The increasing demand for low-latency, high-bandwidth connectivity has introduced novel challenges to delivering strong resilience guarantees in production network environments. Closed hardware platforms, known as middleboxes, that lack visibility and support for state retention remain a key challenge for continuous service delivery during network failures. These middleboxes rarely employ recovery mechanisms of their own, inspiring renewed interest in the field of NFV in recent years due to this gap within the industry. The increasing availability of VNF capabilities in modern infrastructures offers an opportunity to exploit the flexibility of software and use hybrid architectures to improve resilience. Katoptron is a high-availability service that propagates state between unmodified hardware middleboxes and backup PNF or VNF appliances. The platform utilises targeted packet mirroring to allow network devices to organically construct equivalent state and thus allow an easy transition between hardware and software. To demonstrate its viability, we have evaluated Katoptron against a wide range of common hardware middlebox use cases built using multiple open-source packet processing frameworks. Results show upwards of 90% matching state with no observable delay to normal traffic or impact on its functionality.

Cyber security risk assessments provide a crucial starting point towards the understanding of existing risk exposure, via which suitable mitigation strategies can be formed. Risk is viewed as a product of threat, vulnerability and impact, and equal understanding of each of these elements is vitally important. This can be a challenge in Industrial Control System (ICS) environments, where adopted technologies are typically not only bespoke, but interact directly with the physical world. To date, existing vulnerability identification has focused on traditional vulnerability categories. While this approach provides risk assessors with a baseline understanding and the ability to hypothesize about potential resulting impacts, it is rather high level, operating at a level of abstraction that would be viewed as incomplete within a traditional information system context. The work presented in this paper takes the understanding of ICS device vulnerabilities a step deeper. It offers a tool, PLC-VBS, that helps identify Programmable Logic Controller (PLC) vulnerabilities, specifically within logic used to monitor, control, and automate operational processes. PLC-VBS gives risk assessors a more coherent picture about the potential impact should the identified vulnerabilities be exploited; this applies specifically to operational process elements.

Resilience in networks has often relied on high availability to ensure minimal disruption to end users when faults occur, but this has grown difficult for retaining state with the growing popularity of hardware middleboxes – blackbox hardware network functions that have served as an important part of network design in recent years. There is potential room for the introduction of Network Function Virtualisation (NFV) in the field of resilience in connection with middlebox usage. Rather than relying on overprovisioning, we propose Middlebox Minion (MiMi) VNF, a system design that can be inserted around inaccessible hardware. This recreates state in accordance with the middlebox function, using NFV to establish stateful failover mechanisms without the need to replace existing hardware. The experiment we present is a failover analogy examining the importance of state retention and the complexities involved with inaccessible hardware. Results suggest a promising improvement of connection quality and up to 60% lower loss when state can be preserved across failover instances, as well as potential for further exploration of the topic area.

Typical cyber security risk assessment methods focus on the system under consideration, its vulnerabilities, and the resulting impact in the event of a system compromise. Cyber security, however, increasingly requires anticipating the moves of intelligent adversaries, who make decisions based on a range of factors including the cost of their attacks. A study of current risk assessment literature and industry practice shows that consideration of this cost is a notable gap in the understanding of adversaries. The factors of cost experienced by an adversary are established in this paper as Time, Finance, and Risk, supported by a practical study undertaken with relevant security practitioners. Using these factors as a base, a framework is proposed and developed to support the probabilistic determination of cost incurred by an adversary. This framework is an important extension to existing cyber security risk assessments, and is demonstrated in the paper through the use of a case study.

BGP has long been the de-facto control plane protocol for inter-network connectivity. Although initially designed to provide best-effort routing between ASes, the evolution of Internet services has created a demand for more complex control functionalities using the protocol. At the heart of this challenge lies the static nature of configuration mechanisms and the limited programmability of existing BGP speakers. Meanwhile, the SDN paradigm has demonstrated that open and generic network control APIs can greatly improve network functionality and seamlessly enable greater flexibility in network management. In this paper, we argue that BGP speaking systems can and should provide an open and rich control and configuration mechanism, in order to address modern era network control requirements. Towards this goal, we present λBGP, a modular and extensible BGP framework written in Haskell. The framework offers an extensible integration model for reactive BGP control that remains backward compatible with existing BGP standards and allows network managers to define route processing policies using a high-level language and to dynamically inject information sources into the path selection logic. Using a high-performance BGP traffic generator, we demonstrate that λBGP offers performance comparable to production BGP speakers, while dynamic AS route processing policies can be written in just a few lines of code.

