Supervisory Control and Data Acquisition (SCADA) system which monitors and controls physical processes/operations within a rail infrastructure is critical. SCADA system's accessing to key components and infrastructure information make it a promising attack target. This paper explores building machine learning models to detect anomalies in a rail SCADA system through the usage of network traffic data. The attack scenarios designed based on domain expertise are epoch time attack and TCP payload length attack in this paper. Data pre-processing is done before passing into machine learning approaches for training. The anomaly detection machine learning models are evaluated using several metrics such as true positive rate and precision. Results show that supervised learning approaches (K-Nearest Neighbours (KNN), Linear Support Vector Classification (LinearSVC), Random Forest, Gaussian Bayes) outperform unsupervised learning approach (K-Means). Exploration into the use of the full original network traffic versus a subset of network traffic for model training has shown that the latter performed better in precision due to the presence of overfitting to specific alarm network traffic. Finally, our experiment results show that supervised learning approach KNN is effective to detect the attacks with high precision.

Development and deployment of cyber security measures for legacy SCADA systems usually encounter challenges of limited computation resources in the field devices for supporting the designed cryptography processing. This paper presents a scheme with which the field device performs message authentication and integrity check only on selected critical packets such that it protects the system operation while avoiding high computation workload, and applies the scheme to a transportation SCADA system. The proposed scheme takes into account of the SCADA computation power limitation and real time requirements, and the extreme difficulty of making any changes to hardware or software in the legacy system. AES-CCM and symmetric key methods are applied for providing message authentication and integrity, and a bump-in-the-wire (BITW) implementation approach is adopted to avoid the changes to the legacy system. This lightweight packet authentication scheme is implemented and demonstrated over a testbed of a metro transportation SCADA system. Experiments show the effects of the scheme in blocking malicious packet attack and the comparison with a firewall approach.

This paper presents a new passive optical network (PON) architecture that applies an optical multicast capable switch (OMS) to direct wavelengths to a set of PON branches and enables them to share the transceivers in the central office (CO) on demand. The OMS is composed of fiber splitters and switching gates, and by controlling the on-off gates the wavelengths at the inputs can reach any outputs of the OMS. Through the OMS configuration, logical PONs are dynamically formed according to changing traffic patterns, and traffic is further scheduled in the time domain within each logical PON. The proposed network achieves network resource sharing without requiring tunable transceivers or wavelength filters, and without changing deployed network devices in the field or at the user end. Analysis and experimental study results show the efficiency of resource sharing and demonstrate the concept of resource sharing among PON branches.

The paper proposes a new PON architecture that applies an optical broadcast capable router (OBR) to route a wavelength to a set of selected PON branches and thus enables the transceivers in the central office (CO) to be shared among them. The OBR is built on fiber splitters and switching gates, and by controlling the gates the wavelengths at the inputs can reach any outputs of the OBR. Logical PONs are dynamically configured based on users' changing traffic patterns, and the traffic is further scheduled in the time domain in the logical PONs. The network achieves network resource sharing without requiring tunable transceivers or wavelength filters, and furthermore without changing deployed network devices in the field or at the user end. Experiment study and analysis results demonstrate the concept of resource sharing among PON branches and show the efficiency of resource sharing.

In this paper, we propose a topology-based Multicast-Capable (MC) nodes placement heuristic - Power Attenuation Constrained Placement (PACP) in amplifier-less power attenuation constrained all- optical metropolitan area network (AL-MAN). We define a selection function in our algorithm to find the 'best' locations in the network for a given number of MC nodes to achieve good performance in overall cost competitiveness (CC) while ensuring that power constraint is always satisfied. Through our simulation studies, we show that PACP is able to construct power constrained trees with cost close to the optimal cost, and also able to improve the CC as high as 6% compared to latest topology-based algorithm. The simulation results conclude that PACP is cost-resilient for amplifier-less optical multicast networks with small number of MC nodes, and with multicast sessions with low source power output.

