In-network load balancing outperforms traditional software load balancing while costing less. For instance, programmable switch ASICs can use hashing to select the backend server for the initial packet of each flow at the line rate. However, when the pool of available servers changes, ensuring that the subsequent flow packets are mapped to the same server is challenging due to the data plane's limited memory resources and performance requirements. With the emergence of the QUIC transport protocol, several works show how Connection ID fields (CIDs) can embed the server identifier for all non-initial packets. This approach requires modifications on the server side and violates the QUIC specification, which mandates that CIDs remain unlinkable. In this work, we show that stateless QUIC load balancing can be implemented inside the data plane with no changes to CIDs. Moreover, QUIC packets, except the initial client packet, can bypass the load balancer. We also investigate and mitigate attacks on QUIC in this scenario, including full load balancer bypass and 0-RTT IP spoofing.

Kubernetes Services such as LoadBalancer and NodePort expose applications running on pods within a Kubernetes cluster to external users. While the LoadBalancer Service requires an external load-balancing middleware, its alternative, NodePort Service, adds additional hops on the path between clients and the worker nodes. In this paper, we propose P4Kube, a framework consisting of a P4 data plane program and a Kubernetes plugin. Our solution effectively performs load balancing of requests to the worker nodes of a cluster based on the number of running replicas. In P4Kube, the data packets completely bypass the system's control plane. Unlike the previous work, to update its state, the P4Kube data plane works directly with the Kubernetes control plane without any involvement of the network control plane. Our experiments show up to 50 % improvement in the average request time to the cluster compared to conventional approaches.

Accurately predicting the training time of deep learning (DL) workloads is critical for optimizing the utilization of data centers and allocating the required cluster resources for completing critical model training tasks before a deadline. The state-of-the-art prediction models, e.g., Ernest and Cherrypick, treat DL workloads as black boxes, and require running the given DL job on a fraction of the dataset. Moreover, they require retraining their prediction models every time a change occurs in the given DL workload. This significantly limits the reusability of prediction models across DL workloads with different deep neural network (DNN) architectures. In this paper, we address this challenge and propose a novel approach where the prediction model is trained only once for a particular dataset type, e.g., ImageNet, thus completely avoiding tedious and costly retraining tasks for predicting the training time of new DL workloads. Our proposed approach, called PredictDDL, provides an end-to-end system for predicting the training time of DL models in distributed settings. PredictDDL leverages Graph HyperNetworks, a class of neural networks that takes computational graphs as input and produces vector representations of their DNNs. PredictDDL is the first prediction system that eliminates the need of retraining a performance prediction model for each new DL workload and maximizes the reuse of the prediction model by requiring running a DL workload only once for training the prediction model. Our extensive evaluation using representative workloads shows that PredictDDL achieves up to 9.8× lower average prediction error and 10.3× lower inference time compared to the state-of-the-art system, i.e., Ernest, on multiple DNN architectures.

The energy demands of data centers are increasing and are expected to grow exponentially. Reducing the energy consumption of data centers decreases operational expenses, as well as their carbon footprint. We design techniques to reduce data center power consumption by leveraging Software-Defined Networking (SDN) and programmable data plane concepts. Relying solely on in-data plane registers, our proposed system P4Green consolidates traffic in the least number of network switches and shifts workloads to the servers with the available renewable energy. Unlike existing SDN-based solutions, P4Green’s operation does not depend on a centralized controller, making the system scalable and failure-resistant. Our proof-of-concept simulations show that traffic consolidation can reduce data centers’ aggregation switch usage by 36% compared to standard data center load balancing techniques, while workload control can boost renewable energy consumption for 46% of the daily traffic.