Distributed Renewable Energy Sources (DRESs) such as wind and solar are becoming a promising alternative for the energy supply in modern (smart) electricity grids as part of future sustainable smart cities. Successful integration of DRESs requires efficient, resilient, and secure communication in order to satisfy the highly challenging and real-time constraints of smart city applications. Regardless of the various research solutions proposed in this context within the last decade, the relevant standardization is a non-trivial issue and is still in its infancy. In this position paper, we briefly review the currently employed DRES communications standards and identify the gaps in their present status. Finally, we discuss and suggest potential pathways for further improvement.

Networked systems form the backbone of modern society, underpinning critical infrastructures such as electricity, water, transport and commerce, and other essential services (e.g., information, entertainment, and social networks). It is almost inconceivable to contemplate a future without even more dependence on them. Indeed, any unavailability of such critical systems is - even for short periods - a rather bleak prospect. However, due to their increasing size and complexity, they also require some means of autonomic formation and self-organization. This paper identifies the design principles and open research issues in the twin fields of self-organization and resilience for networked systems. In combination, they offer the prospect of combating threats and allowing essential services that run on networked systems to continue operating satisfactorily. This will be achieved, on the one hand, through the (self-)adaptation of networked systems and, on the other hand, through structural and operational resilience techniques to ensure that they can detect, defend against, and ultimately withstand challenges.

Undoubtedly, the characterisation of network traffic flows is vitally important in understanding the dynamics of Internet traffic and in appropriately dimensioning network resources for network and systems management. The vast majority of modelling techniques developed for volume-based traffic profiling (based on packet and/byte counts) imply the statistical assumptions of stationarity, Gaussianity and linearity, which are often taken for granted without being explicitly validated. In this paper, we demonstrate that such properties are often not applicable due to the high fluctuations in Internet traffic, and should therefore be validated first before they are assumed. We employ Time-Frequency (TF) representations and the Hinich algorithms for validating these three modelling assumptions on real backbone and edge network traces. We show by conducting a passive, offline statistical analysis on real operational network traffic traces from both backbone and edge links that link traffic is extremely dynamic irrespective of the level of aggregation and that model characteristics vary. Subsequently, we propose the use of a representative of higher order spectra, the bispectrum, to act as a particularly suitable method for volume-based traffic profiling due to its ability to adapt to different underlying statistical assumptions, as opposed to ARIMA timeseries models that have been typically used in the literature. We demonstrate that the bispectrum, a signal processing tool that has so far been used in the area of image processing and acoustic signals, can be exploited to accurately characterise traffic volumes per transport protocol, and can therefore contribute to fine-grained network operations tasks such as application classification and anomaly detection.

There is a need for new architectures and designs of resilient networked systems that are capable of supporting critical services and infrastructures. The arguments have previously been well rehearsed, but much remains to be done, not least to demonstrate the feasibility of building such systems. Key among the remaining challenges is how to specify and realise appropriate components that interact with each other to produce a resulting resilient system. This paper reviews the state of the art, describes recent contributions, and looks ahead to future research and prospects.

Distributed denial-of-service (DDoS) attacks continue to trouble network operators and service providers, and with increasing intensity. Effective response to DDoS can be slow (because of manual diagnosis and interaction) and potentially self-defeating (as indiscriminate filtering accomplishes a likely goal of the attacker), and this is the result of the discrepancy between the service provider's flow-based, application-level view of traffic and the network operator's packet-based, network-level view and limited functionality. Furthermore, a network required to take action may be in an autonomous system (AS) several AShops away from the service, so it has no direct relationship with the service on whose behalf it acts. This paper presents Antidose, a means of interaction between a vulnerable peripheral service and an indirectly related AS that allows the AS to confidently deploy local filtering with discrimination under the control of the remote service. We implement the core filtering mechanism of antidose, and provide an analysis of it to demonstrate that conscious attacks against the mechanism will not expose the AS to additional attacks. We present a performance evaluation to show that the mechanism is operationally feasible in the emerging trend of operators' willingness to increase the programmability of their hardware with SDN technologies such as OpenFlow, as well as to act to mitigate attacks on downstream customers.

