One of the recent research directions in Intelligent Transportation System (ITS) focuses on Automatic Incident Detection (AID) techniques. Using advances in wireless networking and sensor technologies, modern vehicles have the ability to communicate with each other as well as with roadside infrastructure units in order to increase road safety. These innovations in transportation technology provide traffic managers with the ability to use data collected from the vehicles on the road to detect congestion and traffic incidents. Lately, many techniques were developed to alert drivers in advance about traffic incidents and to enable them to avoid congestion. In this paper, we propose two new techniques for automatic detection of traffic incidents in a highway scenario that are based on the use of distance and time for changing lanes, respectively vehicle speed changes over time. The proposed methods are illustrated with numerical results obtained from simulations that show higher incident detections rate those obtained with alternative methods.

Quality of Service (QoS) support for Mobile Ad-hoc NETworks (MANETs) is a challenging task due to the dynamic topology and limited resource in MANETs, and the QoS model should be the first matter to consider as a system goal. The INSIGNIA framework and DiffServ model can both provide a system-level QoS support for MANETs, but each have pros and cons in service precision and scalability. In this paper, we propose a hybrid QoS model for MANETs, called HQMM, which combines the per-flow granularity of INSIGNIA and the per-class granularity of DiffServ, to provide a responsive, scalable, and flexible QoS support for MANETs. The simulation results show that HQMM can achieve effective service differentiation and offer the best QoS to the per-flow service under various mobility conditions.

Many techniques have been applied to anomaly detection to detect novel attacks, such as statistical analysis, clustering, support vector machines, neural networks and etc. Although the results are promising, there’s still a serious problem, high false positive rates, which make anomaly detection systems practically unusable. We observe that most network Intrusion Detection systems (IDSs) work on information that is only available on lower layers of the network or on higher layers, but not on both. We argue that by correlating the information on different layers, we can have a more efficient anomaly detection system. We introduce an anomaly detection system based on the layer correlation. Bayesian networks and statistical analysis are used to build normal system models for the anomaly detection engine. The prototype system is tested on tcpdump traces including normal and anomalous email activities. Our experimental results show that our proposed solution is capable of reducing false alarm rates.

Summary form only given. There are many issues that should be considered when porting systems or applications to mobile ad-hoc network (MANET) environments. In particular, security and performance of MANET have gained wide attention; yet, PKI (public key infrastructure) is no exception. There were some serious attempts to address the issues of providing certificate authority (CA) services in MANETs. In this paper, we present an enhanced design over the existing approaches in order to provide CA services in MANET. We show a new approach that utilizes cooperative caching between the clients to increase system availability even when the network is partitioned. Moreover, it reduces the need to increase the number of participant mobile certificate authority (MOCA) nodes used to increase the availability of the system; thus reducing the overhead of replicas synchronization and key refreshing occurred when the number of MOCAs is relatively large. By careful design and under reasonable assumptions, we show that certificate caching could be integrated and deployed in MANET without sacrificing the system security.

Summary form only given. A critical issue in multicast communication is how to identify multicast groups. In the Internet, multicast addresses and port numbers distinguish multicast groups from each other. Multicast addresses are used within the network to route the multicast traffic to its destination hosts, whereas port numbers are used within the hosts to demultiplex multiple traffic among the host processes. For a process to join a multicast group, it must join both the address and the port number of the group. Within a host, port numbers can be considered as a limited resource. In general, if a port is already allocated to a process, it cannot be assigned to another one at the same time. This implies that a process may not be able to join a multicast group if the port number of that group is already occupied in the host by another process. This paper focuses on the port blocking problem. Mainly, the paper introduces models and techniques to measure multicast port blocking. First, it presents an experimental work in the study of the problem of port blocking. Second, it introduces two models of the problem: analytical model and simulation model. Results obtained from both the experimental work and the developed models show that port blocking plays an active role in multicast address management and the overall multicast communication.

MANET applications and services pose many interesting challenges due to their unique features. Specifically, security is getting a lot of attention in every aspect of MANETs due to their inherent vulnerability to attacks. Threats exist in every layer of the MANET stack, and different solutions have been adapted for each security problem. Another problem for MANETs is availability, and adding more resources does not necessarily make the system more available. Certificate authority (CA) is one of the most important entities in public key infrastructure (PKI) and needs to be designed carefully when adapted to MANETs. The main goal of our work is to provide a framework that addresses the issues of performance and security of CA in MANETs. Additionally, we would like to increase the availability of CA services, while lowering packet overhead of the network, without increasing the network vulnerability. In this paper, we present a framework suitable for exchanging PKI certificates in MANETs. By caching and exchanging certificates between clients collaboratively, we show that our system can meet the performance challenges of providing CA service without sacrificing system security. Using NS-2 Simulator, we have demonstrated the feasibility of the framework, quantitatively, compared to other related research that has addressed the same problem in MANETs environments.