Deep packet inspection (DPI) is important for network security and is currently provided by complex black-box firewalls. This raises the question: Can network administrators build their own DPI-capable filter using a standard programmable switch? The common answer is that standard switches support P4, which allows users to specify how to parse packet headers, but not packet payload fields (e.g. URL) thus DPI tasks, like URL filtering, require dedicated middleboxes. In this paper, we challenge this common answer. First, we demonstrate that clients send packets with a predictable structure, so a P4 switch can perform some DPI (enough for URL filtering). Second, we demonstrate a URL-filtering firewall completely in the data plane, with no external help from the SDN controller, firewalls, etc. and no custom logic. Our proof-of-concept, P4Wall, handles multiple protocols (HTTP, HTTPS, DNS) with high performance - orders of magnitude faster than a standard Linux (netfilter) firewall.

Software-defined networks are useful for multiple tasks, including firewalling, telemetry, and flow analysis. In particular, the P4 language makes it possible to carry out some simple packet processing tasks in the data plane, i.e., on the switch itself (without real-time support from the SDN controller or a server). However, owing to the limitations of packet parsing in P4, these tasks involve only the packet headers. In this paper, we present a novel approach that allows Deep Packet Inspection (DPI) – i.e., inspection of the packet payload – in the data plane, using P4 alone. We make use of the fact that in P4, a switch can clone and recirculate packets. One copy (clone) can be recirculated, slicing off a byte in each round, and using a finite-state machine to check if a target string has yet been seen. If the target string is found, the other copy (original packet) is discarded; if not, it is passed through. Our approach allows us to build the first application-layer firewall (URL filter) in the data plane, and to achieve essentially line-rate performance while filtering thousands of URLs, on a commodity programmable switch. It may in future also be used for other DPI tasks.

We propose an adapter based multi-domain Transformer based language model (LM) for Transformer ASR. The model consists of a big size common LM and small size adapters. The model can perform multi-domain adaptation with only the small size adapters and its related layers. The proposed model can reuse the full fine-tuned LM which is fine-tuned using all layers of an original model. The proposed LM can be expanded to new domains by adding about 2% of parameters for a first domain and 13% parameters for after second domain. The proposed model is also effective in reducing the model maintenance cost because it is possible to omit the costly and time-consuming common LM pre-training process. Using proposed adapter based approach, we observed that a general LM with adapter can outperform a dedicated music domain LM in terms of word error rate (WER).

The P4 language allows "protocol-independent packet parsing" in network switches, and makes many operations possible in the data plane. But P4 is not built for Deep Packet Inspection – it can only "parse" well-defined packet headers, not free-form headers as seen in HTTPS etc. Thus some very important use cases, such as application-layer firewalls, are considered impossible for P4. This demonstration shows that this limitation is not strictly true: switches, that support only standard P4, are able to independently perform tasks such as blocking specific URLs (without using non-standard "extern" components, help from the SDN controller, or rerouting to a firewall). As more Internet infrastructure becomes SDN-compatible, in future, switches may perform simple application-layer firewall tasks.

SUMMARY: Despite the improvement in variant detection algorithms, visual inspection of the read-level data remains an essential step for accurate identification of variants in genome analysis. We developed BamSnap, an efficient BAM file viewer utilizing a graphics library and BAM indexing. In contrast to existing viewers, BamSnap can generate high-quality snapshots rapidly, with customized tracks and layout. As an example, we produced read-level images at 1000 genomic loci for >2500 whole-genomes. AVAILABILITY AND IMPLEMENTATION: BamSnap is freely available at https://github.com/parklab/bamsnap. SUPPLEMENTARY INFORMATION: Supplementary data are available at Bioinformatics online.

Programmability in the data plane has become increasingly important as virtualization is introduced into networking and software-defined networking becomes more prevalent. Yet, the performance of programmable data planes on commodity hardware is a major concern, in light of ever-increasing network speed and routing table size. This paper focuses on IP lookup, specifically the longest prefix matching for IPv6 addresses, which is a major performance bottleneck in programmable switches. As a solution, the paper presents CuVPP, a programmable switch that uses packet batch processing and cache locality for both instructions and data by leveraging Vector Packet Processing (VPP). We thoroughly evaluate CuVPP with both real network traffic and file-based lookup on a commodity hardware server connected via 80 Gbps network links and compare its performance with the other popular approaches. Our evaluation shows that CuVPP can achieve up to 4.5 million lookups per second with real traffic, higher than the other trie- or filter-based lookup approaches, and scales well even when the routing table size grows to 2 million prefixes.

