The computer and information science and engineering disciplines are at the center of an ongoing societal transformation. The explosive growth of scientific and social data, wireless connectivity at broadband speeds for a countless number of mobile endpoints, and seamless access to resources in the 'cloud' are transforming the way we work, learn, play, and communicate. Furthermore, the proliferation of mobile devices and new applications is leading to increasing complexity and growth of network traffic. I will talk about how digitalization, virtualization, and mobility are reshaping our economy, society, and daily lives. I will also talk about these trends catalyze new opportunities for foundational research. I will further explore how advances in computing and communication serve as key drivers of economic competitiveness and how they will be crucial to achieving national priorities.

Public clouds have become a popular platform for building Internet-scale applications. Using virtualization, public cloud services grant customers full control of guest operating systems and applications, while service providers still retain the management of their host infrastructure. Because applications built with public clouds are often highly sensitive to response time, infrastructure builders strive to reduce the latency of their data center's internal network. However, most existing solutions require modification to the software stack controlled by guests. We introduce a new host-centric solution for improving latency in virtualized cloud environments. In this approach, we extend a classic scheduling principle---Shortest Remaining Time First---from the virtualization layer, through the host network stack, to the network switches. Experimental and simulation results show that our solution can reduce median latency of small flows by 40%, with improvements in the tail of almost 90%, while reducing throughput of large flows by less than 3%.

Whether it happens through malware or through phishing, loss of one's online identity is a real and present danger. While many attackers seek credentials to realize financial gain, an analysis of the compromised accounts at our own institutions reveals that perpetrators often steal university credentials to gain free and unfettered access to information. This nontraditional motivation for credential theft puts a special burden on the academic institutions that provide these accounts. In this paper, we describe the design, implementation, and evaluation of a system for safeguarding academic accounts and resources called the University Credential Abuse Auditing System (UCAAS). We evaluate UCAAS at two major research universities with tens of thousands of user accounts and millions of login events during a two-week period. We show the UCAAS to be useful in reducing this burden, having helped the university security teams identify a total of 125 compromised accounts with zero false positives during the trail.

Critical infrastructure, including the Internet, plays a vital role in the economic, political, and social fabric of society. This interdependency leaves society vulnerable to a wide range of threats that impact the security, reliability, availability, and overall trustworthiness of information technology resources. Assuring these properties in the face of adversarial behavior and an Internet that has changed dramatically in size, complexity, and diversity over the last decade has proven to be a critical challenge. In this talk, I will reflect on the evolution of Internet threats - from early threats, such as viruses and worms, to modern botnets. I will explore how changing attacker's technological means (e.g., resilient infrastructure, covert communication) have intertwined with attacker's changing social, behavioral, and economic motives (e.g., vandalism, crime, activism) to create today's large, complex, and diverse ecosystem of threats. I will also touch on how future innovation in the threat landscape will likely be driven by Internet adoption patterns such as the explosive growth of on-line data, the proliferation of mobile devices, and the emergence of the "cloud" computing paradigm.

Modern networks are complex and hence, network operators often rely on automation to assist in assuring the security, availability, and performance of these networks. At the core of many of these systems are general-purpose anomaly-detection algorithms that seek to identify normal behavior and detect deviations. While the number and variations of these algorithms are large, two broad categories have emerged as leading approaches to this problem: those based on spatial correlation and those based on temporal analysis. In this paper, we compare one promising approach from each of these categories, namely entropy-based PCA and HHH-based wavelets.

The monitoring of packets destined for routeable, yet unused, Internet addresses has proved to be a useful technique for measuring a variety of specific Internet phenomenon (e.g., worms, DDoS). In 2004, Pang et al. stepped beyond these targeted uses and provided one of the first generic characterizations of this non-productive traffic, demonstrating both its significant size and diversity. However, the six years that followed this study have seen tremendous changes in both the types of malicious activity on the Internet and the quantity and quality of unused address space. In this paper, we revisit the state of Internet ”background radiation ” through the lens of two unique data-sets: a five-year collection from a single unused /8 network block, and week-long collections from three recently allocated /8 network blocks. Through

In this paper, we examine changes in Internet inter-domain traffic demands and interconnection policies. We analyze more than 200 Exabytes of commercial Internet traffic over a two year period through the instrumentation of 110 large and geographically diverse cable operators, international transit backbones, regional networks and content providers. Our analysis shows significant changes in inter-AS traffic patterns and an evolution of provider peering strategies. Specifically, we find the majority of inter-domain traffic by volume now flows directly between large content providers, data center / CDNs and consumer networks. We also show significant changes in Internet application usage, including a global decline of P2P and a significant rise in video traffic. We conclude with estimates of the current size of the Internet by inter-domain traffic volume and rate of annualized inter-domain traffic growth.