Intrusion detection system (IDS) is one of the most important security protection mechanisms. Although many IDS commercial products and research projects exist, we still face a serious problem under current systems, a high false positive rate. We observe that current network IDSs don't make full use of the information available from different levels and points of the protected network, and we argue that the utilization of this information is essential. We introduce a new framework for network IDSs based on a network context awareness (NCA) layer as an additional data source to IDSs. We describe the architecture of NCA and methods of how to extract network information into NCA. A correlation engine is presented that works on alerts generated by a specific IDS system (Snort) and NCA information. Our experimental results using simulated attacks show that our proposed solution significantly reduces the false alarm rate and has the potential to greatly improve the efficacy of detecting novel attacks.

This paper investigates the problem of multicast error control in heterogeneous environments for multimedia collaborative applications. Typically, these applications consist of several components such as audio, video, and shared applications. Each of these components has its error control demands that may be different from other components. In a heterogeneous environment, destinations experience different error patterns. Directing error control transmissions to all multicast group members wastes the resources of the unaffected destinations. A technique to overcome this problem is to use multiple multicast groups to deliver error control transmissions only to the affected destinations. This technique places an overhead on the network in maintaining the delivery trees for the extra groups. This paper investigates utilizing multiple groups to control errors in multicast communication and presents a simulation study to evaluate the impact of these groups over the network; an important factor that has been ignored by previous studies.

Mobile IP is a network layer solution to the wide-area mobility problem in the Internet. Mobility agents' hierarchies and regional registrations have been introduced in the foreign domain as a local-area mobility solution. In this paper, we critique the current regional registration proposal identifying some drawbacks with its registration mechanisms signaling design. In addition, we introduce novel registration frameworks for regional and home registrations associated with intra-hierarchy handoffs. We attempt to emphasize the local handoff aspect and benefit from the presence of a mobility support overlay network in the form of an agents' hierarchy. Performance evaluation results through network simulation demonstrate the effectiveness of the proposed techniques in reducing UDP packet loss, and maintaining better TCP throughput versus base mobile IP, in the case of a distant home agent.

The increasing use of multimedia streams nowadays necessitates the development of efficient and effective methodologies for manipulating databases in storing them. Moreover, content-based access to multimedia databases requires in its retrieval stage to effectively asses the similarity of video data. This work proposes a new technique for measuring video data similarity that attempts to model some of the factors that reflect human notion in evaluating video data similarity. This model presents one step towards designing intelligent content-based video retrieval systems capable of measuring the similarity among video clips in a way similar to what humans do. The performance of the proposed model was tested where the system yielded very satisfactory values of recall and precision under various testing scenarios.

In many secure group communication models, there exists a group manager that creates the group key and distributes it to every group member. Such group manager is responsible for changing and re-distributing (rekeying) the group key whenever it deems necessary. Many applications will require very fast rekeying so that it is not disruptive to their performance. In this paper, we present a generic software model for secure group key management. We present the main components along with their functionality and interactions. With emphasis on the rekey manager, we discuss two issues that critically impact the rekey time: establishment and maintenance of the logical key hierarchy (LKH), and the key packet construction for a changed key. We show that our novel idea of maintaining balanced LKH as B/sup +/ search tree greatly reduces the number of changed keys compared to an unbalanced LKH. In addition, we show that a rekey packet construction using simple XOR operations between keys instead of the usual encryption technique substantially reduces rekey time. We preformed experiments that demonstrate the effectiveness and feasibility of our approaches.

We investigate the problem of congestion control for multicast traffic over datagram packet switched networks and present an end-to-end solution to it. The focus of our study is on multimedia collaborative applications. The group members of such applications, typically, span a heterogeneous inter-network, where routers and links may vary widely in their capabilities. Recently, two end-to-end approaches have been introduced for multicast congestion control: hierarchical multicast (a window based approach), and multiple group (a rate based approach). In this paper, we introduce a new end-to-end technique for multicast congestion control that utilizes multiple groups and is window based. We have conducted an analytical study to evaluate our work, which shows encouraging results compared to other techniques.

