Fingerprint template protection has recently drawn much attention due to public security and privacy awareness. In this paper, we demonstrate an approach for designing a non-invertible fingerprint template by constructing the many-to-many bit-string polar transformations with different minutiae points. We explore the relative relationship of minutiae points in polar system, which is registration-free in practical implementations. The security is guaranteed by the non-invertibility of the polar transformations. The performance is evaluated for the merits of non-invertibility, accuracy, diversity and revocability using publicly available benchmark databases, FVC2002 (DB1, DB2) and FVC2004 (DB1, DB2). It shows that the proposed approach exhibits favorable performance compared with the state-of-art alignment-free cancelable fingerprint template protection scheme.

CT angiography image vessel segmentation technique plays a critical role in many practical applications such as diagnosis of diseases and surgical planning. Blood vessels after angiography are often defective in low contrast and high noise due to individual differences and limitations of imaging device. A set of segmentation methods has been proposed for such data feature, which firstly adopts combination of average filtering with high frequency emphasizes filtering enhancement algorithms to perform enhancement preprocessing on the original image, thereby enhancing the contrast ratio of blood vessels and surrounding area; secondly, it performs vessel extraction on the enhanced data using region growth algorithm to obtain the segmentation data of richer vessel branches. Experimental results prove that the segmentation approach proposed here can accurately perform vessel segmentation and effectively avoid incorrect segmentation with better robustness.

This paper presents Cologne, a declarative optimization platform that enables constraint optimization problems (COPs) to be declaratively specified and incrementally executed in distributed systems. Cologne integrates a declarative networking engine with an off-the-shelf constraint solver. We have developed the Colog language that combines distributed Datalog used in declarative networking with language constructs for specifying goals and constraints used in COPs. Cologne uses novel query processing strategies for processing Colog programs, by combining the use of bottom-up distributed Datalog evaluation with top-down goal-oriented constraint solving. Using case studies based on cloud and wireless network optimizations, we demonstrate that Cologne (1) can flexibly support a wide range of policy-based optimizations in distributed systems, (2) results in orders of magnitude less code compared to imperative implementations, and (3) is highly efficient with low overhead and fast convergence times.

This paper presents DAWN, a declarative platform that creates highly adaptive policy-based mobile ad hoc network (MANET) protocols. DAWN leverages declarative networking techniques to achieve extensible routing and forwarding using declarative languages. We make the following contributions. First, we demonstrate that traditional MANET protocols can be expressed in a concise fashion as declarative networks and policy-driven adaptation can be specified in the same language to dictate the dynamic selection of different protocols based on various network and traffic conditions. Second, we propose interprotocol forwarding techniques that ensure packets are able to seamlessly traverse across clusters of nodes running different protocols selected based on their respective policies. Third, we have developed a full-fledged implementation of DAWN using the RapidNet declarative networking system. We experimentally validate a variety of policy-based adaptive MANETs in various dynamic settings using a combination of ns-3 simulations and deployment on the ORBIT testbed. Our experimental results demonstrate that hybrid protocols developed using DAWN outperform traditional MANET routing protocols and are able to flexibly and dynamically adapt their routing mechanisms to achieve a good tradeoff between bandwidth utilization and route quality. We further demonstrate DAWN's capabilities to achieve interprotocol forwarding across different protocols.

As cloud computing becomes widely deployed, one of the challenges faced involves the ability to orchestrate a highly complex set of subsystems (compute, storage, network resources) that span large geographic areas serving diverse clients. To ease this process, we present COPE (Cloud Orchestration Policy Engine), a distributed platform that allows cloud providers to perform declarative automated cloud resource orchestration. In COPE, cloud providers specify system-wide constraints and goals using COPElog, a declarative policy language geared towards specifying distributed constraint optimizations. COPE takes policy specifications and cloud system states as input and then optimizes compute, storage and network resource allocations within the cloud such that provider operational objectives and customer SLAs can be better met. We describe our proposed integration with a cloud orchestration platform, and present initial evaluation results that demonstrate the viability of COPE using production traces from a large hosting company in the US. We further discuss an orchestration scenario that involves geographically distributed data centers, and conclude with an ongoing status of our work.