Cloud based infrastructures are rapidly becoming a destination of choice to host a variety of applications ranging from high availability enterprise services and online TV stations, to batch oriented scientific computations. With investments of billions of dollars, the fortunes of dozens of companies, and major research initiatives staked on its success, it is clear that cloud computing is here to stay. However, it is not yet clear whether cloud services can be a dependable alternative to dedicated infrastructure. On one hand, availability and privacy are serious challenges for applications hosted on cloud infrastructure. On the other hand, a cloud provider's economies of scale allow levels of investment in redundancy and dependability that are difficult to match for smaller operators. Furthermore, the ability to monitor large numbers of applications can enable ldquowisdom of crowdsrdquo approaches to provide enhanced security much in the same way that network providers have been able to do with worms and DDoS attacks. The panel will discuss new dependability related challenges and opportunities that arise in the context of cloud computing, some examples of which are as follows.

The Student Forum at DSN provides an opportunity for students currently working in the area of dependable computing to present and discuss their research objectives, approach and preliminary results. The Forum is centered on a conference track during which the selected student research papers are presented. Student Forum research papers are brief three-page single-authored presentations of ongoing research by graduate students.

Self-propagating malware like worms and bots can dramatically impact the availability and reliability of the Internet. Techniques for the detection and mitigation of Internet threats using content prevalence and scan detectors are based on assumptions of how threats propagate. Some of these assumptions have recently been called into question by observations of huge discrepancies in the quantity of specific threats detected at different points around the Internet. We call these deviations from uniform propagation "hotspots". This paper quantifies and explains these influences on malware propagation. We then propose that hotspots can be explained by two fundamental influences on propagation: algorithmic factors and environmental factors. We use measurement data from sensors deployed at 11 locations around the Internet to demonstrate the impact of these factors on worm and bot propagation. With this understanding, we simulate the outbreak of new threats with hotspots and show how algorithmic and environmental factors reduce the visibility of distributed detectors resulting in the inability to identify new threats.

Several research studies have been devoted to improving the reliability and performance of the Internet by utilizing redundant communication paths between end points. Multihoming, coupled with intelligent route control, and overlay networks are two main streams in this area of research which attempt to leverage redundant connections of the Internet for increased reliability and performance. However, the effectiveness of these approaches depends on the natural diversity of redundant paths between two endhosts in terms of physical links, routing infrastructure, administrative control, and geographical distribution. Even in the case of redundant paths, if traffic between two hosts is not actually routed along completely disjoint paths, congestion or failure of a single shared link or router can adversely affect the end-to-end performance or availability of all paths. This paper presents an experimental study of path diversity on the Internet, focusing on the impact of path diversity on multihomed and overlay networks. We base our analysis on traceroutes and routing table data collected from several vantage points in the Internet including: looking glasses at 10 major Internet service providers (ISPs), RouteViews servers from 20 ISPs, and more than 50 PlanetLab nodes globally distributed across the Internet. Using this data, we quantify the extent of path diversity in multihoming and overlay networks, highlighting the limitations, and also identifying the source of the limitations in these architectures. From the analysis, we learn that both multihoming route control and current overlay networks are not able to ensure path diversity, which makes it very difficult to provide high-availability services even with the use of these systems. We believe that this work provides the insight into building future systems based on understanding path diversity

Recently, overlay networks have emerged as a means to enhance end-to-end application performance and availability. Overlay networks attempt to leverage the inherent redundancy of the Internet's underlying routing infrastructure to detour packets along an alternate path when the given primary path becomes unavailable or suffers from congestion. However, the effectiveness of these overlay networks depends on the natural diversity of overlay paths between two endhosts in terms of physical links, routing infrastructure, administrative control, and geographical distribution. Several recent studies realized that a measurable number of path outages were unavoidable even with use of such overlay networks. This stems from the fact that overlay paths might overlap with each other when overlay nodes are selected without considering the underlying topology. An overlay network's ability to quickly recover from path outages and congestion is limited unless we ensure path independence at the IP layer. This paper proposes a novel framework for topology-aware overlay networks. In this framework, we expressly design overlay networks, aiming to maximize path independence without degrading performance. We develop measurement-based heuristics for 1) placement of overlay nodes inside an ISP and 2) selection of a set of ISPs. We base our analysis on extensive data collection from 232 points in 10 ISPs, and 100 PlanetLab nodes. On top of node placement, we present measurement-based verification to conclude that single-hop overlay routing performs as well as multi-hop routing with respect to both availability and performance. Our analysis results show that a single-hop overlay path provides the same degree of path diversity as the multi-hop overlay path for more than 90% of source and destination pairs. Finally, we validate the proposed framework using real Internet outages to show that our architecture is able to provide a significant amount of resilience to real-world failures.

