In this study we focus on a Steering International Roaming Traffic (SIRT) problem with single service that concerns a telecommunication’s operators’ agreements with other operators in order to enable subscribers access services, without interruption, when they are out of operators’ coverage area. In these agreements, a subscriber’s call from abroad is steered to partner operator. The decision for which each call will be forwarded to the partner is based on the user’s location (country/city), price of the partner operator for that location and the service quality of partner operator. We develop an optimization model that considers agreement constraints and quality requirements while satisfying subscribers demand over a predetermined time interval. We test the performance of the proposed approach using different execution policies such as running the model once and fixing the roaming decisions over the planning interval or dynamically updating the decisions using a rolling horizon approach. We present a rigorous trade off analysis that aims to help the decision maker in assessing the relative importance of cost, quality and ease of implementation. Our results show that steering cost is decreased by approximately 25% and operator mistakes are avoided with the developed optimization model while the quality of the steered calls is kept above the base quality level.

Distributed Denial of Service (DDoS) attacks continue to be one of the most severe threats in the Internet. The intrinsic challenge in preventing DDoS attacks is to distinguish them from legitimate flash crowds since two have many traffic characteristics in common. Today most DDoS detection techniques focus on finding parametric differences between the patterns in attack and legitimate traffic. However, such techniques are very sensitive to the threshold values set on the parameters and more importantly legitimate traffic features might be mimicked by smart attackers to generate requests that look like flash crowds. In this paper, we propose a framework for training networks for such smart attacks. Our framework is based on Deep Generative Network models and our contributions are two-fold.We first show that legitimate traffic features can be mimicked without explicitly modeling their distributions. Second, we introduce the concept of context-aware DDoS attacks. We show that an attacker can generate traffic that looks similar to flash crowds to be undetected for long periods of time. However, the ability of generating such attacks is constrained by the budget of the attacker. A context-aware attacker is the one that can intelligently use its budget to maximize the damage in the victim network. Our study provides a framework for training networks for such DDoS attack scenarios.

The dynamics of interdomain routing have traditionally been studied through the analysis of BGP update traffic. However, such studies tend to focus on the volume of BGP updates rather than their effects, and tend to be local rather than global in scope. Studying the global state of the Internet routing system over time requires the development of new methods, which we do in this paper. We define a new metric, MRSD, that allows us to measure the similarity between two prefixes with respect to the state of the global routing system. Applying this metric over time yields a measure of how the set of total paths to each prefix varies at a given timescale. We implement this analysis method in a MapReduce framework and apply it to a dataset of more than 1TB, collected daily over 3 distinct years and monthly over 8 years. We show that this analysis method can uncover interesting aspects of how Internet routing has changed over time. We show that on any given day, approximately 1% of the next-hop decisions made in the Internet change, and this property has been remarkably constant over time; the corresponding amount of change in one month is 10% and in two years is 50%. Digging deeper, we can decompose next-hop decision changes into two classes: churn, and structural (persistent) change. We show that structural change shows a strong 7-day periodicity and that it represents approximately 2/3 of the total amount of changes.

The ability of an ISP to infer traffic volumes that are not directly measurable can be useful for research, engineering, and business intelligence. Previous work has shown that traffic matrix completion is possible, but there is as yet no clear understanding of which ASes are likely to be able to perform TM completion, and which traffic flows can be inferred.

Characterizing the set of routes used between domains is an important and difficult problem. The size and complexity of the millions of BGP paths in use at any time can hide important phenomena and hinder attempts to understand the path selection behavior of ASes. In this paper we introduce a new approach to analysis of the interdomain routing system designed to shed light on collective routing policies. Our approach starts by defining a new metric for `distance' between prefixes, which we call routing state distance (RSD). We show that RSD has a number of properties that make it attractive for use in visualizing and analyzing the state of the BGP system. Further, since RSD is a metric, it lends itself naturally to use in clustering prefixes or ASes. In fact, the properties of RSD allow us to define a natural clustering criterion, and we show that this criterion admits to a simple clustering algorithm with provable approximation guarantees. We then show that by clustering ASes using RSD, one can uncover macroscopic behavior in BGP that was previously hidden. For example, we show how to identify groups of ASes having similar routing policies with respect to certain destinations, which apparently reflects shared sensitivity to economic or performance considerations. These routing patterns represent a considerable generalization and extension of the notion of BGP atoms to the case where routing policies are only locally and approximately similar across a set of prefixes.

Consider this simple question: how can a network operator identify the set of routes that pass through its network? Answering this question is surprisingly hard: BGP only informs an operator about a limited set of routes. By observing traffic, an operator can only conclude that a particular route passes through its network -- but not that a route does not pass through its network. We approach this problem as one of statistical inference, bringing varying levels of additional information to bear: (1) the existence of traffic, and (2) the limited set of publicly available routing tables. We show that the difficulty depends critically on the position of the network in the overall Internet topology, and that the operators with the greatest incentive to solve this problem are those for which the problem is hardest. Nonetheless, we show that suitable application of nonparametric inference techniques can solve this problem quite accurately. For certain networks, traffic existence information yields good accuracy, while for other networks an accurate approach uses the "distance" between prefixes, according to a new network distance metric that we define. We then show how solving this problem leads to improved solutions for a particular application: traffic matrix completion.

Computer systems are increasingly driven by workloads that reflect large-scale social behavior, such as rapid changes in the popularity of media items like videos. Capacity planners and system designers must plan for rapid, massive changes in workloads when such social behavior is a factor. In this paper we make two contributions intended to assist in the design and provisioning of such systems.We analyze an extensive dataset consisting of the daily access counts of hundreds of thousands of YouTube videos. In this dataset, we find that there are two types of videos: those that show rapid changes in popularity, and those that are consistently popular over long time periods. We call these two types rarely-accessed and frequently-accessed videos, respectively. We observe that most of the videos in our data set clearly fall in one of these two types. In this work, we study the frequently-accessed videos by asking two questions: first, is there a relatively simple model that can describe its daily access patterns? And second, can we use this simple model to predict the number of accesses that a video will have in the near future, as a tool for capacity planning? To answer these questions we develop a framework for characterization and forecasting of access patterns. We show that for frequently-accessed videos, daily access patterns can be extracted via principal component analysis, and used efficiently for forecasting.

A traffic matrix encompassing the entire Internet would be very valuable. Unfortunately, from any given vantage point in the network, most traffic is invisible. In this paper we describe results that hold some promise for this problem. First, we show a new characterization result: traffic matrices (TMs) typically show very low effective rank. This result refers to TMs that are purely spatial (have no temporal component), over a wide range of spatial granularities. Next, we define an inference problem whose solution allows one to infer invisible TM elements. This problem relies crucially on an atomicity property we define. Finally, we show example solutions of this inference problem via two different methods: regularized regression and matrix completion. The example consists of an AS inferring the amount of invisible traffic passing between other pairs of ASes. Using this example we illustrate the accuracy of the methods as a function of spatial granularity.

Mobility models have traditionally been tailored to specific application domains such as human, military, or ad hoc transportation scenarios. This tailored approach often renders a mobility model useless when the application domain changes, and leads to wrong conclusions about the performance of protocols and applications running atop of different domains. In this work we propose and implement a mobility modeling framework (UMMF) based on the observation that the mobility characteristics of most mobility-based applications can be captured in terms of a few fundamental factors: (1) Targets; (2) Obstacles; (3) Dynamic events; (4) Navigation; (5) Steering behaviors; and (6) Dynamic behaviors. We demonstrate the mapping of application-domain-specifics to UMMF elements, showing the power and flexibility of our approach.