In this paper, we introduce an IP multimedia sub-system (IMS) based testbed which provides a platform for the study of real-time services integration and orchestration. This open-source based testbed is built on the principle of service oriented architecture (SOA), with an emphasis for real-time network services. We further developed service-oriented system functionalities such as optical network connection and bandwidth management, mobile client authentication protocols, and video streaming services. They are packaged as interoperable service components, so that they can be integrated and orchestrated through their respective standard interfaces. Finally, we elaborated our proof-of-concept environment via a use-case scenario of having various client-server interactions over a heterogeneous network environment.

In this paper, we propose and study how to provide multipath cross-layer service discovery (MCSD) for mobile ad hoc networks (MANETs). Cross-layer service discovery integrates service discovery into route discovery by taking advantage of network-layer topology information and routing message exchange. Multipath service discovery differs from multipath routing in that multipath service discovery can be either multipath from a client to a server or multipath from a client to multiple servers, depending on the policy used in service selection and invocation. Compared with the traditional unipath cross-layer service discovery (UCSD), MCSD performs better in terms of improving throughput, enhancing service availability and optimizing network-layer resources. However, as a new service discovery scheme, MCSD posts a lot of challenges, particularly in the process of service discovery and how to find the optimal multipath. Due to the complexity of the problem, we focus on double-path cross-layer service discovery (DCSD), a special and most important case of MCSD. We present a heuristic, called iDCSD, which can intelligently find the optimal routes out of the candidate paths from a client to a server and from a client to two servers by minimizing hop count in network layer. Extensive simulation results show that compared with UCSD, (i) MCSD delivers better service availability; and (ii) the proposed iDCSD leads to a better network-layer performance with reasonable computational complexity.

IP Multimedia Subsystem (IMS) and Web services (WS) are service-oriented architectures developed separately for service delivery in the next generation telecommunications, and IT-centric computing environment, respectively. In order to harness services in both of these platforms and to facilitate combining and blending of services, we propose an integrated telecom and IT Service Delivery Platform for interworking between IMS and WS. We propose to use SIP-based Micro Service Orchestration and Web service bus to seamlessly integrate IMS, WS and the underlying services. We further present an example of managing multimedia services over an Ethernet Passive Optical Networks (EPON) infrastructure to illustrate that the proposed Service Delivery Platform has the benefits of supporting rapid development and deployment of new converged multimedia services.

The next-generation dynamically-reconfigurable intelligent GMPLS-based WDM optical networks are expected to operate at extremely high data rates (40 Gbps or beyond) and will be used to carry voice, data, and various other multimedia applications. In these networks a signalling protocol (such as RSVP-TE), which is used to dynamically set up lightpaths, should not only be fast and efficient, but must also be scalable and should try to maximize the number of accepted connections at an acceptable level of control overhead. In this paper, we propose a fast and efficient segmented signalling protocol (SSP) based on a novel concept of intermediate destinations (IDs), for wavelength reservation in GMPLS/WDM optical networks. In SSP, as the route is divided into a number of smaller independent segments on which RSVP-TE runs simultaneously, it reduces the setup time. Simulation experiments on 10times10 grid network show that the proposed protocol is fast with respect to setup time, efficient in terms of average call acceptance ratio and resource utilization.

With the increase of size and number of shared risk link groups (SRLGs), capacity efficiency of shared-path protection becomes much poorer due to SRLG-disjoint constraints and blocking probability becomes much higher due to severe traps. As a result, 100% SRLG failure protection is no longer a practical protection scheme. To solve this problem, we present a new protection scheme called best effort SRLG failure protection, in which we try to provide SRLG-disjoint backup path by choosing the backup path sharing the least number of SRLGs with the working path, so as to make the impact of SRLG failures as low as possible and accept as many as possible connection requests. 100% SRLG failure protection becomes a special case of best effort SRLG failure protection when the working path and backup path share zero SRLG. We propose a heuristic to find the best effort SRLG-disjoint backup path under dynamic traffic. The best effort SRLG failure protection scheme tries to make a trade-off between blocking probability and survivability. Analytical and simulation results show, compared with 100% SRLG failure protection, the proposed scheme offers much better capacity efficiency and much lower blocking probability while keeping survivability as high as possible.