Multi-homed and overlay networks are two widely studied approaches aimed at leveraging the inherent redundancy of the Internet's underlying routing infrastructure to enhance end-to-end application performance and availability. However, the effectiveness of these approaches depends on the natural diversity of redundant paths between two endhosts in terms of physical links, routing infrastructure, administrative control and geographical distribution. This paper quantitatively analyzes the impact of path diversity on multihomed and overlay networks and highlights several inherent limitations of these architectures in exploiting the full potential redundancy of the Internet. We based our analysis on traceroutes and routing table data collected from several vantage points in the Internet including: looking glasses at ten major Internet service providers (ISPs), RouteViews servers from twenty ISPs, and more than fifty PlanetLab nodes globally distributed across the Internet. Our study motivates research directions - constructing topology-aware multihoming and overlay networks for better availability.

Abstract This paper describes the architecture, implementation, and application of Windmill, a passive network protocol performance measurement tool. Windmill enables experimenters to measure a broad range of protocol performance metrics both by reconstructing application‐level network protocols and by exposing the underlying protocol layers' events. Windmill is split into three functional components: a dynamically compiled Windmill Protocol Filter (WPF), a set of abstract protocol modules, and an extensible experiment engine. To demonstrate Windmill's utility, we present the results from several experiments. The first set of experiments validates a possible cause for the correlation between Internet routing instability and network bandwidth usage. The second set of experiments highlights Windmill's ability to act as a driver for a complementary active Internet measurement infrastructure, its ability to perform online data reduction, and the non‐intrusive measurement of a closed system. Copyright © 2003 John Wiley & Sons, Ltd.

This paper describes the design and implementation of protocol scrubbers. Protocol scrubbers are transparent, interposed mechanisms for explicitly removing network scans and attacks at various protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems by converting ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream endpoints. The fingerprint scrubber restricts an attacker's ability to determine the operating system of a protected host. As an example, this paper presents the implementation of a TCP scrubber that eliminates insertion and evasion attacks-attacks that use ambiguities to subvert detection-on passive network-based intrusion detection systems, while preserving high performance. The TCP scrubber is based on a novel, simplified state machine that performs in a fast and scalable manner. The fingerprint scrubber is built upon the TCP scrubber and removes additional ambiguities from flows that can reveal implementation-specific details about a host's operating system.

This paper presents the results from a detailed, experimental study of OSPF an intra-domain routing protocol, running on a mid-size regional Internet service provider. Using multiple, distributed probes running custom monitoring tools, we collected continuous protocol information for a full year. We use this data to analyze the health of the network including the amount, source, duration and periodicity of routing instability. We found that information from external routing protocols produces significant levels of instability within OSPF. We also examine the evolution of the routing topology over time, showing that short term changes are incremental and that the long term trend shows constant change. Finally, we present a set of detailed investigations into several large scale anomalies. These anomalies demonstrate the significant impact external routing protocols have on OSPF. In addition, they highlight the need for new network management tools that can incorporate information from routing protocols.

This paper proposes the concept of a fault-tolerant virtual private network (FVPN) within an autonomous system-a framework for supporting seamless network fail-over by leveraging the inherent redundancy of the underlying Internet infrastructure. The proposed architecture includes an application-level module, which is integrated into gateways at VPN end-points. This module enables fail-over to a redundant path without waiting for the underlying routing protocol converging to a new route. The paper introduces two algorithms for establishing redundant backup paths while minimizing overlapping network links. The proposed schemes are evaluated using topology information and sample routing logs from a regional Internet service provider network.