Network management and operations are complicated, tedious, and error-prone, requiring signifcant human involvement and domain knowledge. As the complexity involved inevitably grows due to larger scale networks and more complex protocol features, human operators are increasingly short-handed, despite the best effort from existing support systems to make it otherwise. This paper presents coolaid, a system under which the domain knowledge of device vendors and service providers is formally captured by a declarative language. Through effcient and powerful rule-based reasoning on top of a database-like abstraction over a network of devices, coolaid enables new management primitives to perform network-wide reasoning, prevent misconfguration, and automate network confguration, while requiring minimum operator effort. We describe the design and prototype implementation of coolaid, and demonstrate its effectiveness and scalability through various realistic network management tasks.

Network accountability, forensic analysis, and failure diagnosis are becoming increasingly important for network management and security. Such capabilities often utilize network provenance - the ability to issue queries over network meta-data. For example, network provenance may be used to trace the path a message traverses on the network as well as to determine how message data were derived and which parties were involved in its derivation.

Routing protocols for large wireless networks must address the challenges of reliable packet delivery at increasingly large scales and with highly limited resources. Attempts to reduce routing state can result in undesirable worst-case routing performance, as measured by stretch, which is the ratio of the hop count of the selected path to that of the optimal path. We present a new routing protocol, Small State and Small Stretch (S4), which jointly minimizes the state and stretch. S4 uses a combination of beacon distance-vector-based global routing state and scoped distance-vector-based local routing state to achieve a worst-case stretch of 3 usingO(√(N)) routing state per node in anN-node network. Its average routing stretch is close to 1. S4 further incorporates local failure recovery to achieve resilience to dynamic topology changes. We use multiple simulation environments to assess performance claims at scale and use experiments in a 42-node wireless sensor network testbed to evaluate performance under realistic RF and failure dynamics. The results show that S4 achieves scalability, efficiency, and resilience in a wide range of scenarios.

We present a unified declarative platform for specifying, implementing, and analyzing secure networked information systems. Our work builds upon techniques from logic-based trust management systems, declarative networking, and data analysis via provenance. We make the following contributions. First, we propose the secure network datalog (SeNDlog) language that unifies Binder, a logic-based language for access control in distributed systems, and Network Datalog, a distributed recursive query language for declarative networks. SeNDlog enables network routing, information systems, and their security policies to be specified and implemented within a common declarative framework. Second, we extend existing distributed recursive query processing techniques to execute SeNDlog programs that incorporate authenticated communication among untrusted nodes. Third, we demonstrate that distributed network provenance can be supported naturally within our declarative framework for network security analysis and diagnostics. Finally, using a local cluster and the PlanetLab testbed, we perform a detailed performance study of a variety of secure networked systems implemented using our platform.

This paper presents the design and implementation of declarative policy-based adaptive MANET routing protocols. Our work builds upon declarative networking, a recent innovation for building extensible network architectures using declarative languages. We make the following contributions. First, we demonstrate that traditional MANET protocols can be expressed in a compact fashion as declarative networks. We validate these declarative protocols via an experimental study on the ORBIT wireless testbed and a cluster-based emulation environment. Second, we demonstrate that policy-driven adaptation can be specified in a generic set of declarative rule-based policies that dictate the dynamic selection of different protocols based on network conditions. Third, we conduct extensive evaluation results of declarative policy-based adaptation of MANET routing on the ORBIT wireless testbed and the cluster-based emulation environment. Our experimental results show that the specified policies enable MANETs to dynamically hybridize a variety of routing protocols to achieve a good tradeoff in bandwidth utilization and route quality.

Overlay networks create new networking services across nodes that communicate using pre-existing networks. MOSAIC is a unified declarative platform for constructing new overlay networks from multiple existing overlays, each possessing a subset of the desired new network's characteristics. MOSAIC overlays are specified using Mozlog, a new declarative language for expressing overlay properties independently from their particular implementation or underlying network.

