In light of the unprecedented proliferation of cloud-native applications, cyber threats targeting cloud services have escalated markedly, emerging as a critical concern for stake-holders. The intrinsic nature of cloud infrastructures renders them particularly susceptible to diverse attacks. In this context, effective attack identification becomes pivotal, facilitating swift responses and preventive measures to mitigate risks and bolster overall security resilience. Despite a range of solutions in literature, attack classification remains an arduous task in industrial environments. To address this, we propose a comprehensive and deployment-friendly graph-based framework. It leverages cloud activity traces, transforming system events to graph structures, and we enumerate 4 different types of attack within a controlled environment. We frame a multi-classification problem, and construct multi-level features to characterize distinct attacks amidst background activities, bypassing the complexity of Deep Learning (DL). To evaluate the efficacy, we compare with multiple Graph Neural Networks (GNNs), and our solution yields comparable performance, demonstrating a promising candidate for the practical and efficient cyber threat detection.

In the past few years, accelerated by Covid-19 pandemic, real-time services based on RTC (Real-Time Communications) have become pervasive, and their performance has become critical for a wide range of business and entertainment applications. The diffusion of RTC services beyond controlled enterprise network perimeters poses the challenge of guaranteeing high-quality, reliable, in-time delivery over the Internet and at global, worldwide scale. In this paper, we address such a problem by proposing ROBUST, a Reliable and Flexible Media Transport based on Pub/Sub Information-Centric Networking (ICN) principles. ROBUST brings enhanced reliability and flexibility to RTC applications over varying network environments and conditions. ROBUST initial design is experimentally assessed on three popular Video Conferencing applications (Jitsi Meet, Cisco Webex, and Zoom) with encouraging improvements in terms of objective Quality of Experience (QoE) metrics: e.g., we observe at least 91% loss recovery in the most challenging experimental settings, an improved video smoothness for Zoom up to 160%, a higher resolution for Webex up to 16%, while Jitsi with ROBUST works in conditions where the original application does not.

Real-time communication (RTC) applications have become largely popular in the last decade with the spread of broadband and mobile Internet access. Nowadays, these platforms are a fundamental means for connecting people and supporting businesses that increasingly rely on forms of remote work. In this context, it is of paramount importance to operate at the network level to ensure adequate Quality of Experience (QoE) for users, and appropriate traffic management policies are essential to prioritize RTC traffic. This in turn requires the network to be able to identify RTC streams and the type of content they carry. In this paper, we propose a machine learning-based application to classify media streams generated by RTC applications encapsulated in Secure Real-Time Protocol (SRTP) flows in real-time. Using carefully tuned features extracted from packet characteristics, we train models to classify streams into a variety of classes, including media type (audio/video), video quality, and redundant streams. We validate our approach using traffic from over 62 hours of multi-party meetings conducted using two popular RTC applications, namely Cisco Webex Teams and Jitsi Meet. We achieve an overall accuracy of 96% for Webex and 95% for Jitsi, using a lightweight decision tree model that makes decisions based solely on 1 second of real-time traffic. Our results show that models trained for a particular meeting software have difficulty when used with another one, although domain adaptation techniques facilitate the transfer of pre-trained models.

Real-time communication (RTC) platforms have become increasingly popular in the last decade, together with the spread of broadband Internet access. They are nowadays a fundamental means for connecting people and supporting the economy, which relies more and more on forms of remote working. In this context, it is particularly important to act at the network level to ensure adequate Quality of Experience (QoE) to users, where proper traffic management policies are essential to prioritize RTC traffic. This, in turn, requires in-network devices to identify RTC streams and the type of content they carry. In this paper, we propose a machine learning-based application to classify, in real-time, the media streams generated by RTC applications encapsulated in Secure Real Time Protocol (SRTP) flows. Using carefully tuned features extracted from packet characteristics, we train a model to classify streams into an ample set of classes, including media type (audio/video), video quality and redundant streams. To validate our approach, we use traffic from more than 88 hours of multi-party meeting calls made using the Cisco Webex Teams application. We reach an overall accuracy of 97% with a light-weight decision tree model, which makes decisions using only 1 second of traffic.

