Although the Internet has become a hub around which every aspect of our lives-from commerce to leisurely activities-is centered, many around the world are not able to freely access information over the Internet. Some governments censor what the people can and cannot see. In this paper, regardless of the socio-political view points, we focus on the design of anti-censorship technology that can be implemented on the side of the information purveyors. The primary objective is to develop a framework for combating censorship. Our approach aims to make it too expensive and impractical for the adversary to censor Web sites. In particular, we propose the use of Mobile IPv6 to form a moving target defense strategy, where the Web servers logically behave as if they are the mobile nodes (without actually moving). The potential efficacy of this framework is modeled analytically. Probabilistic models are used to derive important metrics and parameters. One key factor termed swarming ratio enables hosting sites to reason about the amount of resources needed to force the adversary's costs over practical limits. This model is used to guide the performance goals and architectural setup of the prototype implementation (modifications are made on the server-side software and Kernel without changing the standard Mobile IPv6 protocol). Hence, the solution can be utilized without any changes to the existing network infrastructure. Furthermore, we introduce a novel, credit-based accounting strategy for grouping of users to drastically shift resource requirements in our favor. Lab-based tests are used to measure performance overheads, and based on the findings, targeted optimizations are performed to consider practical deployment scenarios. The end result is a solution that may also be combined with existing anti-censorship methods (that are end-user-based and/or assisted by friendly network assets) to form a robust anti-censorship solution.

Consumers and service providers are both becoming increasingly concerned about new, never-before-seen attacks. Anomaly-based intrusion prevention is an important part of cybersecurity, which offers the possibility of detecting some zero-day attacks. Typically, detection speed and efficacy (in terms of true and false positives) are considered in evaluating intrusion detection schemes. However, effective configuration (training and tuning) is critical for deployment of such schemes in practice. As network traffic may shift over time, the ability to perform fast reconfiguration is needed to provide the level of security necessary for future applications. We present parallel mapping and genetic algorithms-based approaches, which can be used to achieve rapid training and tuning for a highly efficient payload-based anomaly detection algorithm.

In this paper, we introduce MVPN, a framework for building secure Virtual Private Networks (VPNs) with a novel Mobile IPv6 based Moving Target Defense strategy. Our approach aids in combating remote attacks against a VPN server. By eliminating the static address of the server, we make it difficult for an attacker to find the server. The server''s address is randomly changed at a certain interval creating a moving target. At the same time, authenticated clients are updated through the use of the Binding Update procedure (standard Mobile IPv6 protocol). One key strength of this approach lies in the fact that the clients do not need to make any changes or use special software. Our testbed experiments show low packet-loss rates that may occur due to the handoff delay.

As the number of network-based attacks continue to increase, network operations and management tasks become more and more complex. As we have come to depend on reliable operations of networked systems, it is important to be able to provide security measures that both efficient in terms of processing speed as well as in detecting attacks that are not in the database. To this end, anomaly-based intrusion detection systems allow detection of previously unknown and never seen attacks, and effectively complement signature-based detection schemes. In this paper, we evaluate a robust intrusion detection scheme with the goal of developing stand-alone devices that can be deployed in a plug-and-play manner to existing systems. Such devices are attractive as it allows an added security feature to quickly be deployed without adding to the management complexity of existing systems. Our system is robust in that it is resilient to contaminated traffic that may be included in real-time training. Leveraging this advantage, we show that our detection system can self-train without the need for a large, sanitized training data set typically required for many anomaly-based detection schemes. This feature naturally lends itself to faster deployment and for managing systems in changing environments. We demonstrate this concept by developing a physical prototype using an embedded platform. Our results show that amount of delay introduced by the device is small. Another attractive feature of the stand alone device is that it is impossible to temper with without physical access to the device, even if host systems are compromised.

Optical backbone networks are becoming increasingly intelligent and flexible. These networks are able to establish high-bandwidth wavelength connections on-demand to support future network-centric applications. Choosing an efficient path in a timely manner, while considering important criteria such as operation costs and network performance, is a key problem confronting the network operators. Subtle path preferences of different dynamic routing algorithms (which are usually ignored by traditional analysis techniques) can make a significant difference in performance on mesh networks. It opens new research to advance routing algorithms in both analysis and implementation paradigms. In this paper, we propose an opportunity cost model that provides fast and accurate analysis for threshold-based online congestion-aware routing algorithms. The model is simple to compute, robust to different network topologies, and scalable. We show that our model further aids in the design of a number of new routing algorithms that can be easily applied to practical networks. In contrast to previous work, the optimal threshold values for our algorithms can be identified analytically, and the values sustain good performance on different network topologies and sizes.