Utilizing millimeter wave (mmWave) wireless communication in wireless datacenter networks, the power consumption of the networking equipment can be reduced drastically. However, security of a datacenter is one of the highest design priorities. Many studies on the security of wired datacenters including identifying the possible threats and solutions have been explored in the literature. On the contrary, being an emerging technology, no study has been conducted on the security for the wireless datacenters. Being a wireless system, it has the potential to inherit many of the threats of a typical wireless network. So, in order to successfully realize wireless datacenter architectures, it is essential to do an extensive investigation of the system from a security perspective. In this paper, we study both existing as well as novel threats and their impact on the wireless datacenter network. In addition to these conventional threats, we demonstrate the impact of a novel attack on the wireless datacenter which can be launched by leveraging its control plane.

In the era of high-performance cloud computations, networks need to ensure fast packet forwarding. This task is carried by TCAM forwarding chips that perform line-rate Longest Prefix Matches in a Forwarding Information Base (FIB). However, with the increasing number of prefixes in IPv4 and IPv6 routing tables the price of TCAM increases as well. In this work, we present a novel FIB compression technique by adding an aggregation layer into a FIB caching architecture. In Combined FIB Caching and Aggregation (CFCA), cache-hit ratio is maximized up to 99.94% with only 2.50% entries of the FIB, while the churn in TCAM is reduced by more than 40% compared to low-churn FIB aggregation techniques.

Ternary Content-Addressable Memory (TCAM) chips are used to store Forwarding Information Bases (FIB) in modern routers. TCAM provides next-hop lookup for IP packets at the line-rate. However, TCAM is expensive and energy-consuming; in addition, the constant FIB growth may lead to TCAM overflow problem. Yet only a small portion of FIB entries carries the most of network traffic. Thus, FIB caching, namely, installing the most popular entries in a fast memory, e.g., TCAM, may significantly minimize TCAM usage. To date, FIB caching architecture has not been widely deployed in backbone routers due to high cache-miss latency and the lack of an efficient cache replacement strategy. In this work, we leverage the concept of the programmable data plane to design a Programmable FIB Caching Architecture (PFCA) with two levels of cache. We present a pipeline-based algorithm to detect the least popular prefixes in a cache for a victim selection. We tested the prototype of PFCA using real traffic traces and an FIB with more than 599K entries, and showed that PFCA can be implemented using P4 programmable data plane language. Our results show that PFCA achieves 99.8% hit ratio for Level-1 cache with 20K entries and nearly 99.9% hit ratio for Level-2 cache with 40K entries. We also demonstrate that PFCA significantly reduces the number of BGP updates in the cache and thus makes the cache more stable.

Computer networks often serve as the first line of defense against malicious attacks. Although there are a growing number of tools for defining and enforcing security policies in software-defined networks (SDNs), most assume a single point of control and are unable to handle the challenges that arise in networks with multiple administrative domains. For example, consumers may want want to allow their home IoT networks to be configured by device vendors, which raises security and privacy concerns. In this paper we propose a framework called Proof-Carrying Network Code (PCNC) for specifying and enforcing security in SDNs with interacting administrative domains. Like Proof-Carrying Authorization (PCA), PCNC provides methods for managing authorization domains, and like Proof-Carrying Code (PCC), PCNC provides methods for enforcing behavioral properties of network programs. We develop theoretical foundations for PCNC and evaluate it in simulated and real network settings, including a case study that considers security in IoT networks for home health monitoring.

With the widespread usage of containerized virtualization in data centers and clouds, it is important to enabling high-throughput and zero-copy data transfer between those containers. Remote Direct Memory Access (RDMA) allows bypassing the kernel for packet processing by offloading it to specific RDMA-enabled NICs. The existing solutions enabling RDMA with containers are either based on custom container orchestrators (e.g., FreeFlow) or lack the ability for the control plane to manage the underlying RDMA traffic (e.g., Kubernetes RDMA plug-in via SR-IOV). The work in this paper builds off of previous work in Kubernetes to make an architecture that allows control over bandwidth requirements of RDMA within a Kubernetes cluster.