Real-Time Communication (RTC) applications have become ubiquitous and are nowadays fundamental for people to communicate with friends and relatives, as well as for enterprises to allow remote working and save travel costs. Countless competing platforms differ in the ease of use, features they implement, supported user equipment and targeted audience (consumer of business). However, there is no standard protocol or interoperability mechanism. This picture complicates the traffic management, making it hard to isolate RTC traffic for prioritization or obstruction. Moreover, undocumented operation could result in the traffic being blocked at firewalls or middleboxes. In this paper, we analyze 13 popular RTC applications, from widespread consumer apps, like Skype and Whatsapp, to business platforms dedicated to enterprises - Microsoft Teams and Webex Teams. We collect packet traces under different conditions and illustrate similarities and differences in their use of the network. We find that most applications employ the well-known RTP protocol, but we observe a few cases of different (and even undocumented) approaches. The majority of applications allow peer-to-peer communication during calls with only two participants. Six of them send redundant data for Forward Error Correction or encode the user video at different bitrates. In addition, we notice that many of them are easy to identify by looking at the destination servers or the domain names resolved via DNS. The packet traces we collected, along with the metadata we extract, are made available to the community.

WebRTC is increasingly adopted by real-time streaming applications beyond traditional multiparty collaboration, in virtue of its low-latency capabilities. To support large scale deployments, the WebRTC architecture has evolved from the original peer-to-peer design to a centralized MCU-based (Multipoint Control Unit) system first, then to a lighter, SFU-based (Selective Forwarding Unit) system where media encoding/decoding and rate selection is delegated to the clients.In this paper we present ICN-RTC, a real time communication architecture build on the latest SFU-based proposal that exploits the scalability benefits provided by Information-Centric Networking (ICN). We also propose the ICN-RTC synchronization protocol, a protocol that allows to use the pull-based transport of ICN without introducing additional latency to media distribution.We implemented ICN-RTC using Hybrid ICN, an incrementally deployable ICN implementation using IP. Preliminary results are encouraging: ICN-RTC scales with the number of active speakers rather than the total number of users in the conference. This allows for calls with ten times more participants with respect to the standard WebRTC, reducing the resources needed for the call by more than a hundred times.

Introduced as an extension of the Cloud at the network edge for computing and storage purposes, the Fog is increasingly considered a key enabler for Internet-of-Things applications whose latency requirements are not compatible with a Cloud-only approach. Unlike Cloud platforms, which can elastically accommodate large numbers of requests, Fog deployments are usually dimensioned for an average traffic load and, thus, unable to handle sudden bursts of requests without violating latency guarantees. In this article, we address the problem of efficiently controlling Fog admission to guarantee application response time. We propose request-aware admission control (AC) strategies maximizing the number of Fog-handled requests by means of dynamic popularity estimation. In particular, the LRU-AC , an AC strategy based on online learning of the request popularity distribution via a Least Recently Used (LRU) filter, is introduced. We contribute an analytical model for assessing LRU-AC performance and quantifying the incurred reduction of Cloud offload cost, w.r.t. both an ideal oracle-based and a request-oblivious AC strategy. Further, we propose a feasible implementation design of LRU-AC on FPGA hardware using Aging Bloom Filters (ABF) to mimic the function of the LRU-AC, while providing a compact memory representation. The use of ABFs for LRU-AC is theoretically validated and verified through simulation. The current implementation shows a throughput of 16.7 Mpps and a processing latency of less than 3μ s while multiplying the Fog acceptance-rate by 10 in the evaluated scenario.