Anomaly-based intrusion detection systems pattern the normal activity and are attractive in that new, never-seen attacks can be detected. In addition, they can be implemented as a black box solution that sits away from the host using methods that allow rapid processing of the incoming packets without the need to examine high layer information such as protocol details or host profiles. However, the statistical fingerprint of the normal traffic can shift. These changes, caused by various site-level phenomenon (such as changes in overall activity at the networked site or even system updates), can lead to a significant increase in false positive rates. In turn, this effect puts a heavy burden on the post-detection stages which inspect the packets that have raised alarms thereby reducing the overall system performance. In order to guarantee the level of reliability such a system is expected to provide, we need an autonomous mechanism for detecting when a valid traffic change occurs and a self-tuning mechanism when such an alarm is raised. In this paper, we explore in detail the first step towards automating the tuning of intrusion detection systems-the alarm generation. We present a scheme for computing when a traffic change occurs using statistical analysis with anomaly score data. This method can be adapted to a variety of anomaly-based intrusion detection systems. We show that, with some modification, a combination of technical analysis methods (typically used in predicting and verifying financial market data) can be used to guide the intrusion detection system by providing information on when the traffic change occurs. We also discuss the possibility of quick re-tuning using incoming packets collected on-line with a noise-resistant intrusion detection scheme.

In this paper, we present and analyze an algorithm for mapping discrete GPS data gathered from vehicles to a continuous flow of data to determine the time to traverse a road section. Vehicle-tracking devices are installed in 80 probe vehicles in the Anchorage area, and a specific roadway section was chosen as a test section. Drivers for this study drove from before the start of the test roadway section past the end of the test roadway section, measuring the time to travel from the start to the finish of the test roadway section. The vehicle-tracking devices report speed and location every 10 seconds. From this data, we calculated the amount of time to traverse the test roadway section using our proportional model and compared it to the actual amount of time it took to traverse the test roadway section. We performed the analysis assuming the vehicle-tracking devices were reporting location every 10 seconds, 20 seconds, 30 seconds, 40 seconds, 50 seconds, and 60 seconds. With an average actual time to traverse the test roadway section of 2 minutes 28 seconds, the error rate based on the proportional model was between 1.8%-9.2% (2.7-13.1 seconds), based on how frequently the vehicle was reporting its location. Merely taking the average speed on the edge from the vehicle reporting its speed and location during those same durations had an error rate between 14.2%-25.8% (24.7-41.1 seconds). Our results show that the proportional model has a small error rate (1.8% with 10 second reporting time) and can accurately represent the time to traverse roadway sections based on discrete readings from a small number of probe vehicles.

As physical layer impairments play a large role in determining the ultimate performance of all-optical networks, it has attracted much attention. However, traditional survivability schemes have been designed and utilized without considering the quality of transmission at the physical layer. Recently, a few studies on QoT-aware (quality of transmission) protection were initiated to meet the reliability needs of future communications infrastructures. In this paper, we present a study of how transmission impairments caused by non-ideal characteristics of network components (such as amplifier spontaneous emission noise and crosstalk) affect the survivability under various QoT-aware protection schemes. We present heuristic QoT-guaranteed protection RWA for dynamic provisioning that forgoes multiple bit-error-rate calculations, and quantify the performance of various QoT-aware schemes. We also evaluate the tradeoff between using crosstalk-free Banyan switches and utilizing switch plane selection with non-crosstalk-free designs. It is expensive to provide QoT-guaranteed protection, but the usefulness of QoT-aware (nonguaranteed) schemes, while cost-effective, depends on the topology. Our results also show that QoT-unaware algorithms, while performing significantly worse in terms of blocking, can have slightly better post-failure performance.

Anomaly-based intrusion detection systems are an essential part of a global security solution and effectively complement signature-based detection schemes. Its strength in detecting previously unknown and never seen attacks make it attractive, but it is more prone to higher false positives. In this paper, we present a simple payload based intrusion detection scheme that is resilient to contaminated traffic that may unintentionally be used during training. Our results show that, by adjusting the two tuning parameters used in our approach, the ability to detect attacks while maintaining low false positives is not hindered, even when 10% of the training traffic consists of attacks. Test results also show that our approach is not sensitive to changes in the parameters, and a wide range of values can be used to yield high per-packet detection rates (over 99.5%) while keeping false positives low (below 0.3%).