Cuckoo filters have been recently proposed as an efficient structure to perform approximate membership checks. In this paper, it is shown that the false positive rate of a cuckoo filter can be reduced by storing in addition to the fingerprint the information that tell us if a given fingerprint has been inserted in the first or the second bucket. This improvement of the cuckoo filter is denoted as Position Aware (PA) cuckoo filter.

Datacenters have become the digital backbone of the modern society and consume enormous amounts of power. Significant portion of the power consumption is due to the power hungry switching fabric necessary for communication in the datacenter. Additionally, the complex cabling in traditional datacenters pose design and maintenance challenges and increase the energy cost of the cooling infrastructure by obstructing the flow of chilled air. In this work we address these problems of traditional datacenters by designing a server-to-server wireless datacenter network (DCN). We propose design methodologies for the use of 60GHz unlicensed millimeter-wave bands to establish direct communication links between servers in a DCN without the need for a conventional fabric. This will reduce the power consumption of the DCN significantly. We first demonstrate that such a power-efficient wireless DCN can sustain the traffic requirements encountered in small to mid-size real datacenters and provide data rates that are comparable to traditional DCNs. Having established the feasibility of a server-to-server wireless DCN in terms of performance, we estimate that its power consumption is lower by four to six times in comparison to a conventional DCN fabric.

As servers are placed in diverse locations in networked services today, it becomes vital to direct a client's request to the best server(s) to achieve both high performance and reliability. In this distributed setting, non-negligible latency and server availability become two major concerns, especially for highly-interactive applications. Profiling latencies and sending redundant data have been investigated as solutions to these issues. The notion of a cloudlet in mobile-cloud computing is also relevant in this context, as the cloudlet can supply these solution approaches on behalf of the mobile. In this paper, we investigate the effects of profiling and redundancy on latency when a client has a choice of multiple servers to connect to, using measurements from real experiments and simulations. We devise and test different server selection and data partitioning strategies in terms of profiling and redundancy. Our key findings are summarized as follows. First, intelligent server selection algorithms help find the optimal group of servers that minimize latency with profiling. Second, we can achieve good performance with relatively simple approaches using redundancy. Our analysis of profiling and redundancy provides insight to help designers determine how many servers and which servers to select to reduce latency.

Robots are typically used at the college level either as a pedagogic platform for introductory programming or for more advanced courses in robotics. With robots becoming cheaper and more plentiful, personal interactions with them will become more commonplace. This project therefore takes the position that undergraduate computing students need the opportunity to explore core computing concepts in a robotics context. Specifically, we will give students the ability to work alongside teams of highly capable and easily programmable corobots, a term used to identify robots that work side by side with humans, rather than being completely autonomous and isolated. A modular approach is used to incorporate corobotics into various computer science (CS) courses such as first-year computing, networking, and data management, thus permitting the students to see these corobots in multiple contexts. This work-in-progress paper describes the corobotics infrastructure that has been developed, and outlines how this infrastructure can be used to support diverse courses in the CS curriculum.

A Bloom filter is a succinct data structure for membership queries. While the filter enables a compact storage, it allows false positives when queried and exhibits an inherent tradeoff between the false positive rate and space complexity. Among many applications, IP address lookup shows promise for improvement using on-chip Bloom filters; however, high false positive rates may cause more off-chip memory access and degrade the performance significantly. We introduce a new Bloom filter called the length-aware Bloom filter (LABF) for multiple pattern matching problems. The primary idea is to explore the discrepancy in length distribution between the set of patterns and the set of prefixes of input text that are examined against the patterns. While maintaining the simplicity, LABFs outperform the standard Bloom filter when the pattern lengths are nonuniformly distributed in a wide range. Such pattern length distributions frequently occur in multiple pattern matching, e.g., longest prefix matching in IP address lookup. We derive a simple formula to configure parameters for the construction of an LABF and provide a provable guarantee for the average number of false positives. Our experimental results show that LABFs reduce the average false positive rates by a factor of 4 and 16, for IPv4 and IPv6, respectively.