The future landscape of a heterogeneous and unified access (WiFi and Cellular), where users and applications interact with heterogeneous multi-cloud networks, with many different services collaborating together, poses significant challenges to ISP, Enterprises, Cloud Providers and the applications themselves, in particular in terms of Policies, Security and QoE. In this demonstration we showcase the potential of Hybrid ICN (hICN) in the context of enforcing inter-domain policies: exploiting the connection-less, app-aware, multipoint transport of hICN we are able to manage policies on a per-application basis, combining multiple objectives of different players (ISP, Enterprise, Users) in a dynamic and seamless manner.

Information-Centric Networking (ICN) is a novel network architecture designed to replace the current IP-based architecture. In ICN, contents are identified based on unique names and can be cached in-network in order to immediately serve subsequent requests. These characteristics are particularly important in the context of the Internet of Things (IoT), where they allow to heavily reduce loads on the things, as well as increase content availability and decrease energy consumption. In this paper we address the open problem of providing access control for IoT deployments in ICN. Our protocol takes advantage of the reliance of IoT on Infrastructure-as-a-Service and provides confidentiality, traitor tracing and revocation of an unbound number of users. At the same time, our protocol preserves both network caching and location-independent content retrieval. To the best of our knowledge, our protocol is the first access control protocol for ICN providing all these advantages. We provide an extensive analysis of the security properties of our protocol, as well as a thorough experimental evaluation. Our evaluation shows that our protocol does not pose significant over-head with respect to published content size nor computational time required. Considering a popular IoT camera, our evaluation shows that our protocol introduces 0.27% size overhead and 150ms of computational overhead for a 7 seconds stream.

We propose and evaluate simple signals coming from in-network telemetry that are effective to enhance the quality of DASH streaming. Specifically, in-network caching is known to positively affect DASH streaming quality but at the same time negatively affect the controller stability, increasing the quality switch ratio. Our contributions are to first (i) consider the broad spectrum of interaction between the network and the application, and then (ii) to devise how to effectively exploit in a DASH controller a very simple signal (i.e., per-quality hit ratio) that can be exported by framework such as Server and Network Assisted DASH (SAND) at fairly low rate (i.e., a timescale of 10s of seconds). Our thorough experimental campaign confirms the soundness of the approach (that significantly ameliorate performance with respect to network-blind DASH), as well as its robustness (i.e., tuning is not critical) and practical appeal (i.e., due to its simplicity and compatibility with SAND).

Mobility has become a basic premise of network communications, thereby requiring a native integration into 5G networks. Despite numerous efforts to propose and standardize effective mobility-management models for IP, the result is a complex, poorly flexible set of mechanisms. The natural support for mobility offered by information centric networking (ICN) makes it a good candidate to define a radically new solution relieving limitations of the traditional approaches. If consumer mobility is supported in ICN by design, in virtue of its connectionless pull-based communication model, producer mobility is still an open challenge. In this paper, we look at two prominent ICN architectures, content centric networking (CCN) and named data networking (NDN) and we propose MAP-Me, an anchor-less solution to manage micro-mobility of content producers via a name-based CCN/NDN data plane, with support for latency-sensitive streaming applications. We analyze MAP-Me performance and provide guarantees of correctness, stability, and bounded stretch, which we verify on real ISP topologies. Finally, we set up a comprehensive simulation environment in NDNSim 2.1 for MAP-Me evaluation and comparison against the existing classes of solutions, including a realistic trace-driven car-mobility pattern under a 802.11n radio access. The results are encouraging and highlight the superiority of MAP-Me in terms of user performance and network cost metrics. All the code is available as open-source.