Health monitoring, automated failure localization and diagnosis have all become critical to service providers of large distribution networks (e.g., digital cable and fiber-to-the-home), due to the increases in scale and complexity of their offered services. Existing automated failure diagnosis solutions typically assume complete knowledge of network topology, which in practice is rarely available. The solution presented in this paper - Network Management and Diagnosis (NetworkMD) - is an automated failure diagnosis system that can infer failure groups based on historical failure data, and optionally geographical information. The inferred failure groups mirror missing topologies, and can be used to localize failures, diagnose root causes of problems, and detect misconfiguration in known topologies. NetworkMD uses an unsupervised learning algorithm based on non-negative matrix factorization (NMF) to infer failure groups. Using cable network as the primary example, we demonstrate the effectiveness of NetworkMD in both simulated settings and real environment using data collected from a commercial network serving hundreds of thousands of customers via thousands of intermediate network devices.

Cable network has become one of the most popular ways of high-speed Internet access for homes and small businesses. For broadband cable providers, managing their large-scale network infrastructure is highly challenging because these networks are geographically dispersed and contain a large number of devices. A single administrative area typically serves hundreds of thousands of end-customers (or cable modems) with thousands of intermediate distribution devices that operate on different protocol layers. Such devices include routers, Cable Modem Termination Systems (CMTS's), fiber nodes, repeaters, etc. It is, thus, critical for the providers to monitor the health of their infrastructure and perform quick failure diagnosis. However, there are many challenges in failure diagnosis. In this paper, we focus on two challenges that are motivated by input from a large U.S. cable provider: missing device status information and incomplete topology.

The responsiveness of networked applications is limited by communications delays, making network distance an important parameter in optimizing the choice of communications peers. Since accurate global snapshots are difficult and expensive to gather and maintain, it is desirable to use sampling techniques in the Internet to predict unknown network distances from a set of partially observed measurements. This paper makes three contributions. First, we present a model for representing and predicting distances in large-scale networks by matrix factorization which can model suboptimal and asymmetric routing policies, an improvement on previous approaches. Second, we describe two algorithms-singular value decomposition and non-negative matrix factorization-for representing a matrix of network distances as the product of two smaller matrices. Third, based on our model and algorithms, we have designed and implemented a scalable system-Internet Distance Estimation Service (IDES)-that predicts large numbers of network distances from limited samples of Internet measurements. Extensive simulations on real-world data sets show that IDES leads to more accurate, efficient and robust predictions of latencies in large-scale networks than existing approaches

Mobile wireless devices have intermittent connectivity, sometimes intentional. This is a problem for conventional Mobile IP, beyond its well-known routing inefficiencies and deployment issues. DHARMA selects a location-optimized instance from a distributed set of home agents to minimize routing overheads; set management and optimization are done using the PlanetLab overlay network. DHARMA's session support overcomes both transitions between home agent instances and intermittent connectivity. Cross-layer information sharing between the session layer and the overlay network are used to exploit multiple wireless links when available. The DHARMA prototype supports intermittently connected legacy TCP applications in a variety of scenarios and is largely portable across host operating systems. Experiments with DHARMA deployed on more than 200 PlanetLab nodes demonstrate routing performance consistently better than that for best-case Mobile IP.

In this paper, we propose a model for representing and predicting distances in large-scale networks by matrix factorization. The model is useful for network distance sensitive applications, such as content distribution networks, topology-aware overlays, and server selections. Our approach overcomes several limitations of previous coordinates-based mechanisms, which cannot model sub-optimal routing or asymmetric routing policies. We describe two algorithms --- singular value decomposition (SVD) and nonnegative matrix factorization (NMF)---for representing a matrix of network distances as the product of two smaller matrices. With such a representation, we build a scalable system--- Internet Distance Estimation Service (IDES)---that predicts large numbers of network distances from limited numbers of measurements. Extensive simulations on real-world data sets show that IDES leads to more accurate, efficient and robust predictions of latencies in large-scale networks than previous approaches.

With advances in World-Wide Web applications and technologies, research on measurement and modeling of Internet and Web-based information systems has become increasingly important This paper focuses on continuously monitoring Web traffic by packet sniffing on high-speed links, which is the foundation of analyzing theoretical models of Web characteristics and evolvement. The author presents MOT, a memory online tracing system of Web traffic. MOT parses all packets in memory directly without involving unnecessary I/0 operations with magnetic disks to enhance the system performance. Event-driven design pattern and several other techniques are adopted in MOT to overcome the difficulties of buffering huge volume of traffic. MOT provides a fast, accurate and safe way to obtain the source data for many Web-related studies.