Mobile edge computing (MEC) and fog are emerging computing models that extend the cloud and its services to the edge of the network. The emergence of both MEC and fog introduce new requirements, which mean their supported deployment models must be investigated. In this paper, we point out the influence and strong impact of the extended cloud (i.e., the MEC and fog) on existing communication and networking service models of the cloud. Although the relation between them is fairly evident, there are important properties, notably those of security and resilience, that we study in relation to the newly posed requirements from the MEC and fog. Although security and resilience have been already investigated in the context of the cloud-to a certain extent-existing solutions may not be applicable in the context of the extended cloud. Our approach includes the examination of models and architectures that underpin the extended cloud, and we provide a contemporary discussion on the most evident characteristics associated with them. We examine the technologies that implement these models and architectures, and analyze them with respect to security and resilience requirements. Furthermore, approaches to security and resilience-related mechanisms are examined in the cloud (specifically, anomaly detection and policy-based resilience management), and we argue that these can also be applied in order to improve security and achieve resilience in the extended cloud environment.

Cloud computing is now extremely popular because of its use of elastic resources to provide optimized, cost-effective and on-demand services. However, clouds may be subject to challenges arising from cyber attacks including DoS and malware, as well as from sheer complexity problems that manifest themselves as anomalies. Anomaly detection techniques are used increasingly to improve the resilience of cloud environments and indirectly reduce the cost of recovery from outages. Most anomaly detection techniques are computationally expensive in a cloud context, and often require problem-specific parameters to be predefined in advance, impairing their use in real-time detection. Aiming to overcome these problems, we propose a technique for anomaly detection based on data density. The density is computed recursively, so the technique is memory-less and unsupervised, and therefore suitable for real-time cloud environments. We demonstrate the efficacy of the proposed technique on a dataset created in our cloud testbed. The dataset consists of feature vectors obtained from a physical cloud testbed network experiencing migration under controlled traffic conditions modelling scenarios combining normal network use with network-based attacks. The obtained results, which include precision, recall, accuracy, F-score and G-score, show that network level attacks are detectable with high accuracy.

An analysis of new technologies can yield insight into the way these technologies will be used. Inevitably, new technologies and their uses are likely to result in new security issues regarding threats, vulnerabilities and attack vectors. In this paper, we investigate and analyse technological and security trends and their potential to become future threats by systematically examining industry reports on existing technologies. Using a cloud computing use case we identify potential resilience metrics that can shed light on the security properties of the system.

The growing demand for online distribution of high quality and high throughput content is dominating today's Internet infrastructure. This includes both production and user-generated media. Among the myriad of media distribution mechanisms, HTTP adaptive streaming (HAS) is becoming a popular choice for multi-screen and multi-bitrate media services over heterogeneous networks. HAS applications often compete for network resources without any coordination between each other. This leads to quality of experience (QoE) fluctuations on delivered content, and unfairness between end users, while new network protocols, technologies, and architectures, such as software defined networking (SDN), are being developed for the future Internet. The programmability, flexibility, and openness of these emerging developments can greatly assist the distribution of video over the Internet. This is driven by the increasing consumer demands and QoE requirements. This paper introduces a novel user-level fairness model UFair and its hierarchical variant UFairHA, which orchestrate HAS media streams using emerging network architectures and incorporate three fairness metrics (video quality, switching impact, and cost efficiency) to achieve user-level fairness in video distribution. UFairHAhas also been implemented in a purpose-built SDN testbed using open technologies, including OpenFlow. Experimental results demonstrate the performance and feasibility of our design for video distribution over future networks.

Cloud services are prominent within the private, public and commercial domains. Many of these services are expected to be always on and have a critical nature; therefore, security and resilience are increasingly important aspects. In order to remain resilient, a cloud needs to possess the ability to react not only to known threats, but also to new challenges that target cloud infrastructures. In this paper we introduce and discuss an online cloud anomaly detection approach, comprising dedicated detection components of our cloud resilience architecture. More specifically, we exhibit the applicability of novelty detection under the one-class support Vector Machine (SVM) formulation at the hypervisor level, through the utilisation of features gathered at the system and network levels of a cloud node. We demonstrate that our scheme can reach a high detection accuracy of over$90$percent whilst detecting various types of malware and DoS attacks. Furthermore, we evaluate the merits of considering not only system-level data, but also network-level data depending on the attack type. Finally, the paper shows that our approach to detection using dedicated monitoring components per VM is particularly applicable to cloud scenarios and leads to a flexible detection system capable of detecting new malware strains with no prior knowledge of their functionality or their underlying instructions.