Streaming of video content over the Internet is experiencing an unprecedented growth. While video permeates every application, it also puts tremendous pressure in the network-to support users having heterogeneous accesses and expecting a high quality of experience, in a furthermore cost-effective manner. In this context, future internet paradigms, such as information centric networking (ICN), are particularly well suited to not only enhance video delivery at the client (as in the dynamic adaptive streaming over HTTP (DASH) approach), but to also naturally and seamlessly extend video support deeper in the network functions. In this paper, we contrast ICN and transmission control protocol/internet protocol (TCP/IP) with an experimental approach, where we employ several state-of-the-art DASH controllers (PANDA, AdapTech, and BOLA) on an ICN versus TCP/IP network stack. Our campaign, based on tools that we developed and made available as open-source software, includes multiple clients (homogeneous vesrus heterogeneous mixture and synchronous vesrus asynchronous arrivals), videos (up to 4k resolution), channels (e.g., DASH profiles, emulated WiFi and LTE, and real 3G/4G traces), and levels of integration with an ICN network (i.e., vanilla named data networking (NDN), wireless loss detection and recovery at the access point, and load balancing). Our results clearly illustrate, as well as quantitatively assess, the benefits of ICN-based streaming, warning about potential pitfalls that are however easy to avoid.

The rapid traffic growth fueled by mobile devices spread and high speed network access calls for substantial innovation at network layer. The content-centric nature of Internet usage highlights the limitations of the host-centric model in coping with dynamic content-to-location binding, mobility, multicast, multi-homing, etc. If transmission capacity speedups in the backhaul may hide inefficiencies in the short term, the hostcentric communication model needs to be revisited to sustain future mobile demand. In this paper, we first identify and quantify the opportunities for backhaul evolution by analyzing a large set of traffic measurements collected between mobile core and backhaul of Orange France. The analysis reveals that 50% of HTTP requests are cacheable and traffic can be reduced from 60% to 95% during the peak hour by using 350GBs to 1TB of memory overall. Motivated by such significant opportunities for latency reduction and network cost savings, we present a solution based on Information-Centric Networking (ICN). First results of a large scale experimentation with 100 Linux servers and customized software, in a realistic network setting, provide a glimpse into ICN gains even under naive caching: a factor three reduction in delivery time and almost 40% bandwidth savings, when compared to existing alternatives.

Latency-minimization is recognized as one of the pillars of 5G network architecture design. Information-Centric Networking (ICN) appears a promising candidate technology for building an agile communication model that reduces latency through in-network caching. However, no proposal has developed so far latency-aware cache management mechanisms for ICN. In the paper, we investigate the role of latency awareness on data delivery performance in ICN and introduce LAC, a new simple, yet very effective, Latency-Aware Cache management policy. The designed mechanism leverages in a distributed fashion local latency observations to decide whether to store an object in a network cache. The farther the object, latency-wise, the more favorable the caching decision. By means of simulations, show that LAC outperforms state of the art proposals and results in a reduction of the content mean delivery time and standard deviation by up to 50%, along with a very fast convergence to these figures.

The evolution of the Internet into a distributed Information access system calls for a paradigm shift to enable an evolvable future network architecture. Information-Centric Networking (ICN) proposals rethink the communication model around named data, in contrast with the host-centric transport view of TCP/IP. Information retrieval is natively pull-based, driven by user requests, point-to-multipoint and intrinsically coupled with in-network caching. In this paper, we tackle the problem of joint multipath congestion control and request forwarding in ICN for the first time. We formulate it as a global optimization problem with the twofold objective of maximizing user throughput and minimizing overall network cost. We solve it via decomposition and derive a family of optimal congestion control strategies at the receiver and of distributed algorithms for dynamic request forwarding at network nodes. An experimental evaluation of our proposal is carried out in different network scenarios to assess the performance of our design and to highlight the benefits of an ICN approach.