This paper examines the latency in Internet path failure, failover, and repair due to the convergence properties of interdomain routing. Unlike circuit-switched paths which exhibit failover on the order of milliseconds, our experimental measurements show that interdomain routers in the packet-switched Internet may take tens of minutes to reach a consistent view of the network topology after a fault. These delays stem from temporary routing table fluctuations formed during the operation of the border gateway protocol (BGP) path selection process on the Internet backbone routers. During these periods of delayed convergence, we show that end-to-end Internet paths will experience intermittent loss of connectivity, as well as increased packet loss and latency. We present a two-year study of Internet routing convergence through the experimental instrumentation of key portions of the Internet infrastructure, including both passive data collection and fault-injection machines at major Internet exchange points. Based on data from the injection and measurement of several hundred thousand interdomain routing faults, we describe several unexpected properties of convergence and show that the measured upper bound on Internet interdomain routing convergence delay is an order of magnitude slower than previously thought. Our analysis also shows that the upper theoretic computational bound on the number of router states and control messages exchanged during the process of BGP convergence is factorial with respect to the number of autonomous systems in the Internet. Finally, we demonstrate that much of the observed convergence delay stems from specific router vendor implementation decisions and ambiguity in the BGP specification.

Simulation and verification are two conventional techniques for the analysis of specifications of real-time systems. While simulation is relatively inexpensive in terms of execution time, it only validates the behavior of a system for one particular computation path. On the other hand, verification provides guarantees over the entire set of computation paths of a system, but is, in general, very expensive due to the state-space explosion problem. We introduce a new technique: simulation-verification combines the best of both worlds by synthesizing an intermediate analysis method. This method uses simulation to limit the generation of a computation graph to that set of computations consistent with the simulation. This limited computation graph, called a simulation-verification graph, can be one or more orders of magnitude smaller than the full computation graph. A tool, XSVT, is described which implements simulation-verification graphs. Three paradigms for using the new technique are proposed. The paper illustrates the application of the proposed technique via an example of a robot controller for a manufacturing assembly line.

Group communication is a widely studied paradigm for building fault-tolerant distributed systems. The Armada project at the University of Michigan is a collaborative effort with the Honeywell Technology Center to study how real-world applications use group communication. We describe the results of our experience implementing a fault-tolerant distributed radar tracking system, and discuss how we were able to simplify our design and implementation by utilizing additional services built on top of the group communication model.

This paper describes the design and implementation of a protocol scrubber, a transparent interposition mechanism for explicitly removing network attacks at both the transport and application protocol layers. The transport scrubber supports downstream passive network-based intrusion detection systems; whereas the application scrubbing mechanism supports transparent fail-closed active network-based intrusion detection systems. The transport scrubber's role is to convert ambiguous network flows into well-behaved flows that are unequivocally interpreted by all downstream endpoints. As an example, this paper presents the implementation of a TCP/IP scrubber that eliminates insertion and evasion attacks-attacks that use ambiguities to subvert detection-on passive network-based intrusion detection systems, while preserving high performance. The application protocol scrubbing mechanism is used as a substrate for building fail-closed active network based intrusion detections systems that can respond to attacks by eluding or modifying application data flows in real-time. This paper presents the high performance implementation of a general purpose transparent application-level scrubbing toolkit in the FreeBSD kernel.

Group communication is a widely studied paradigm which is often used in building real-time and fault-tolerant distributed systems. RTCAST is a real-time group communication protocol which has been designed to work with commercial, non-real-time, off-the-shelf hardware and operating systems, such as Solaris, Linux and Windows NT. RTCAST makes probabilistic real-time guarantees based on assumptions about the performance of the underlying system. Unfortunately, the high variability of the access to system resources that these operating systems provide may limit the predictability of the real-time guarantees provided by RTCAST. By taking advantage of a service that provides resource scheduling and reservation in these operating systems, both the hardness and timing granularity of RTCAST's real-time services can be greatly improved. This paper describes an implementation of RTCAST which makes use of the Resource Kernel to provide highly predictable, real-time communication guarantees.

This paper examines the latency in Internet path failure, failover and repair due to the convergence properties of inter-domain routing. Unlike switches in the public telephony network which exhibit failover on the order of milliseconds, our experimental measurements show that inter-domain routers in the packet switched Internet may take tens of minutes to reach a consistent view of the network topology after a fault. These delays stem from temporary routing table oscillations formed during the operation of the BGP path selection process on Internet backbone routers. During these periods of delayed convergence, we show that end-to-end Internet paths will experience intermittent loss of connectivity, as well as increased packet loss and latency. We present a two-year study of Internet routing convergence through the experimental instrumentation of key portions of the Internet infrastructure, including both passive data collection and fault-injection machines at major Internet exchange points. Based on data from the injection and measurement of several hundred thousand inter-domain routing faults, we describe several unexpected properties of convergence and show that the measured upper bound on Internet inter-domain routing convergence delay is an order of magnitude slower than previously thought. Our analysis also shows that the upper theoretic computational bound on the number of router states and control messages exchanged during the process of BGP convergence is factorial with respect to the number of autonomous systems in the Internet. Finally, we demonstrate that much of the observed convergence delay stems from specific router vendor implementation decisions and ambiguity in the BGP specification.