Software-defined networking provides abstractions and a flexible architecture for the easy configuration of network devices, based on the decoupling of the data and control planes. This separation has the potential to considerably simplify the implementation of resilience functionality (e.g., traffic classification, anomaly detection, traffic shaping) in future networks. Although software-defined networking in general, and OpenFlow as its primary realisation, provide such abstractions, support is still needed for orchestrating a collection of OpenFlow-enabled services that must cooperate to implement network-wide resilience. In this paper, we describe a resilience management framework that can be readily applied to this problem. An important part of the framework are policy-controlled management patterns that describe how to orchestrate individual resilience services, implemented as OpenFlow applications.

We present a fundamentally new approach to classify application flows based on the mapping of aggregate transport-layer volume information onto the Time-Frequency (TF) plane. We initially show that the volume persona (i.e. counts of packets and bytes) of traffic flows at the transport layer exhibits highly non-stationary characteristics, hence rendering many typical classification methods inapplicable. By virtue of this constraint, we present a novel application classification method based on the Cohen energy TF distributions for such highly non-stationary signals. We have used the Rényi information to measure the distinct complexity of any given application signal, and to subsequently construct a robust training model for every application protocol within our scheme. The effectiveness of our approach is demonstrated using real backbone and edge link network traces captured in US and Japan. Our results show that for the majority of applications, aggregate volume-based classification can reach up to 96% accuracy, while considering significantly less features in comparison with existing approaches.

Network resilience strategies aim to maintain acceptable levels of network operation in the face of challenges, such as malicious attacks, operational overload or equipment failures. Often the nature of these challenges requires resilience strategies comprising mechanisms across multiple protocol layers and in disparate locations of the network. In this paper, we address the problem of resilience management and advocate that a new approach is needed for the design and evaluation of resilience strategies. To support the realisation of this approach we propose a framework that enables (1) the offline evaluation of resilience strategies to combat several types of challenges, (2) the generalisation of successful solutions into reusable patterns of mechanisms, and (3) the rapid deployment of appropriate patterns when challenges are observed at run-time. The evaluation platform permits the simulation of a range of challenge scenarios and the resilience strategies used to combat these challenges. Strategies that can successfully address a particular type of challenge can be promoted to become resilience patterns. Patterns can thus be used to rapidly deploy resilience configurations of mechanisms when similar challenges are detected in the live network.

Internet performance measurement is commonly perceived as a high-cost control-plane activity and until now it has tended to be implemented on top of the network's forwarding operation. Consequently, measurement mechanisms have often had to trade relevance and accuracy over non-intrusiveness and cost effectiveness. In this paper, we present the software implementation of an in-line measurement mechanism that uses native structures of the Internet Protocol version 6 (IPv6) stack to piggyback measurement information on data-carrying traffic as this is routed between two points in the network. We carefully examine the overhead associated with both the measurement process and the measurement data, and we demonstrate that direct two-point measurement has minimal impact on throughput and on system processing load. The results of this paper show that adequately engineered measurement mechanisms that exploit selective processing do not compromise the network's forwarding efficiency, and can be deployed in an always-on manner to reveal the true performance of network traffic over small timescales.

Distributed Denial of Service (DDoS) attacks are a persistent, current, and very real threat to networks. Expanding upon a flexible distributed framework for network remediation utilising multiple strategies, we examine a novel fusion of methods to maximise throughput from legitimate clients and minimise the impact from attackers. The basic approach is to build up a whitelist of likely legitimate clients by observing outgoing traffic, presenting a challenge though proof-of-work, and providing flow cookies. Traffic that does not match the expected profile is likely attack traffic, and can be heavily filtered during attack conditions. After we incrementally develop this approach, we explore the positive and negative impacts of this approach upon the network and analyse potential countermeasures.