Internet performance is tightly related to the properties of TCP and UDP protocols, jointly responsible for the delivery of the great majority of Internet traffic. It is well understood how these protocols behave under first-in-first-out (FIFO) queuing and what are the network congestion effects. However, no comprehensive analysis is available when flow-aware mechanisms such as per-flow scheduling and dropping policies are deployed. Previous simulation and experimental results leave a number of unanswered questions. In this paper, we tackle this issue by modeling via a set of fluid nonlinear ordinary differential equations (ODEs) the instantaneous throughput and the buffer occupancy of long-lived TCP sources under three per-flow scheduling disciplines (Fair Queuing, Longest Queue First, Shortest Queue First) and with longest queue drop buffer management. We study the system evolution and analytically characterize the stationary regime: Closed-form expressions are derived for the stationary throughput/sending rate and buffer occupancy, which give a thorough understanding of short/long-term fairness for TCP traffic. Similarly, we provide the characterization of the loss rate experienced by UDP flows in the presence of TCP traffic. As a result, the analysis allows to quantify benefits and drawbacks related to the deployment of flow-aware scheduling mechanisms in different networking contexts. The model accuracy is confirmed by a set of simulations and by the evaluation of the three scheduling disciplines in a real implementation in the Linux kernel.

Content-Centric Networking is a new communication architecture that rethinks the Internet communication model, designed for point-to-point connections between hosts, and centers it around content dissemination and retrieval. Most of the issues faced by the current IP infrastructure in terms of mobility management, security, scalability, which are accrued by today's Internet trends, find a natural solution in CCN shift from IP addresses to named data. In this paper we explore the impact of storage management on the performance of multiple applications sharing the same CCN infrastructure and we quantify the effectiveness of static storage partitioning and dynamic management techniques in providing service differentiation. To this purpose, we implement a set of storage management techniques in the open source CCNx prototype and perform extensive experiments in a real testbed under fairly realistic network conditions. Our experimental results allow to clarify the relation between CCN chunk-level caching and Quality of Experience (QoE) perceived by end users.

BitTorrent developers have recently introduced a new application layer congestion control algorithm based on UDP framing at transport layer and currently under definition at the IETF ledbat Working Group. Ledbat is a delay-based protocol which aims at offering a ``lower than Best Effort'''' data transfer service, with a lower priority with respect to elastic TCP and interactive traffic (e.g., VoIP, game). However, in its current specification, ledbat is affected by a late-comer advantage: indeed the last flow arriving at the bottleneck is more aggressive due to a wrong estimation of the base delay and finally takes over all resources. In this work, we study several solutions to the late-comer problem by means of packet level simulations and simple analysis: in the investigation process, we individuate the root cause for LEDBAT unfairness and propose effective countermeasures.

Internet performance is tightly related to the properties of TCP and UDP protocols, jointly responsible for the delivery of the great majority of Internet traffic. It is well understood how these protocols behave under FIFO queuing and what are the network congestion effects. However, no comprehensive analysis is available when flow-aware mechanisms such as per-flow scheduling and dropping policies are deployed. Previous simulation and experimental results leave a number of unanswered questions. In the paper, we tackle this issue by modeling via a set of fluid non-linear ODEs the instantaneous throughput and the buffer occupancy of N long-lived TCP sources under three per-flow scheduling disciplines (Fair Queuing, Longest Queue First, Shortest Queue First) and with longest queue drop buffer management. We study the system evolution and analytically characterize the stationary regime: closed-form expressions are derived for the stationary throughput/sending rate and buffer occupancy which give a thorough understanding of short/long-term fairness for TCP traffic. Similarly, we provide the characterization of the loss rate experienced by UDP flows in presence of TCP traffic. As a result, the analysis allows to quantify benefits and drawbacks related to the deployment of flow-aware scheduling mechanisms in different networking contexts. The model accuracy is confirmed by a set of ns2 simulations and by the evaluation of the three scheduling disciplines in a real implementation in the Linux kernel.