This paper addresses the problem of dynamic routing of survivable sub-lambda traffic in heterogeneous grooming optical networks wherein sub-lambda client layer connections are multiplexed onto lambda connections on the optical layer. We present a differentiated survivability framework, which includes multi-layer survivability approaches with improved resource sharing methods based on inter-layer and inter-class resource sharing techniques. In addition to this, a new graph based network model is proposed, which supports both 1) the heterogeneity in a network, and 2) the coexistence of inter-layer and inter-class based resource sharing methods. The suitability of the model for a critical must-use grooming port scenario is presented. A tradeoff phenomenon between transceiver-usage and reserved links, which is inherent in the inter-layer sharing methods, is illustrated. Simulation experiments are carried out, and the performance variation and the tradeoff phenomenon are investigated.

Providing differentiated quality-of-protection (QoP) for surviving single-link failures in WDM mesh networks has been extensively studied in recent years. This paper investigates the problem of providing differentiated QoP for surviving arbitrary double-link failures by allowing a connection request to choose from several QoP classes. In this paper, we propose to use three classes, i.e., single shared-path protection (SSPP), single dedicated-path protection (SDPP), and double shared-path protection (DSPP) to provide differentiated QoP. We present two differentiated QoP schemes. Scheme 1 (conventional differentiated QoP) is a natural extension of conventional differentiated QoP for surviving single-link failures, which uses SDPP, SSPP, and SDPP separately to satisfy different QoP requirements. Scheme 2 (shared differentiated QoP) tries to share backup resources between SSPP and SDPP. Simulation results show that our proposed architecture of QoP can satisfy different QoP requirements for surviving double-link failures by making a balance between blocking probability and average QoP. Analytical and numerical results indicate that the proposed differentiated QoP scheme 2 are more efficient in improving not only blocking probability but also average QoP.

Integrated OPtical EtherNet (iOPEN) network was earlier proposed as an integrated Ethernet and reconfigurable WDM network, which supports Ethernet transport services in campus area and metro area networks. In this paper we propose and study network operation mechanisms for iOPEN network to achieve cost-effective network operation. VLAN approach is extended to operate new lightpaths, to support QoS services and traffic engineering, and to retain the Ethernet simplicity features. The proposed operation mechanisms are evaluated over an iOPEN testbed network.

In this paper, we consider the reliability of a connection as a parameter to denote different levels of fault- tolerance and propose a segment-based partial protection scheme for routing reliability-guaranteed connections in a resource efficient manner. In this scheme we try to provide a partial protection path instead of an end-to-end protection path to improve the reliability of a connection. To provide partial protection path, we need to identify primary segments which are less (more) reliable (vulnerable) to failures and select a suitable primary segment to provide a protection segment. However, identifying less-reliable primary segments which really contribute to achieve the required reliability and selection of resource-efficient protection segment among several possible segments are not trivial problems. In this paper, we develop efficient methods to address these problems. Apart from providing the reliability guarantee, the proposed scheme is able to recover all failures immediately, except the failures which are not covered by the protection segment. In this case the failed connections cannot be rerouted on to the protection segment and we initiate our proposed recovery process which handles all possible failure scenarios. We conduct extensive simulation experiments to evaluate the effectiveness of the proposed scheme on different network configurations with respect to three performance metrics: average spare wavelength usage, average recovery time, and average recovery ratio.