This paper describes MTSim, an extensible, customizable simulation platform for the Modechart toolset (MT). MTSim provides support for "plugging in" user-defined viewers useful in simulating system behavior in different ways, including application-specific ways. MTSim also supports full user participation in the generation of simulations by allowing users to inject events into the execution trace. Moreover, MTSim provides monitoring and assertion checking of execution traces and the invocation of user-specified handlers upon assertion violation. This paper also introduces an MTSim component called WebSim, a suite of simulation tools for MT, and an application-specific component of MTSim which displays the cockpit of an F-18 aircraft and which responds to user inputs to model a bomb release function.

This paper examines the problem of building scalable, fault-tolerant distributed systems from collections of communicating process groups, while maintaining well-defined end-to-end delivery semantics. We propose a new architecture which supports modular group composition by providing a distinction between intra-group and inter-group communication. With this architecture, multiple group communication protocols and end-to-end delivery semantics can be used in a single system. These features reduce the complexity of ordering messages in a group composition, resulting in enhanced scalability. Finally we present simulation results comparing the performance of a group composition using our architecture to that of a single process group.

This paper examines the network routing messages exchanged between core Internet backbone routers. Internet routing instability, or the rapid fluctuation of network reachability information, is an important problem currently facing the Internet engineering community. High levels of network instability can lead to packet loss, increased network latency and time to convergence. At the extreme, high levels of routing instability have led to the loss of internal connectivity in wide-area, national networks. In an earlier study of inter-domain routing, we described widespread, significant pathological behaviour in the routing information exchanged between backbone service providers at the major US public Internet exchange points. These pathologies included several orders of magnitude more routing updates in the Internet core than anticipated, large numbers of duplicate routing messages, and unexpected frequency components between routing instability events. The work described in this paper extends our earlier analysis by identifying the origins of several of these observed pathological Internet routing behaviour. We show that as a result of specific router vendor software changes suggested by our earlier analysis, the volume of Internet routing updates has decreased by an order of magnitude. We also describe additional router software changes that can decrease the volume of routing updates exchanged in the Internet core by an additional 30 percent or more. We conclude with a discussion of trends in the evolution of Internet architecture and policy that may lead to a rise in Internet routing instability.

This paper presents a real-time primary-backup replication scheme to support fault-tolerant data access in a real-time environment. The main features of the system are fast response to client requests, bounded inconsistency between primary and backup, temporal consistency guarantee for replicated data, and quick recovery from failures. The paper defines external and interobject temporal consistency, the notion of phase variance, and builds a computation model that ensures such consistencies for replicated data deterministically where the underlying communication mechanism provides deterministic message delivery semantics and probabilistically where no such support is available. It also presents an optimization of the system and an analysis of the failover process which includes failover consistency and failure recovery time. An implementation of the proposed scheme is built within the x-kernel architecture on the MK 7.2 microkernel from the Open Group. The results of a detailed performance evaluation of this implementation are also discussed.

The paper presents a real-time primary-backup (RTPB) replication scheme for supporting fault-tolerant real-time applications. It formally defines two types of temporal consistency, namely external temporal consistency and inter-object temporal consistency. By introducing a key concept called phase variance, the authors are able to build temporal consistency models and derive necessary and sufficient conditions that can be used as the basis for update and transmission scheduling that achieve temporal consistency guarantees. Furthermore, they prove that the term phase variance used in the models can be bounded under various scheduling algorithms, namely EDF, rate monotonic and distance-constrained scheduling. A RTPB implementation was developed within the x-kernel architecture on the MK 7.2 microkernel and the results of a detailed performance evaluation is also discussed.

This paper describes the architecture and implementation of Windmill, a passive network protocol performance measurement tool. Windmill enables experimenters to measure a broad range of protocol performance metrics by both reconstructing application-level network protocols and exposing the underlying protocol layers' events. Windmill is split into three functional components: a dynamically compiled Windmill Protocol Filter (WPF), a set of abstract protocol modules, and an extensible experiment engine. To demonstrate Windmill's utility, the results from several experiments are presented. The first set of experiments suggests a possible cause for the correlation between Internet routing instability and network utilization. The second set of experiments highlights: Windmill's ability to act as a driver for a complementary active Internet measurement apparatus, its ability to perform online data reduction, and the non-intrusive measurement of a closed system.