Last year, the official BitTorrent client switched to LEDBAT, a new congestion control algorithm targeting a lower-than Best Effort transport service. In this paper, we study this new protocol through packet-level simulations, with a special focus on a performance comparison with other lower-than Best Effort protocols such as TCP-LP and TCP-NICE: our aim is indeed to quantify and relatively weight the level of Low-priority provided by such protocols. Our results show that LEDBAT transport generally achieves the lowest possible level of priority, with the default configurations of TCP-NICE and TCP-LP representing increasing levels of aggressiveness. In addition, we perform a careful sensitivity analysis of LEDBAT performance, by tuning its main parameters in both an inter-protocol (against TCP) and intra-protocol (against LEDBAT itself) scenarios. In the inter-protocol case, even in case of misconfiguration LEDBAT competes as aggressively as TCP, but we show that it is not possible to achieve an arbitrary level of low-priority by merely tuning its parameters. In the intra-protocol case, we show that coexistence of legacy flows with slightly dissimilar settings, or experiencing different network conditions, can result in significant unfairness.

The unsatisfactory performance of TCP in high speed wide area networks has led to several versions of TCP- like H-TCP, Fast TCP, Scalable TCP, Compound or CUBIC, all aimed at speeding up the window update algorithm. In this paper we focus on Scalable TCP (STCP), a TCP version which belongs to the class of Multiplicative Increase Multiplicative Decrease (MIMD) congestion protocols. We present a new stochastic model for the evolution of the instantaneous throughput of a single STCP flow in the Congestion Avoidance phase, under the assumption of a constant per-packet loss probability. This model allows one to derive several closed-form expressions for the key stationary distributions associated with this protocol: we characterize the throughput obtained by the flow, the time separating Multiplicative Decrease events, the number of bits transmitted over certain time intervals and the size of rate decrease. Several applications leveraging these closed form expressions are considered with a particular emphasis on QoS guarantees in the context of dimensioning. A set of ns2 simulations highlights the model accuracy.

A fundamental issue arising in mobile ad hoc networks (MANETs) is the selection of the optimal path between any two nodes. A method that has been advocated to improve routing efficiency is to select the most stable path so as to reduce the latency and the overhead due to route reconstruction. In this work, we study both the availability and the duration probability of a routing path that is subject to link failures caused by node mobility. In particular, we focus on the case where the network nodes move according to the Random Direction model, and we derive both exact and approximate (but simple) expressions of these probabilities. Through our results, we study the problem of selecting an optimal route in terms of path availability. Finally, we propose an approach to improve the efficiency of reactive routing protocols.

The split of a multihop, point to point TCP connection consists in replacing a plain, end-to-end TCP connection by a cascade of TCP connections. In such a cascade, connection n feeds connection n+1 through some proxy node n. This technique is used in a variety of contexts. In overlay networks, proxies are often peers of the underlying peer to peer network. Split TCP is also already proposed and largely adopted in wireless networks at the wired/wireless interface to separate links with vastly different characteristics. In order to avoid losses in the proxies, a backpressure mechanism is often used in this context. In this paper we develop a model for such a split TCP connection aimed at the analysis of the throughput dynamics on both links and that of the buffer occupancy in the proxy for long file transfers. The two main variants of Split TCP are considered: that with backpressure and that without. The study consists of two parts: the first part is purely experimental and is based on ns2 simulations. It allows us to identify complex interaction phenomena between TCP flow rates and proxy buffer occupancy, which seem to have been ignored by previous work on Split TCP. The second part of the paper is of mathematical nature. We establish the basic equations that govern the evolution of such a cascade and prove some of the experimental observations made in the first part. In particular, we give the conditions for system stability and we show the possibility of heavy tail asymptotics for proxy buffer occupancy and delays in the stationary regime.

This paper presents an application of basic concepts of statistical physics to devise an approximate model describing the dynamics of large peer-to-peer networks, based on fluid-diffusive equations. The model we propose is quite general and highly modular, and allows to represent several effects related to resources distribution among peers, user behavior, resource localization algorithms and dynamic structure of the overlay topology. Since the complexity of the model is largely independent of the system size, it provides a viable alternative to Montecarlo approaches for the analysis of very large P2P systems.