This paper addresses the problem of dynamic routing of sub-lambda connections with differentiated survivability using multi-layer protection and inter-layer backup resource sharing in IP/MPLS-over-WDM networks. When providing the differentiated survivability services, mission-critical high priority connections which require optical layer protection are more likely to be rejected than connections which require IP/MPLS layer protection because of the difference in protection granularity. To address this problem, we propose two re routing-based dynamic routing schemes for reducing the blocking of mission-critical connections. In the schemes, rerouting operation is done with the use of lightpaths called potential lightpaths, and an efficient heuristic algorithm is proposed for choosing them. Further, the schemes employ inter-layer backup sharing for the benefit of high priority connections and they adopt strategies which consider critical issues in finding and utilizing the potential lightpaths. Our schemes have several important and attractive features: 1) the schemes do not cause any interruption for ongoing traffic during normal operation, 2) the schemes improve the performance of mission-critical traffic without affecting the performance of other traffic significantly, and 3) the schemes are affordable in terms of computational intensity since the rerouting operation is done only when a mission-critical connection is not honored. Through simulation experiments we investigate the performance of the proposals and verify their effectiveness

This paper addresses the problem of achieving a balance in satisfying a network service provider's requirements: maintaining an acceptable call acceptance rate, satisfying protection requirements of requests, and controlling the signaling overhead in case of a component failure, in IP-over-WDM networks in a dynamic traffic arrival scenario. Satisfying all these aspects is a difficult task especially when the traffic pattern is dynamic in nature and a single layer protection approach is followed. In this work, first we propose a multi-layer protection scheme for achieving a better and acceptable tradeoff between blocking performance and signaling overhead in IP-over-WDM networks. We define various operational settings in the proposed scheme and investigate their impacts on the performance of the scheme. An important feature of this scheme is that, these settings allow a network service provider to select a suitable operational strategy for achieving the desired tradeoff based on network's policy and traffic demand. Then we propose an adaptive protection approach for dynamic traffic in consideration of providing better protection to requests as much as possible while considering blocking performance and signaling overhead. Through simulation experiments we evaluate the performance of the proposals and demonstrate their effectiveness.

This paper addresses the problem of quality of service (QoS) differentiation of sub-wavelength level label switched path (LSP) requests considering both differentiated survivability services and transmission quality in terms of end-to-end delay requirements of requests. We define different classes of LSP requests and propose a novel QoS differentiation scheme for IP-over-WDM networks. The scheme adopts a multi-layer protection approach consists of dedicated lightpath protection, shared lightpath protection, and shared LSP protection methods. The inter-class backup resource sharing technique is used to improve the performance of different classes of traffic. The routing strategies consider efficient resource utilization and end-to-end delay requirements of different priority requests. In this work, LSPs belonging to different classes with different protection requirements are allowed to traverse the same lightpath to use resources effectively. This grooming approach is efficient in terms of resource usage and it poses several challenges: 1) lightpath protection can be used or modified to satisfy the protection requirement of a newly traversed LSP, and 2) when and how the protection resources are released or updated when an LSP is released while preserving the other LSPs' protection needs. An effective way of distributing signaling messages for failure recovery should also be considered as different protection methods are used. We address all these issues in the proposed scheme. Through simulation experiments, we investigate the impacts of the backup sharing strategies and the routing strategies on connections acceptance rate for different classes of traffic and end-to-end delay requirements of different priority requests. Based on simulation results we demonstrate how the selection of a suitable sharing strategy and a routing strategy can be done that gives the best performance for all the classes and show the effectiveness of the scheme in satisfying both users' QoS requirements and network services providers' requirements.

We study the dynamic survivable lightpath provisioning problem in wavelength-division multiplexing (WDM) optical mesh networks. Dynamic provisioning implies routing of connection requests that arrive one at a time with no a priori knowledge of future arrivals. We propose a new protection approach to provision lightpath requests according to their differentiated joint quality-of-service (QoS) requirements: connection reliability and recovery time, in a resource efficient manner. In our scheme, a probabilistic failure environment is assumed. We provide differentiated protection to the requests according to their differentiated reliability requirements, and at the same time guarantee the specified connection recovery time if failures occur and the connection is recoverable from these failures. We compare the proposed scheme with several sample full or partial protection schemes. Simulation results show that both QoS parameters have serious impact on the network performance and the proposed joint-QoS protection scheme significantly outperforms the other sample full or partial protection schemes in terms of connection blocking probability.