Now that cellular networks are being called upon to support real-time interactive multimedia traffic such as video teleconferencing, these networks must be able to provide their users with quality-of-service (QoS) guarantees. Although the QoS provisioning problem arises in wireline networks as well, mobility of hosts, scarcity of bandwidth, and channel fading make QoS provisioning a challenging task in wireless networks. It has been noticed that multimedia applications can tolerate and gracefully adapt to transient fluctuations in the QoS that they receive from the network. The management of such adaptive multimedia applications is becoming a new research area in wireless networks. As it turns out, the additional flexibility afforded by the ability of multimedia applications to tolerate and adapt to transient changes in the QoS parameters can be exploited by protocol designers to significantly improve the overall performance of wireless systems. The main contribution of this paper is to propose a novel, rate-based, borrowing scheme for QoS provisioning in high-speed cellular networks carrying multimedia traffic. Our scheme attempts to allocate the desired bandwidth to every multimedia connection originating in a cell or being handed off to the cell. The novelty of our scheme is that, in case of insufficient bandwidth, in order not to deny service to requesting connections (new or hand-off), bandwidth will be borrowed, on a temporary basis, from existing connections. Our borrowing scheme guarantees that no connection gives up more than its fair share of bandwidth, in the sense that the amount of bandwidth borrowed from a connection is proportional to its tolerance to bandwidth loss. Importantly, our scheme ensures that the borrowed bandwidth is promptly returned to the degraded connections. Extensive simulation results show that our rate-based QoS provisioning scheme outperforms the best previously known schemes in terms of call dropping probability, call blocking probability, and bandwidth utilization.

Mobile IP presents an efficient solution to the wide-area host mobility problem in the Internet. Nevertheless, its home registration process introduces an overhead in the local-area mobility case. A mobile host is required to register with its possibly distant home agent, whenever it changes its point of attachment to the network. Foreign agent hierarchies have been introduced to perform regional mobile IP registration to minimize the home registration signaling overhead. We propose a novel configurable architecture to organize cooperating foreign agent hierarchies in the foreign domain. An attempt is made not to change the mobile host home registered care-of address as long as it is within the foreign domain. In such a manner, home registration signaling overhead is minimized, and the home agent is isolated from any local-area movement by the mobile host.

At Old Dominion University, we have designed and implemented a Java-based distance education system, which we term IRI-h (for Interactive Remote Instruction-heterogeneous). IRI-h is designed to function on a number of heterogeneous platforms, and within heterogeneous network environments. IRI-h builds on the success of its predecessor system IRI, but attempts to avoid a number of identified pitfalls and deficiencies such as platform dependence, poor scalability, and the need for a homogeneous controlled network environment. We present the design and software architecture of IRI-h which continues to offer audio, video, and tool sharing services within a synchronous virtual classroom environment, albeit in a platform independent manner. Furthermore, the proposed architecture accommodates class participants with no multicast capabilities, or limited connectivity bandwidth by offering tunneling, and rate adaptation services.

Increased desktop processing power and network bandwidth have made feasible distributed multimedia collaborative systems. Such systems are characterized by video, audio and data exchanges. While there has been much research and development of protocols and services for video and audio transmission, less work has been focused on data sharing particularly when the data is being generated by an application in real time and in turns controlled by one or more of the participants in the collaborative session. This paper describes a protocol and its implementation for sharing desktop applications in a distributed collaborative session. Key objectives of this protocol are scalability and resilience to dropped packages and to participants joining and leaving a session. We describe design decisions and give results demonstrating the effect of two different compression algorithms and protocol parameters. Finally, Odust a tool sharing system built on the implementation of shared application views is described.

We used our Original Interactive Remote Instruction (IRI) system to teach scores of university classes over the past years at sites up to 300 km apart. While this system is a prototype, its use in real classes allows us to deal with crucial issues in distributed education instruction systems. We describe our motivation and vision for a reimplementation of IRI that supports synchronous and asynchronous distance education. This new version, called IRI-h (h for hetergeneous), is coded in Java and executes on several different platforms. IRI-h extends IRI both to multiple platforms and heterogeneous network experiences with the developing prototype, including preliminary performance evaluation, and also unresolved issues still to be addressed.

One approach to multicast group security is to have a group key shared by every group member. In this paper, we are interested in group key distribution and management. A new simple technique is introduced for key distribution to a large group based on the hierarchical key tree. The new technique uses bit XOR operation between keys to reduce the computation effort, and uses random byte patterns (BPs) to distribute the key material in the multicast message. The new technique has symmetric procedures for message construction by a key distribution center (KDC) when a member joins or leaves the group, which allows the generation of one rekey message that incorporates multiple delays of both joins and leaves. In addition to the substantial decrease in the computation effort, our technique decreases the required group member storage. Finally, a novel model for the key tree in a distributed KDC is introduced. The new model allows sending the rekey message by one KDC to the whole group and other peer KDCs without any increase in the delay or the number of sent messages. This is achieved by building and replicating an additional KDC key tree.