Network traffic abnormalities pose one of the greatest threats for networked environments. Autonomic communications offer a solution: it should be possible to design network mechanisms that behave adaptively and respond to any anomalous phenomenon that threatens normal network behaviour. In this paper we present the design of an adaptive anomaly detection component that has been built as part of an autonomic network system. We have implemented an entropy estimator to predict the onset of anomalous traffic behaviour within an autonomic resilience framework, and a Supervised Naive Bayesian classifier which synergistically empower the core properties of self-adaptation, self-learning and self-protection for next generation networks. Being part of an always-on, automated measurement and control infrastructure, such mechanism enforces the adaptive system reaction to suboptimal network operation and its subsequent restoration, while requiring minimal static (re)configuration and operator intervention.

Autonomic communication has the aim of supporting fast-evolving network technologies and services, and of reducing the burden in managing complex and dynamic network environments. Networks with desirable self- properties should be more adaptable to changing conditions and would enable greater flexibility and functional scalability. A necessary condition for realising these benefits is a heightened level of network awareness; this requires not merely the capacity to monitor the system and network state, but also the ability to characterise the operational environment and its dynamic shifts. As argued in the literature, patterns of change can be detected through cross-correlation of monitored or sensory inputs expressed in events. The profiling of the temporal ordering and other relationships encoded in these patterns can provide contextual information suitable for reasoning and adaptation tasks. In this paper, we present the design framework and initial evaluation of an Information Sensing system that aims to enable awareness through an integrated event detection-correlation mechanism. In the context of autonomic networks, it offers a more lightweight solution than traditional active database-oriented event systems, and it has better performance than log-post analysis processing; its design also provides for a distributed detection facility.

The innate dynamicity and complexity of mobile ad-hoc networks (MANETs) has resulted in numerous ad-hoc routing protocols being proposed. Furthermore, numerous variants and hybrids continue to be reported in the literature. This diversity appears to be inherent to the field-it seems unlikely that there will ever be a ‘one-size-fits-all’ solution to the ad-hoc routing problem. However, typical deployment environments for ad-hoc routing protocols still force the choice of a single fixed protocol; and the resultant compromise can easily lead to sub-optimal performance, depending on current operating conditions. In this paper we address this problem by exploring a framework approach to the construction and deployment of ad-hoc routing protocols. Our framework supports the simultaneous deployment of multiple protocols so that MANET nodes can switch protocols to optimise to current operating conditions. The framework also supports finer-grained dynamic reconfiguration in terms of protocol variation and hybridisation. We evaluate our framework by using it to construct and (simultaneously) deploy two popular ad-hoc routing protocols (DYMO and OLSR), and also to derive fine-grained variants of these. We measure the performance and resource overhead of these implementations compared to monolithic ones, and find the comparison to be favourable to our approach.

Wireless mesh networks are being used to provide Internet access in a cost efficient manner. Typically, consumer-level wireless access points with modified software are used to route traffic to potentially multiple back-haul points. Malware infected computers generate malicious traffic, which uses valuable network resources and puts other systems at risk. Intrusion detection systems can be used to detect such activity. Cost constraints and the decentralised nature of WMNs make performing intrusion detection on mesh devices desirable. However, these devices are typically resource constrained. This paper describes the results of examining their ability to perform intrusion detection. Our experimental study shows that commonly-used deep packet inspection approaches are unreliable on such hardware. We implement a set of lightweight anomaly detection mechanisms as part of an intrusion detection system, called OpenLIDS. We show that even with the limited hardware resources of a mesh device, it can detect current malware behaviour in an efficient way.

Autonomic network environments are required to be resilient. Resilience is defined as the ability for a network to provide and maintain an acceptable level of service in the face of various challenges to normal operation [1]. Traffic abnormalities are a great challenge and it is vital for any network to be supported by resilient mechanisms in order to detect and mitigate such events. In this document we present our measurement-based resilience architecture and we argue that the correct combination of already proposed theoretical methodologies and mechanisms present in our architecture compose a powerful defence mechanism that satisfies autonomic properties such as self-protection and self-optimization. In addition we refer to our intentions of testing our proposed architecture within the ANA project [2] in order to justify our hypothesis.