The primary-backup replication model is one of the commonly adopted approaches to providing fault tolerant data services. Its extension to the real time environment, however, imposes the additional constraint of timing predictability, which requires a bounded overhead for managing redundancy. The paper discusses the trade-off between reducing system overhead and increasing (temporal) consistency between the primary and backup, and explores ways to optimize such a system to minimize either the inconsistency or the system overhead while maintaining the temporal consistency guarantees of the system. An implementation built on top of the existing RTPB model (H. Zou and F. Jahanian, 1998) was developed within the x-kernel architecture on the Mach OSF platform running MK 7.2. Results of an experimental evaluation of the proposed optimization techniques are discussed.

This paper examines the network interdomain routing information exchanged between backbone service providers at the major US public Internet exchange points. Internet routing instability, or the rapid fluctuation of network reachability information, is an important problem currently facing the Internet engineering community. High levels of network instability can lead to packet loss, increased network latency and time to convergence. At the extreme, high levels of routing instability have led to the loss of internal connectivity in wide-area, national networks. We describe several unexpected trends in routing instability, and examine a number of anomalies and pathologies observed in the exchange of inter-domain routing information. The analysis in this paper is based on data collected from border gateway protocol (BGP) routing messages generated by border routers at five of the Internet core's public exchange points during a nine month period. We show that the volume of these routing updates is several orders of magnitude more than expected and that the majority of this routing information is redundant, or pathological. Furthermore, our analysis reveals several unexpected trends and ill-behaved systematic properties in Internet routing. We finally posit a number of explanations for these anomalies and evaluate their potential impact on the Internet infrastructure.

The paper provides an experimental comparison of two middleware data dissemination services: a distributed object based service, and a message based service. The paper compares these two services in the context of a common application: a wide area network collaboratory, namely the Upper Atmospheric Research Collaboratory (UARC). UARC is an example of an application that reliably streams data from a set of suppliers to a set of receivers. This comparison highlights the tradeoffs between ease of implementation and performance for a data streaming middleware service. By relying on a rigid language primitive, namely remote method invocation, the object based dissemination service gave up the control over its transport policies. In contrast, the lower level socket based service was specifically constructed to provide a flexible interface to its applications. This flexibility allowed the middleware to better support data delivery to a heterogeneous set of receivers. This is important in a wide area distributed system where hosts are connected together over a broad spectrum of network links. The paper provides a concrete example of the effects of high level design choices in the implementation of a wide area distributed system's communication middleware.

This paper examines the network inter-domain routing information exchanged between backbone service providers at the major U.S. public Internet exchange points. Internet routing instability, or the rapid fluctuation of network reachability information, is an important problem currently facing the Internet engineering community. High levels of network instability can lead to packet loss, increased network latency and time to convergence. At the extreme, high levels of routing instability have lead to the loss of internal connectivity in wide-area, national networks. In this paper, we describe several unexpected trends in routing instability, and examine a number of anomalies and pathologies observed in the exchange of inter-domain routing information. The analysis in this paper is based on data collected from BGP routing messages generated by border routers at five of the Internet core's public exchange points during a nine month period. We show that the volume of these routing updates is several orders of magnitude more than expected and that the majority of this routing information is redundant, or pathological. Furthermore, our analysis reveals several unexpected trends and ill-behaved systematic properties in Internet routing. We finally posit a number of explanations for these anomalies and evaluate their potential impact on the Internet infrastructure.

TCP, the de facto standard transport protocol in today's operating systems, is a very robust protocol that adapts to various network characteristics, packet loss, link congestion, and even significant differences in vendor implementations. This paper describes a set of experiments performed on six different vendor TCP implementations using ORCHESTRA, a tool for testing and fault injection of communication protocols. These experiments uncovered violations of the TCP protocol specification, and illustrated differences in the philosophies of various vendors in their implementations of TCP. The paper summarizes several lessons learned about the TCP implementations through these experiments. © 1997 John Wiley & Sons, Ltd.