Today's Internet best-effort services introduce unavoidable uncertainties in the data transfer delay and create the need for synchronization mechanisms that preserve the temporal relationship among streams of distributed multimedia applications. We present algorithms for stream synchronization that are immune to moderate clock skew between sender and receivers and take into account the different time constraints of each media. In our time model, we introduce the idea of a virtual observer, which perceives the session as being in the same room with a sender. We propose policies for delay management and special consideration is given to the time the algorithms take to reach steady state. We avoid the need for globally synchronized clocks for media synchronization by introducing the concept of user's multimedia presence, which defines a new manner for combining streams coming from multiple sites. Finally, we evaluate this framework with traces collected from the Internet.

With the increasing complexity of large scale distributed (LSD) systems, an efficient monitoring mechanism has become an essential service for improving the performance and reliability of such complex applications. The paper presents a scalable, dynamic, flexible and nonintrusive monitoring architecture for managing large scale distributed (LSD) systems. This architecture, which is referred to as the HiFi monitoring system, detects and classifies interesting primitive and composite events and performs either a corrective or steering action. When appropriate, information is also disseminated to management applications, such as reactive control tools. The outlined solution offers improvements over related works by supporting new monitoring techniques such as hierarchical filtering based monitoring and filter incarnation that improve the monitoring scalability and dynamism which are required for managing large scale distributed systems. The HiFi monitoring system has been implemented and used at the Old Dominion University for monitoring and steering Interactive Remote Instruction (IRI) which is a large scale distributed multimedia system for distance learning.

Obtaining feedback information regarding the state of receivers in a multicast session is a fundamental problem that often arises in collaborative multimedia systems. In this paper we present a generalized abstraction of the state feedback problem. Then, we present a feedback protocol that addresses some of the special cases that commonly arise. The presented feedback protocol is suitable for application in best-effort unreliable networks such as the Internet. It allows for obtaining the desired state feedback about a group of receivers, where each receiver may be in one of a set of finite states. The efficiency of the proposed protocol in eliminating the reply implosion problem is illustrated by simulation experiments.

Collaborative multimedia systems demand overall session quality control beyond the level of quality of service (QoS) pertaining to individual streams in isolation of others. To this end, the authors have recently introduced the concept of quality of session (QoSess) control. At every instant in time, the quality of the session depends on the actual QoS offered by the system to each of the application streams, as well as on the relative priorities of these streams according to the application semantics. The authors present a framework for achieving QoSess control, and describe the architecture of a distributed QoSess control layer. In addition, they describe a new inter-stream bandwidth adaptation mechanism, which is used by the QoSess control layer to dynamically control the bandwidth shares of the streams belonging to a session.

Controlling the quality of collaborative multimedia sessions, that deploy multiple media streams, is a challenging problem. In this paper we present a framework for achieving quality of session (QoSess) control focusing on two main components of the QoSess control layer. The first component is a scalable and robust feedback mechanism which allows for determining the worst case state among a group of receivers of a stream. This mechanism is used for controlling the transmission rate of multimedia sources in the cases of layered and single-rate streams. The second component is the inter-stream bandwidth adaptation mechanism that dynamically controls the bandwidth shares of the streams belonging to a session. We compare the performance of several adaptation algorithms. Additionally, in order to ensure stability and responsiveness in the inter-stream adaptation process, several measures are taken, including devising a domain rate control protocol. The performance of our mechanisms is analyzed and their advantages are demonstrated by simulation and experimental results.

Collaborative multimedia systems encompass many Internet applications such as desktop conferencing and interactive distance learning. These applications often contain resources, such as audio, video and shared applications, that must be accessed exclusively by one participant at a time. We present a distributed algorithm that manages the access to these exclusive resources. The algorithm is based on the assumption that the transport layer provides reliable multicasting. Resources are classified into two main classes: primitive and composite. Composite resources consist of a set of two or more primitive resources. A token is associated with each resource unit, and a participant must obtain the resource's token before using the resource. To use a resource, certain permissions may be needed from certain entities such as the session coordinator, the current resource holder and, in some cases, the resource itself. The algorithm guarantees that at any given time, the resource is held by exactly one participant and the token of any resource will never be lost under all possible failure conditions.