A flash crowd event can be characterised by a dramatic increase in requests for a service over a relatively short period of time. Often, these events lead to a loss of service because of the saturation of the target server and associated network resources. This paper presents a set of mechanisms that can be used to make Web servers and associated resources more resilient to flash crowd events. Specifically, we present a novel admission control mechanism that uses a detection mechanism we developed in earlier work to adjust the admission rate of HTTP requests to a Web server. We demonstrate, via simulations, that the admission control mechanism can be used to protect a Web server from the effects of a flash crowd event, protect the traffic of other services that are hosted on the same network as a targeted Web server, and in combination with a push-back mechanism reduce the effect of flash crowd traffic on an ISP's network that is serving the Web server. The mechanisms presented here are exemplars that fit within a resilience strategy we are developing - D2R2+DR - which is summarised here.

Wireless mesh networks are being increasingly used to provide affordable network connectivity to communities where wired deployment strategies are either not possible or are prohibitively expensive. Unfortunately, computer networks (including mesh networks) are frequently being exploited by increasingly profit-driven and insidious attackers, which can affect their utility for legitimate use. In response to this, a number of countermeasures have been developed, including intrusion detection systems that aim to detect anomalous behaviour caused by attacks. We present a set of socio-technical challenges associated with developing an intrusion detection system for a community wireless mesh network. The attack space on a mesh network is particularly large; we motivate the need for and describe the challenges of adopting an asset-driven approach to managing this space. Finally, we present an initial design of a modular architecture for intrusion detection, highlighting how it addresses the identified challenges.

In contrast to aggregate inter-packet metrics that quantify the arrival processes of aggregate traffic at a single point in the network, intraflow end-to-end per-packet performance metrics assess the level of service quality experienced by certain traffic types while routed over a network path. Consequently, while the former is influenced by the superimposition of a large number of concurrent ON/OFF sources, the latter mainly depends on the specific transport mechanisms employed by individual flows in conjunction with the temporal resource contention along the end-to-end path. In this paper, we have used a ubiquitous measurement technique to assess the unidirectional end-to-end delay characteristics experienced by diverse sets of IPv6 flows routed over heterogeneous wireless network configurations. We analysed numerous traces to find that, when viewed as time series data, often exhibit long-range dependence manifested by Hurst parameter estimates greater than 0.5. Our results suggest that the end-to-end packet delay can be bursty across multiple time scales even at the microflow level, implying high performance variability during sufficiently long-lived application sessions. We anticipate that the quantification of such intraflow phenomena can enable applications to optimise and adjust their operation in the face of potential performance degradation.

This paper proposes a novel mechanism to enhance data protection in communications across untrusted networks. The approach is based on the principle of network address hopping, whereby a data stream is spread across multiple end-to-end connections. The aim is to obscure the data exchange between two peers by shuffling the communication pattern. The hopping pattern - a shared secret between the communication participants - defines the sequence for the address hopping and determines the data spreading. Besides a description of the basic operation of the network address hopping mechanism, the paper evaluates the level of protection it can offer for end-to-end communications. This theoretical analysis is accompanied by a quantitative evaluation of the processing overhead of our prototype implementation on commodity end hosts.

The stratification of Internet protocols segregates network functionality into two broad layers: the overlay layer (application level) and the underlay layer (network level). Overlay networks are typically not aware of the operation of underlay networks, and conversely underlay networks are blind of the services executing at the overlay layer. Even though there is a prolific deployment of overlay networking based services, this architectural design is proving to have a number of deficiencies. Typically, such services make poor use of underlying networking resources, leading to degraded user-perceived quality of service. We propose a two-layer coordination and control framework aimed at optimizing network performance and enhancing user-perceived service. The framework and corresponding middleware structure make use of active networking technology. We choose peer-to-peer systems as our overlay study case, and discuss the problems associated with providing two-layer optimization and application support for such systems. Finally, we draw conclusions about the potential benefits of this approach and point towards possible directions of future work.

Measurement-based performance evaluation of network traffic is becoming very important, especially for networks trying to provide differentiated levels of service quality to the different application flows. The nonidentical response of flows to the different types of network-imposed performance degradation raises the need for ubiquitous measurement mechanisms, able to measure numerous performance properties, and being equally applicable to different applications and transports. This paper presents a new measurement mechanism, facilitated by the steady introduction of IPv6 in network nodes and hosts, which exploits native features of the protocol to provide support for performance measurements at the network (IP) layer. IPv6 Extension Headers have been used to carry the triggers involving the measurement activity and the measurement data in-line with the payload data itself, providing a high level of probability that the behaviour of the real user traffic flows is observed. End-to-end one-way delay, jitter, loss, and throughput have been measured for applications operating on top of both reliable and unreliable transports, over different-capacity IPv6 network configurations. We conclude that this technique could form the basis for future Internet measurements that can be dynamically deployed where and when required in a multiservice IP environment.