In this paper we consider routing and wavelength assignment of primary and shared backup lightpaths using OSPF-TE routing information and CR-LDP signalling in GMPLS-based WDM optical mesh networks. In the emerging generalized multi-protocol label switching (GMPLS) based WDM transport networks, called intelligent optical transport networks, WDM-based optical components like add-drop multiplexers (ADMs) and optical cross connects (OXCs) will have full knowledge of the wavelengths in the network, status, and traffic carrying capacity of each wavelength. With such intelligence, these intelligent optical networks could create self-connecting and self-regulating connections on-the-fly. In these networks, after a lightpath establishment or release, the routing protocol may take considerable amount of time to update the routing database at all the nodes in the network, known as routing convergence time (T/sub o/). In case of dynamic traffic, where lightpath requests arrive to and depart from the network randomly; the routing and wavelength assignment for a new lightpath request may be carried out based on non-updated (old) link state information resulting in conflicts and hence leads to higher blocking probability. In this paper we evaluate the blocking performance for different scenarios, such as primary and shared backup lightpath establishment, with full and partial information. The simulation results show that the partial information case over performs the full information case with respect to connection blocking probability.

This paper presents an efficient protection scheme to provide differentiated survivability services for dynamic traffic in mesh WDM optical networks. In the deterministic quality of protection (QoP) framework, connections with different reliability requirements are classified by assigning a continuous spectrum of QoP grades. The backup bandwidth of those connections with low QoP grades is treated as low-speed traffic and may be multiplexed into one backup lightpath for the purpose of efficient bandwidth utilization. In this way, the bandwidth can be efficiently allocated by two-level backup bandwidth aggregation: backup bandwidth sharing and backup bandwidth multiplexing. To allocate the connections with different QoP grades, we propose two efficient routing algorithms: minimum delay QoP routing (MDQR) and maximum aggregation QoP routing (MAQR). Through simulation experiments, we demonstrate that our algorithms work well in terms of blocking performance and the ability of providing differentiated survivability services.

Protection schemes for WDM mesh networks are typically based on the single-failure scenario. However, the single-failure model is not realistic since the failure of network components is probabilistic. On the other hand, different applications or end users need different levels of fault tolerance. In this work, we assume a probabilistic failure environment and choose the connection reliability as a parameter to denote the level of fault tolerance. We propose a partial segment-based protection approach to accommodate lightpath requests according to their differentiated reliability requirements. We also consider incorporating backup sharing in such an environment. We conduct extensive simulation experiments to evaluate the effectiveness of the proposed scheme. Simulation results show that establishing connections according to their differentiated reliability requirements can effectively improve network blocking performance and the proposed partial segment-based protection scheme outperforms the partial path-based protection scheme proposed in the literature in terms of connection blocking probability.

A control scheme which is used to set up and tear down lightpaths, should not only be fast and efficient, must also be scalable, and should try to minimize the number of blocked connections; while satisfying the requested level of fault-tolerance. In this work we propose a distributed control scheme based on preferred link approach for establishing reliability-constrained least-cost lightpaths, by choosing the reliability of a lightpath to denote the level of fault-tolerance required by the connection request. Four heuristics are proposed and their performance is studied through extensive simulation experiments. The simulation results suggest that our heuristics provide better performance compared to other distributed protocols available, in terms of average call acceptance rate, average path cost, average routing distance, and average connection setup time; when the connection requests with different levels of fault-tolerance requirements arrive to and depart from the network randomly.

We study the problem of scheduling switching element (SE)-disjoint connections in banyans and dilated banyans under stage control and show how it applies to photonic cross-connect (or switch) technology. For a given set of connections (or packets), it is desirable to establish them in as few rounds as possible where the number of rounds (i.e., schedule length) corresponds to the degree at which a cross-connect may be multiplexed in time or wavelength. For a stage-controlled banyan, three scheduling algorithms are described. The first two algorithms perform well when the number of connections to be scheduled is small and large, respectively, but perform poorly otherwise. The third algorithm is optimal in that it can generate a schedule of minimum length with a polynomial time complexity. We determine the average schedule length in a banyan using these three algorithms through both analysis and simulation and extend our analysis to dilated banyans.