Real-time applications typically operate under strict timing and dependability constraints. Although traditional data replication protocols provide fault tolerance, real-time guarantees require bounded overhead for managing this redundancy. This paper presents the design and evaluation of a window-consistent primary-backup replication service that provides timely availability of the repository by relaxing the consistency of the replicated data. The service guarantees controlled inconsistency by scheduling update transmissions from the primary to the backup(s); this ensures that client applications interact with a window-consistent repository when a backup must supplant a failed primary. Experiments on our prototype implementation, on a network of Intel-based PCs running RT-Mach, show that the service handles a range of client loads while maintaining bounds on temporal inconsistency.

Article Corona: a communication service for scalable, reliable group collaboration systems Share on Authors: Robert W. Hall Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MI Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MIView Profile , Amit Mathur Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MI Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MIView Profile , Farnam Jahanian Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MI Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MIView Profile , Atul Prakash Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MI Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MIView Profile , Craig Rassmussen Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MI Software Systems Research Laboratory, Department of Electrical Engineering and Computer Science, The University of Michigan, Ann Arbor, MIView Profile Authors Info & Claims CSCW '96: Proceedings of the 1996 ACM conference on Computer supported cooperative workNovember 1996 Pages 140–149https://doi.org/10.1145/240080.240238Online:16 November 1996Publication History 44citation628DownloadsMetricsTotal Citations44Total Downloads628Last 12 Months14Last 6 weeks2 Get Citation AlertsNew Citation Alert added!This alert has been successfully added and will be sent to:You will be notified whenever a record that you have chosen has been cited.To manage your alert preferences, click on the button below.Manage my AlertsNew Citation Alert!Please log in to your account Save to BinderSave to BinderCreate a New BinderNameCancelCreateExport CitationPublisher SiteGet Access

As software control of time-critical functions in embedded systems becomes more common, a means for the precise specification of their behavior and formal methods for analyzing system requirements become increasingly important. Modechart is a graphical specification language introduced to meet this need. The main focus of this paper is on methods and supporting tools for representing and reasoning about properties of time-critical systems specified in Modechart. The paper describes a verification methodology which takes advantage of the structuring inherent in a Modechart specification to determine whether a system specification satisfies the required properties. The paper also describes the implementation of a mechanical verifier, based on the proposed approach, which has been recently integrated as part of the Modechart Toolset prototype development environment from the Naval Research Lab [7].

Ensuring that a distributed system with strict dependability constraints meets its prescribed specification is a growing challenge that confronts software developers and system engineers. This paper presents a technique for probing and fault injection of fault-tolerant distributed protocols. The proposed technique, called script-driven probing and fault injection, can be used for studying the behavior of distributed systems and for detecting design and implementation errors of fault-tolerant protocols. The focus of this work is on fault injection techniques that can be used to demonstrate three aspects of a target protocol: i) detection of design or implementation errors, ii) identification of violations of protocol specifications, and iii) insight into design decisions made by the implementers. The emphasis of our approach is on experimental techniques intended to identify specific "problems" in a protocol or its implementation rather than the evaluation of system dependability through statistical metrics such as fault coverage. To demonstrate the capabilities of this technique, the paper describes a probing and fault injection tool, called the PFI tool (Probe/Fault Injection Tool), and a summary of several extensive experiments that studied the behavior of two protocols: the transmission control protocol (TCP) and a group membership protocol (GMP).

Ensuring that a distributed real-time system with strict dependability constraints meets its prescribed specification is a growing challenge that confronts software developers and system engineers. This paper reports on a software fault injection tool, called SockPFI, for testing the fault tolerance and timing behavior of distributed real-time applications. SockPFI, developed on Real-Time Mach, can be used to test socket-based distributed real-time applications on this platform without modifying the source code of the target protocol. The SockPFI tool is based on the concept of script-driven probing and fault injection. It is explicitly designed to address some of the intrusiveness associated with fault injection of distributed systems, and in particular, with real-time protocols. The paper describes the design and implementation of SockPFI on Real Time Mach, and a demonstration of the tool on a real-time primary-backup replication protocol.

Ensuring that a distributed system with strict dependability constraints meets its prescribed specification is a growing challenge that confronts software developers and system engineers. This paper presents a technique for probing and fault injection of fault-tolerant distributed protocols. The proposed technique, called script-driven probing and fault injection, can be used for studying the behaviour of distributed systems and for detecting design and implementation errors of fault-tolerant protocols. The focus of this work is on fault injection techniques that can be used to demonstrate three aspects of a target protocol: detection of design or implementation errors; identification of violations of protocol specifications; and insight into design decisions made by the implementers. The emphasis of our approach is on experimental techniques intended to identify specific “problems” in a protocol or its implementation rather than the evaluation of system dependability through statistical metrics such as fault coverage. To demonstrate the capabilities of this technique, the paper describes a probing and fault injection tool, called the PFI tool (probe/fault injection tool), and a summary of several extensive experiments that studied the behaviour of two protocols: the Transmission Control Protocol (TCP) and a group membership protocol (GMP).