The ability to measure, monitor and control the service quality experienced by network traffic is becoming increasingly important as multiple traffic types are aggregated onto IP networks. Assessing the real-time performance of the application flows is an essential requirement for network operations and service management, as well as for identifying how the different traffic types and transports interact and behave, when they are carried over the end-to-end Internet infrastructure. This paper introduces a novel measurement technique for assessing the performance of IPv6 network flows. By exploiting IPv6 extension headers, measurement triggers and the instantaneous measurement indications are carried in the same packets as the payload data itself. providing a high level of probability that the behaviour of the real user traffic flows is being observed. The measurement mechanism is applied at the network layer and provides for a generic technique able to measure any type of traffic without depending on particular transports or on specific measurement architectures. A prototype implementation of this technique is also described and evaluated by measuring performance properties of application flows over different-capacity IPv6 environments. End-to-end delay and jitter of video streams have been measured, as well as the goodput for services operating on top of reliable transport. This measurement technique can be the basis for low-overhead, scalable, transparent and reliable measurement of individual and aggregate network flows, and can be dynamically deployed where and when required in a multi-service IP environment.

The MPEG-7 standard presents several interesting challenges with regard to manipulating multimedia content descriptions. We discuss two exemplary applications for MPEG-7: personalized TV services and video surveillance. In doing so, we introduce some capabilities into the standard that test the limits of the current models, namely those of multiple streams and those of carouseling and synch-points. We then introduce proposed extensions that facilitate these additional functionalities, and explore their impact upon the models within the standard.

The challenge in building an ATM switch, especially in the area of QoS control, lies in the design of the port controllers. By combining port reconfiguration, cell scheduling and connection admission control, a programmable QoS controller at the output port of the non-blocking, output-buffered reconfigurable ATM switch is proposed. In such a switch, the output port is the only point of contention that can cause possible QoS degradations due to excessive queueing delays. Cell scheduling is used as an essential mechanism for attaining meaningful differentiated QoS behaviour. The QoS controller combines per-connection buffer management with a table-driven cell scheduler to achieve a broad range of QoS behaviour. This paper reports the simulation results of our study on (i) the effects of different traffic characteristics, and (ii) the effects of slot algorithms in the cell scheduler, on the QoS performance.

We address some of the problems concerning RTCP scalabilty in large multicast groups. The problems are summarised as the increased storage state maintained by every member about every other member in the group, the feedback delay, and the bandwidth usage problem especially for receivers that obtain incoming RTCP reports through low bandwidth links. We designed a scheme to tackle these problems and to improve the RTCP scalability. Our scheme is based on a hierarchical structure in which members are grouped dynamically, into local regions and receiver reports (RRs) are sent with limited scope. As a result, the load is distributed among members in the group. Each region has an aggregator (AG) that receives the RRs feedback, performs some aggregation statistics on this control data, then sends these statistics to a manager. The manager performs additional analysis to evaluate the network performance and to estimate regions which are suffering from significant congestion. Finally, we present the benefits of using our scheme.

The ReTINA project (ACTS AC048) is an industrial collaboration to explore the use of CORBA for the support of real-time multimedia services, from the point of view of network control and from the point of view of middleware services. This paper covers CORBA for network control, and CORBA extensions towards a DPE framework for flexible binding and real-time support.

The Magic WAND project (Wireless ATM Network Demonstrator) is one of the largest projects within the European Union ACTS (Advanced Communications Technologies and Services) initiative. The project aims to design, verify, implement, and demonstrate a wireless access network for ATM LAN's. The complete range of functionality, from physical data transmission to shared multimedia application, is addressed. The WAND system is designed for indoor environments with user mobility limited to walking speed. The system's functional specification has been designed and verified using SDL (specification and description language). In this paper, the WAND system functional model is given and SDL simulation results are presented, to illustrate how the protocols support some of the key operations of a wireless access network. These include initial registration, call setup, and handover.

