filtering rules is problematic because it depends on both natures of the legal traffic and the unwanted activities. More precisely, we do not know exactly how the unwanted activities are reflected in the SIP messages and in what they differ from the legal ones. In this paper, we address the case of Spam over Internet Telephony (SPIT) mitigation.

The first generation of IGP Link Weight Optimizers (LWOs) was based on presumably invariant intra-domain traffic matrices only, ignoring the fact that updating link weights had a side effect on these traffic matrices due to hot-potato routing, thus resulting in suboptimal link weight settings, and sometimes to very bad performance. The second generation of IGP LWOs, referred to as BGP-aware LWOs, has been able to optimize link weights while taking hot-potato effects into account. However, these tools relied on the complete visibility assumption fulfilled by e.g. a full-mesh iBGP configuration. This paper proposes a third generation LWO, still BGP-aware, but also able to work with iBGP configurations based on route reflectors, which usually hide some reachability information from routers. This partial visibility may cause various problems, including path deflections (i.e., the actual egress router is not the expected one), which may in turn create forwarding loops. Our LWO embeds a BGP routing solver which can always predict the actual egress router, even when route reflectors are used. It can also forbid solutions leading to path deflection. Its efficiency is evaluated on a real dataset, and compared to other LWOs.

We address the problem of finding indirect overlay paths that reduce the latency between pairs of nodes in an overlay. To this end we propose to rely on an Internet Coordinate System (ICS), namely Vivaldi, to estimate RTTs and help find these interesting detours. We define two initial criteria to illustrate our approach and assess their true/false positive rates.

A well-known approach to intradomain traffic engineering consists in finding the set of link weights that minimizes a network-wide objective function for a given intradomain traffic matrix. This approach is inadequate because it ignores a potential impact on interdomain routing due to hot-potato routing policies. This may result in changes in the intradomain traffic matrix that have not been anticipated by the link weights optimizer, possibly leading to degraded network performance.

The ANA (Autonomic Network Architecture) project aims at providing a framework to flexibly host, interconnect, and federate multiple heterogeneous networks in an autonomic way, i.e. without requiring active human intervention. The guiding design principle is to strive for a maximum degree of flexibility at all levels of the architecture in order to inherently support heterogeneity and evolution. This paper describes the core abstractions and concepts of ANA (as defined during the first year of the project) and introduces their basic operation and interaction. While not autonomic themselves, the core architectural principles of ANA will enable autonomicity by not imposing a "one-size-fits-all" approach where protocols and paradigms are fixed by the architecture. We indeed argue that only the capacity of the network to be polyfunctional and fully adaptable will justify the label ' autonomic'. A prototype ofANA is currently being developed and will be released in 2008: the goal is to demonstrate the feasibility of autonomic networking within the 4 years of the project.

We explain how the TOTEM toolbox can be used to engineer an operational network. TOTEM is an open source TOolbox for Traffic Engineering Methods which covers IP- based and MPLS-based intradomain traffic engineering (TE) algorithms, but also interdomain TE. In this paper, we use the toolbox as an off-line simulator to optimise the traffic of an operational network. To help an operator choose between an IP-based or MPLS-based solution, or find the best way to load- balance a network for a given traffic, our case study compares several IP and MPLS routing algorithms, evaluates the impact of hot-potato routing on the intradomain traffic matrix, and analyses the worst-case link failure. This study reveals the power of a toolbox that federates many traffic engineering algorithms.

We compare and evaluate different methods to infer groups of correlated failures. These methods try to group failure events occurring nearly simultaneously in clusters. Indeed if several failures occur nearly at the same moment in a network, it is possible that these failures have the same root cause. The input data of our algorithms are IP failure notifications that can be provided by several sources. We consider two sources: IS-IS Link State Packets (LSPs) and Syslog messages. Our first results on the Abilene and GÉANT networks show that the inference methods behave differently and that using IS-IS LSPs provides more accurate results than using Syslog messages.

We compare and evaluate how well-known and novel network-wide objective functions for Traffic Engineering (TE) algorithms fulfil TE requirements. To compare the objective functions we model the TE problem as a linear program and solve it to optimality, thus finding for each objective function the best possible target of any heuristic TE algorithm. Our first results on the GÉANT network suggest that they can give quite different results.

The low quality of service provided by wireless networks does not facilitate the setup of long-awaited services, such as video conversations. In a cellular network, handoffs are an important cause of packet losses and delay jitter. These problems can be mitigated if proactive measures are taken. This requires each cell to guess the next handoff of each mobile terminal, a problem known as mobility prediction. This prediction can occur thanks to some clues (such as signal strength measurements) giving information about the terminals motion. For example, a clue that locates on which road a mobile is moving is likely to be interesting for all the prediction-enabled cells along that road ---and should therefore be sent to them. This paper proposes a new method aimed at selecting the most relevant clues and finding where to propagate those clues so as to optimize mobility predictions. The pertinence of a clue is measured using information theory and by means of decision trees. This pertinence estimation is exchanged between the cells and allows to build a"relevance map" that helps determine where clues should be sent. It is adapted to the characteristics of wireless terminals such as low bandwidth and processing power.

Several mechanisms increase the QoS level of mobile networks thanks to an underlying mobility prediction method (i.e. a means to predict a mobile's next access router). This paper aims at studying how the accuracy of the prediction method can influence the network QoS in the particular context of call admission control. It shows that (a) the mobiles behaviour must be adapted according to the prediction scheme accuracy in order to achieve good performance and (b) the admission algorithm can be modified to increase its fairness and to give mobiles an incentive to do such an adaptation.

In this paper, we present the application of machine learning techniques to the improvement of the congestion control of TCP in wired/wireless networks. TCP is sub-optimal in hybrid wired/wireless networks because it reacts in the same way to losses due to congestion and losses due to link errors. We thus propose to use machine learning techniques to build automatically a loss classifier from a database obtained by simulations of random network topologies. Several machine learning algorithms are compared for this task and the best method for this application turns out to be decision tree boosting. It outperforms ad hoc classifiers proposed in the networking literature.

Abstract. Enhanced Timed-LOTOS, denoted ET-LOTOS, is an extension of LOTOS that allows the modelling of real-time behaviours. It covers all the aspects of full LOTOS, including data types, it supports both a dense and a discrete time domain and can manipulate time values as any other data values. A tutorial on ET-LOTOS, showing many application examples, has already been published [LéL97]. The present paper adds to it by providing an in-depth presentation of its theoretical aspects. The complete semantics is given and explained, and its properties are studied. In particular, we prove that the semantics is consistent and that strong bisimulation is a congruence. This requires to deal carefully with the presence of negative premises in the operational semantics, which are necessary to express urgency. ET-LOTOS is also shown to be a conservative extension of LOTOS for guarded processes, and is the basis of the timed extension of LOTOS currently developed by ISO [ISO98]. To our knowledge, this is the first in-depth study of a language that combines data types and real-time behaviours.