Reliable multicast protocols are becoming an essential element in distributed applications such as interactive distance learning applications. However, the existing implementations of reliable multicast protocols are not sufficient to satisfy the group communications requirements of some distributed applications. Our experience of using number of multicast protocols in IRI distance learning applications shows the necessity of providing an application-layer reliable multicast server (RMS) to extend the primitive group communication services provided by such multicast protocols. Examples of such services include handling heterogeneous environments (such as LAN vs. WAN networks and different reliable multicast protocols), automatic fault recovery and simple application interface. In this paper, we motivate and describe the design and the implementation of RMS architecture which has been used in IRI learning sessions for two semesters. We also show how RMS improves the reliability, performance and flexibility of IRI sessions via supporting extended group communication services.

In new collaborative multimedia applications, there is a need for overall control, beyond the level of quality of service (QoS) as pertaining to individual streams in isolation of others. At every instant in time, the quality of the session, as perceived by the end user, depends on the priorities of the on-going streams, according to the application semantics, as well as on the actual QoS offered by the system to each of these streams. We introduce the concept of "Quality of Session" control. This is achieved by employing a monitoring mechanism for measuring the perceived QoS of each stream. In addition, in order to react to existing or potential bottlenecks in the network or end-systems, or skewness in the synchronization of views, an inter-stream adaptation mechanism is applied.

We propose and analyze a proportional share resource allocation algorithm for realizing real-time performance in time-shared operating systems. Processes are assigned a weight which determines a share (percentage) of the resource they are to receive. The resource is then allocated in discrete-sized time quanta in such a manner that each process makes progress at a precise, uniform rate. Proportional share allocation algorithms are of interest because: they provide a natural means of seamlessly integrating real and non-real-time processing; they are easy to implement; they provide a simple and effective means of precisely controlling the real-time performance of a process; and they provide a natural means of policing so that processes that use more of a resource than they request have no ill-effect on well-behaved processes. We analyze our algorithm in the context of an idealized system in which a resource is assumed to be granted in arbitrarily small intervals of time and show that our algorithm guarantees that the difference between the service time that a process should receive and the service time it actually receives is optimally bounded by the size of a time quantum. In addition, the algorithm provides support for dynamic operations, such as processes joining or leaving the competition, and for both fractional and non-uniform time quanta. As a proof of concept we have implemented a prototype of a CPU scheduler under FreeBSD. The experimental results shows that our implementation performs within the theoretical bounds and hence supports real-time execution in a general purpose operating system.

Today a plethora of multimedia, hyperlink software and hardware components are available, as well as teleconferencing systems supporting collaborative work. However, few systems are easy for people to use for real applications such as support of remote instruction. Most importantly, none of these tools scale to use by more than a few users simultaneously. We describe our vision for a system which will support interactive remote instruction (IRI) to support college-level education across spatial boundaries in a manner largely transparent to students and faculty. We have implemented a prototype of this system which has been used to evaluate both the user-interface design and performance requirements. The goal is to have a user interface which models most of the interactions which occurs in a regular classroom. A key focus in this paper is the assessment of system requirements necessary to support large classes. That means that multimedia tools must support O(10), rather than O(1), simultaneous users and user-system interaction protocols must be effective and accepted by students and faculty with diverse backgrounds and computer sophistication.

The state of the art in reliable multicasting protocols renders itself inadequate for group multicasting in environments where both intra-group and inter-group messages bridge several LANs. A particularly difficult situation arises if some LANs are managed by autonomous authorities. If autonomy is upheld, as a defacto condition, then LANs under different authorities can adopt different ordering criteria for group multicasting. The accommodation of heterogeneous ordering criteria is a problem that has been largely ignored. The authors propose the multi-LAN multi-order (MLMO) protocol, which supports a reliable ordered delivery service for both local and global messages. The MLMO protocol assumes an environment in which multicasting groups can have members belonging to different LANs, and each group can adopt either total or causal order for message delivery to its members. Characteristic to the protocol is a communication structure that can be aligned with the actual routing topology; thus, the number of necessary protocol messages is maintained. Furthermore, groups that adopt causal order are not forced to experience message latency solely because of coexisting groups that adopt total order.

Consider a system consisting of a set ofn processes, P~, P2 ..... Pn, and a set of serially reusable resources of m different types, R1, R~ ..... R,~.It is assumed that the system is "claim-limited," that is, its "claim matrix" C, whose (i, j) element C(i, j) is the maximum number of units of R: that may be needed by P, at the same time, is known a priori.It is desired to design a deadlock-free system, that is, one which never deadlocks for any allocation sequence within the limits given by C. For j ffi 1, 2 ..... m, let a, (>0) be the cost of one unit of Rj.An algorithm for designing a deadlock-free system with the minimum resource cost is presented.Its running time is bounded by O(ca(m) + mlogm), where e ts the number of nonzero elements in C and a, is the inverse of Ackermann's function, which is very slowly growing Categories and Subject Descriptors: D.4.m