Network dimensioning for wavelength-routed WDM networks has been extensively studied to maximize connection acceptance rate while minimizing the total cost. However, Internet services are increasingly generating more demands that have high-bandwidth requirements with relatively short holding times. As globalization of companies or organizations becomes a new trend, the variety of Internet service demands, in space and time, creates a more variable and unpredictable traffic model for long term network provisioning. At the same time, upgrading backbone networks remains expensive and infrequent. It is important to be able to efficiently utilize precious network resources so that low call blocking is achieved while requiring fewer upgrades when the traffic model changes. There are two kinds of dimensioning problems. First, basic dimensioning allocates network resources for a newly built network. Second, incremental dimensioning allocates extra resources for an already built network without affecting currently available resources. Historically, routing and dimensioning problems are studied together as an optimization problem. However, as integrating multiple network layers into one control platform becomes a common trend, and as higher-layer traffic that currently utilize dynamic routing imposed on logical layers increases, it is essential to plan the underlying network based on dynamic routing schemes, such as open shortest path routing (SPF). In this paper, we study basic and incremental dimensioning for dynamic routed traffic. We propose a simulation based basic dimensioning approach and introduce two new incremental dimensioning techniques: MEAN and SD. We also introduce an evolutionary traffic model and traffic load computation criteria. Simulation results show that basic dimensioning effectively reduces the topological bottlenecks, rendering 7% less blocking compared to uniform allocation. With the evolutionary traffic model, SD incremental dimensioning shows advantages over the MEAN method on most practical networks. We also compare our results with fixed routing and dimensioning approaches, showing that dynamic approaches provide better network balance and utilization.

Traffic engineering has been extensively studied to maximize network resource utilization while minimizing call blocking [1]. As the the demand for high data rate services over wide area networks (WAN) continue to grow [2], and as traffic patterns become subject to more frequent changes, resource utilization and the ability to guarantee quality-of-service become more important. However, accurate, predictive traffic models are difficult to construct [3], implying that the routing mechanism will need to adapt to the difference between the anticipated and the observed loads. Online routing based on network residual capacity plays an important role in such settings, since optimal offline solutions require knowledge of future traffic, rendering long-term optimization nearly impossible. shortest path first (SPF) based routing is fast and is currently the most widely-used online algorithm for optical networks. Many variants of SPF, like CSPF (Constrained SPF), have been proposed to further reduce blocking and network congestion. This paper focuses on the problem of online open routing for connection-oriented optical networks. As part of the major contributions of this paper, we propose a novel online, link-state based routing algorithm called reduced flow routing (RFR), an oracular optimization model, and an efficient network provisioning algorithm. The RFR algorithm uses a fast analysis of each potential route’s impact on future requests to select amongst the available choices. The strategy of RFR leverages information about network topology and residual capacity to reduce blocking by rejecting 20% less connection requests relative to other online routing algorithms with little additional cost. The RFR algorithm can be integrated readily into current and future Generalized Multi-Protocol Label Switching (GMPLS) networks as well as many other relevant networks.

Survivability becomes increasingly critical in managing high-speed networks as data traffic continues to grow in both size and importance. In addition, the impact of failures is exacerbated by the higher data rates available in optical networks. It is therefore imperative to address network survivability in an efficient manner in order to design and operate reliable networks. Transparent optical networks (TONs) provide several advantages over optically opaque networks for supporting the growing communication demands, but suffer from several drawbacks that reduce the efficacy of most applicable capacity-efficient survivability techniques. In this paper, we present a protection algorithm (for single link and/or node failures) called Streams. Streams protection is identical to 1:1 dedicated path protection in terms of recovery speed, but requires significantly less capacity. We study both online non-dynamic routing as well as (online) dynamic provisioning scenarios to compare Streams with dedicated and shared path protection in terms of capacity, blocking probability, path lengths, and recovery time/data loss, and report the relative tradeoffs between the different protection schemes in detail. Our results show that our simple heuristic for Streams under online provisioning scenarios offer attractive tradeoffs in terms of blocking, recovery speed, data loss and implementation overhead. We also briefly cover simple ILP solutions to address static offline routing problems, and show that the Streams protection scheme is also efficient under offline routing scenarios as well.

Survivability becomes increasingly critical in managing high-speed networks as data traffic continues to grow in both size and importance. In addition, the impact of failures is exacerbated by the higher data rates available in optical networks. It is therefore imperative to address network survivability in an efficient manner in order to design and operate reliable networks. Transparent optical networks (TONs) provide several advantages over optically opaque networks for supporting the growing communication demands, but suffer from several drawbacks that reduce the efficacy of most applicable capacity-efficient survivability techniques. In this paper, we introduce a novel protection algorithm (for single link and node failures) called streams. The streams algorithm is similar to 1:1 dedicated path protection in terms of implementation and operation overhead, and has identical recovery speeds while requiring less capacity. We compare the streams algorithm with dedicated and shared path protection in terms of capacity requirements, path lengths, and recovery time. We also extend the flooding based mesh restoration algorithm (FBMR) in order to provide a fair comparison in online routing scenarios, and report the relative tradeoffs between the different algorithms. Our results show that dynamically routed streams offer attractive tradeoffs in terms of capacity, path length, recovery speed, data loss and implementation complexity.