Face recognition applications for airport security and surveillance can benefit from the collaborative coupling of mobile and cloud computing as they become widely available today. This paper discusses our work with the design and implementation of face recognition applications using our mobile-cloudlet-cloud architecture named MOCHA and its initial performance results. The challenge lies with how to perform task partitioning from mobile devices to cloud and distribute compute load among cloud servers (cloudlet) to minimize the response time given diverse communication latencies and server compute powers. Our preliminary simulation results show that optimal task partitioning algorithms significantly affect response time with heterogeneous latencies and compute powers. Motivated by these results, we design, implement, and validate the basic functionalities of MOCHA as a proof-of-concept, and develop algorithms that minimize the overall response time for face recognition. Our experimental results demonstrate that high-powered cloudlets are technically feasible and indeed help reduce overall processing time when face recognition applications run on mobile devices using the cloud as the backend servers.

This paper presents strategies for providing successful Research Experiences for Undergraduates (REU). The authors have advised several undergraduates on research for the past few years, and have jointly supervised around twenty-five students, over two summers, on a project funded by an NSF-funded REU program in areas relating to the visualization of astrophysical data using high performance file systems. Several of these student projects have led to research publications. The paper briefly motivates the need for research in modern computing and engineering education. It then presents specific details about the development of summer REU programs including how to: secure funding and institutional support; plan a summer program including the design of scalable research projects; develop strategies to advertise and recruit students, especially from underrepresented groups; create a dynamic research and social environment through one-on-one mentoring; develop appropriate assessment and evaluation processes; and track student participants after they graduate from the program.

In the modern world of computing, diverse mobile devices connect to the internet and typically share data stored within the cloud. To live and succeed in this world, it is imperative that all majors, especially engineering majors, have an in-depth, not introductory, understanding of topics in mobile web computing. This paper explores the design and development of an immersion concentration of courses in these topics as part of general education at our institution. The concentration consists of courses that introduce hands-on programming of mobile devices; the issues in and the impact of architectural and distributed computing; and finally secure data management, privacy, and legal issues in mobile web computing. All of these courses focus on developing critical thinking, modern communication, contemporary issues, and life-long learning issues in the context of hands-on mobile computing. This work-in-progress paper motivates this effort, discusses the main features of the proposed courses, outlines some of the challenges being faced, and summarizes the current status of this ongoing effort.

In structured peer-to-peer (p2p) systems, distributed hash tables (DHTs) often partition the ID space into disjoint intervals with each interval assigned to the corresponding node. While nodes join and leave dynamically, one of the hard challenges posed by DHTs is load balancing across the ID space. Tries are known to be a viable data structure such that a balanced trie implies balanced intervals in the ID space. We establish a distributed trie as a deployable overlay network that connects the IDs of participating nodes. We propose a decentralized, efficient, and low-cost algorithm that balances ID intervals in DHTs using the trie. Our scheme allows a node to join or leave the system at a low cost, R + Θ(log log n), where R denotes the message routing cost in DHTs and n is the number of nodes. Compared to the prior ID assignment schemes that require R + Θ(log n) at best for the same operations, our new algorithm reduces the additional cost incurred to maintain the ID space balanced by a factor of Θ(log n/log log n). In our analysis and experiments, we show that the ID space is indeed well-balanced such that the ratio between the largest interval and the smallest is at most 8 with high probability. Finally, we discuss applications of the distributed trie to item load balancing and the multiple choice paradigm.

Over the past decade, Voice over IP (VoIP) has revolutionalized the telecommunications industry. VoIP has become more prevalent than ever, and consequently more users have switched to IP-based data networks for their telephone use from the analogue Public Switched Telephone Network (PSTN). One challenge, though, is to secure and protect these VoIP connections. In this paper, we investigate a new approach to demonstrate the vulnerability of VoIP connections. Our approach monitors real-time data streams (e.g., RTP), and inserts packets containing fraudulent voice data at expected times estimated from the monitoring. As false packets are well-aligned with original packets, we can maximize the effects of the test while minimizing the number of inserted packets. This minimal number of false packets also helps eschew the detection efforts of denial-of- service defense mechanisms. Our results indicate that the inserted packets at desired times can indeed disrupt the original RTP stream without any noticeable traffic increase.