In this paper, we outline an architecture which enables the real-time delivery of continuous media over the Internet using the Real-time Transport Protocol (RTP). We present our implementation of RTP with its control protocol RTCP. RTCP feedback reports are used by our adaptive rate controller to help reduce congestion. Then, we assess the functionality of RTP and its suitability for the future Internet. This leads us to investigate the resource ReSerVation Protocol (RSVP) and evaluate RTP and RSVP together with respect to some transport protocols' requirement for the future Internet.

The nature of distributed multimedia applications is such that they require multipeer communication support mechanisms. The multimedia traffic needs to be delivered to end-systems, networks, and end-users in a form that they can handle while satisfying the constraints imposed by the multimedia application. Quality-of-service (QoS) mechanisms that can ensure full quality media playout at high-performance workstations, while at the same time providing appropriately filtered lower quality media for playout at other end-systems, are required. Existing multicast support mechanisms are deficient for this purpose, in a heterogeneous environment, because they work on a common denominator premise where the quality delivered depends on the least capable link or node involved in the multicast session. This paper begins by discussing video compression; it proposes and analyzes the use of filtering mechanisms as means of supporting disparate receiver capabilities and QoS requirements. The paper describes the implementation of a number of filtering mechanisms and highlights the communications architecture within which these mechanisms are built. This architecture constitutes a specific network topology and a new protocol family developed within a UNIX-like operating system.

The integration of distributed multimedia systems around the unifying theme of quality of service (QOS) is addressed. A set of key QOS requirements is presented and mapped onto a provisional QOS architecture (QOS-A) that has emerged from a experimental system designed and implemented at Lancaster. The scope of the discussion is limited to aspects of a QOS-A for the support of continuous media communications. Also, the focus is on asynchronous transfer mode (ATM) at the network layer rather than the full range of multiservice networks. Functions and mechanisms for QOS support are examined and placed within the evolving QOS-A.>

D. Hutchinson; Special Issue Editorial: DISTRIBUTED MULTIMEDIA SYSTEMS, The Computer Journal, Volume 36, Issue 1, 1 January 1993, Pages 2–3, https://doi.or

The combination of high-speed multiservice networks and multimedia workstations offers considerable potential for the development of distributed multimedia applications. A key problem is how to integrate continuous-media types such as audio and video into a distributed workstation environment. An experimental system architecture based on a specialized multimedia network interface that attempts to provide this integration is described. The design and implementation of this system are discussed in depth in terms of workstation enhancement and distributed system support. A new approach to the problem of media synchronization is introduced, and the importance of quality of service in the architecture is highlighted. Experiences encountered during this work are described, comparison with other approaches is made, and likely future developments in multimedia network interfacing are discussed.>

The desire to transfer continuous media such as digital audio and video across packet switched networks imposes a number of new requirements on transport level communication services. This paper identifies a number of these requirements in the context of an experimental distributed multimedia infrastructure, and reports on research which addresses some of the associated issues. Particular attention is paid to two areas: (i) extended Quality of Service (QoS) provision; and (ii) support for the co-ordination of multiple related connections. We then describe an application level service, known as an orchestrator, which performs synchronisation functions over multiple related transport connections. We also outline the design and implementation of a continuous media transport service which meets the identified requirements. Finally, we outline the way in which the orchestrator and transport services are integrated into an object-based distributed multimedia application platform.

Distributed systems can be built to a client-server model in which one of the important servers is the file server, consisting of at least one processor and disk drive, attached to the network with the sole purpose of storing information on behalf of its clients. In the Department of Computing at Lancaster University we have designed and built a file server which is connected to both of our networks: an Ethernet-type network (called Strathnet, of local design) and a Cambridge Ring type network. The Arca File Server is based on work started at Cambridge University. This paper describes the background of file servers for local networks and the design and implementation of our system.

This paper describes the hardware and software architecture of a gateway between an Ethernet-style local area network called Strathnet and an X.25 packet switched network (British Telecom's PSS). The hardware is based on a Motorola 68000 processor using the VME bus, and peripheral boards based on an 8-bit 68120/1 processor for the local network and the X.25 interfaces. The software is layered from the low-level executive, through the three X.25 levels and the transport layer, and through the corresponding layers on the local network side, to the bridging software itself. Both hardware and software are designed so that the system can be a general-purpose gateway: for example, the local area network peripheral board could be replaced by a ring type interface, and the software within the local network layers could similarly be replaced.