Present a specification language for real-time systems called Modechart. The semantics of Modechart is given in terms of real-time logic (RTL), which is especially amenable to reasoning about the absolute (real-time clock) timing of events. The semantics of Modechart has an important property that the translation of a Modechart specification into RTL formulas results in a hierarchical organization of the resulting RTL assertions. This gives us significant leverage in reasoning about properties of a system by allowing us to filter out assertions that concern lower levels of abstraction. Some results about desirable properties of Modechart specifications are given. A graphical implementation of Modechart has been completed.>

The specification, design and implementation of a set of protocols to solve the processor group membership problem in distributed systems are presented. These group membership protocols were developed as part of a toolkit for building distributed/parallel applications on a cluster of workstations. The group membership service forms the lowest layer in the toolkit, and is the glue which unifies all other layers. The membership service supports three distinct protocols: weak, strong, and hybrid. These protocols differ significantly in the level of consistency and the number of messages exchanged in reaching agreement. The modular implementation of these protocols and the optimization techniques used to enhance their performance are described.>

A run-time environment for monitoring distributed real-time systems is described. In particular, the authors focus on the problem of detecting violations of timing assertions in an environment in which the real-time tasks run on multiple processors, and timing constraints can be either interprocessor or intraprocessor constraints. Constraint violations are detected at the earliest possible time by deriving and checking intermediate constraints. If the violations must be detected as early as possible, then the problem of minimizing the number of messages to be exchanged between the processors becomes intractable. The authors characterize a subclass of timing constraints that occur commonly in distributed real-time systems and whose message requirements can be minimized. They also take into account the drift among the various processor clocks when detecting a violation of a timing assertion. Finally, an implementation of a distributed run-time monitor is described.>

A model and an implementation of a run-time environment for specifying and monitoring properties of real-time systems are presented. The proposed approach supports annotating real-time programs with events that are recorded and examined at run-time. The authors provide two general methods for synchronous or asynchronous monitoring of real-time constraints. In the synchronous case, a system constraint is embedded inside a program; thus, the constraint is examined at a particular point in the execution of a real-time task. In the asynchronous case, a constraint is monitored by a separate task during the entire execution of real-time tasks. The authors also describe an implementation of a run-time monitoring toolkit as a set of library function calls in C.>

The authors present a timestamp-based protocol for checkpointing the global state of a long-lived distributed computation in an environment in which processor clocks are approximately synchronized. The protocol is based on periodic checkpointing of local process states and logging of incoming messages during a short bounded interval. It tolerates process crash and performance failures as well as network omission and performance failures. The proposed approach has the advantage of optimistic logging protocols in that it does not require synchronous logging of each message on stable storage. The approach also has the advantage of pessimistic logging protocols in that it avoids the domino effect by recovering to the most recent successful local checkpoint.>

A method is presented for the specification and verification of real-time systems in which some of the timing constraints are specified as variables. These variables can be viewed as parameters of the system under consideration. A set of inequalities restricts the range of values that a variable can be assigned relative to other variables (parameters) of the system. The proposed method extends an earlier work by F. Jahanian and D.A. Stuart (1988) for verifying properties of systems expressed in the Modechart language where timing constraints were specified as integer constants. Also presented are results on the undecidability of verifying properties of systems.>

This paper presents a graph-theoretic algorithm for safety analysis of a class of timing properties in real-time systems which are expressible in a subset of real time logic (RTL) formulas. Our procedure is in three parts: the first part constructs a graph representing the system specification and the negation of the safety assertion. The second part detects positive cycles in the graph using a node removal operation. The third part determines the consistency of the safety assertion with respect to the system specification based on the positive cycles detected. The implementation and an application of this procedure will also be described.

The authors formalize the safety analysis of timing properties in real-time systems. The analysis is based on a formal logic, RTL (real-time logic), which is especially suitable for reasoning about the timing behavior of systems. Given the formal specification of a system and a safety assertion to be analyzed, the goal is to relate the safety assertion to the systems specification. There are three distinct cases: (1) the safety assertion is a theorem derivable from the systems specification; (2) the safety assertion is unsatisfiable with respect to the systems specification; or (3) the negation of the safety assertion is satisfiable under certain conditions. A systematic method for performing safety analysis is presented.