A multitude of overlay network designs for resilient routing, multicasting, quality of service, content distribution, storage, and object location have been recently proposed. Overlay networks offer several attractive features, including ease of deployment, flexibility, adaptivity, and an infrastructure for collaboration among hosts. In this paper, we explore cooperation among co-existing, possibly heterogeneous, overlay networks. We design Synergy, a utility-based overlay internetworking architecture that fosters overlay cooperation. Our architecture promotes fair peering relationships to achieve synergism. Results from Internet experiments with cooperative forwarding overlays indicate that our Synergy prototype improves delay, throughput, and loss performance, while maintaining the autonomy and heterogeneity of individual overlay networks.

Overlay networks among cooperating hosts have recently emerged as a viable solution to several challenging problems, including multicasting, routing, content distribution, and peer-to-peer services. Application-level overlays, however, incur a performance penalty over router level solutions. This paper characterizes this performance penalty for overlay multicast trees via experimental data, simulations, and theoretical models. Experimental data and simulations illustrate that (i) the average delay and the number of hops between parent and child hosts in overlay trees generally decrease, and (ii) the degree of hosts generally decreases, as the level of the host in the overlay tree increases. Overlay multicast routing strategies, together with power-law and small-world Internet topology characteristics, are causes of the observed phenomena. We compare three overlay multicast protocols with respect to latency, bandwidth, router degrees, and host degrees. We also quantify the overlay tree cost. Results reveal that L(n)/U(n) /spl prop/ n/sub 0.9/ for small n, where L(n) is the total number of hops in all overlay links, U(n) is the average number of hops on the source to receiver unicast paths, and n is the number of members in the overlay multicast session.

We investigate the effect of TCP explicit congestion notification (ECN) with a new response strategy that is more aggressive in the short term, but preserves TCP long term behavior, without modifying the router marking rate. A less aggressive ECN decrease gives more incentives for end systems to become ECN-compliant, as ECN serves as an early warning sign in this case. Our analysis and simulation results demonstrate the effectiveness of the new algorithm in improving throughput and reducing fluctuations. We model a multiple bottleneck scenario with various types of traffic, and evaluate the effect of a number of parameters, including TCP flavor, increase/decrease parameters, buffer size, and random early detection (RED) parameters.

We propose an application level multicast approach, Topology Aware Grouping (TAG), which exploits underlying network topology in-formation to build efficient overlay networks among multicast group members. TAG uses information about path overlap among mem-bers to construct a tree that reduces the overlay relative delay penalty, and reduces the number of duplicate copies of a packet on the same link. We study the properties of TAG, and model and experiment with its economies of scale factor to quantify its benefits compared to unicast and IP multicast. We also compare the TAG approach with the ESM approach in a variety of simulation configurations in-cluding a number of real Internet topologies and generated topolo-gies. Our results indicate the effectiveness of the algorithm in reducing delays and duplicate packets, with reasonable algorithm time and space complexities.

There are at least four US patents on software watermarking, and an idea for further advancing the state of the art was presented by C. Collberg and C. Thomborsen (1999). The new idea is to embed a watermark in dynamic data structures, thereby protecting against many program-transformation attacks. Until now there have been no reports on practical experience with this technique. We have implemented and experimented with a watermarking system for Java based on the ideas of Collberg and Thomborsen. Our experiments show that watermarking can be done efficiently with moderate increases in code size, execution times and heap-space usage, while making the watermarked code resilient to a variety of program-transformation attacks. For a particular representation of watermarks, the time to retrieve a watermark is on the order of one minute per megabyte of heap space. Our implementation is not designed to resists all possible attacks; to do that, it should be combined with other protection techniques, such as obfuscation and tamperproofing.