Cloud networks utilize virtual connections to connect virtual machines distributed across cloud sites. They are increasingly deployed due to flexible provisioning using software and cost-effectiveness in not requiring to build physical network infrastructure. However, their extensive virtualization makes it unclear how well the established practices of conventional networks translate to them. We study throughput measurements over a Google Cloud network using a matching hardware-emulated conventional network, which provide production and exploratory conditions, respectively. The measurements span connections representing local, cross-continental and around the Earth distances. We study the effects of parallel flows, congestion control algorithms and retransmissions on the network throughput profile expressed as a function of RTT. We compare the throughput profile of Google Cloud network with those of emulated network under various loss conditions, including those too disruptive or expensive in the former. Our analysis based on the concave-convex shape and utilization-concavity coefficients of throughput profiles indicates an overall agreement of performance between the two networks, thereby justifying the use of conventional network emulations to analyze cloud networks. In terms of practical use, our study establishes that BBR and BBRv2 alpha TCP achieve higher throughput compared to loss-based congestion control algorithms under most network configurations, especially, under losses at large RTT.

The evolution of the Network [entbl]Function Virtualization (NFV) paradigm has revolutionized the way network services are deployed, managed, and scaled. Within this transformative landscape, Virtual Network Function (VNF) resource prediction emerges as a cornerstone for optimizing network resource allocation and ensuring service reliability and efficiency. Traditional resource forecasting methods often struggle to adapt to the dynamic and non-linear nature of changes in resource consumption patterns in modern telecommunication networks. We address this challenge by leveraging the inherent pattern recognition and next-token prediction capabilities of Large Language Model (LLM) without requiring any domain-specific fine-tuning. Our study utilizes Llama2 as the foundation model to evaluate the performance against widely used probability-based models on a public VNF dataset that encompasses real-world resource consumption data of various VNFs for comparative analysis. Our findings suggest that LLM offers a highly effective alternative for VNF resource forecasting, demonstrating significant potential in enhancing network resource management.

The dynamics of TCP under a variety of conditions is well understood. Nonetheless, users requiring a certain level of TCP performance should run benchmarks in order to verify the amount of throughput they are able to achieve. When on a network, such as a cloud provider or even mobile network, you are often charged by the amount of data transferred over the network. In this paper, we propose the addition of confidence intervals to throughput testing tools as a method of decreasing the network transfer costs by means of automatic early stopping. We show that this allows us to still get quality measurements and minimize the amount of time and data these measurements consume.

A network of virtual machines at cloud server sites connected over virtual IO connections is a flexible, easily deployable, and cost-effective alternative to a physical network infrastructure with dedicated servers connected over leased fiber lines. We study the throughput performance of such a cloud network by collecting measurements over Google Cloud infrastructure spanning multiple continents. To study its ideal performance and impact of packet losses, we utilize its emulation using dedicated servers and connection hardware emulation devices. We compare the measurements over the cloud network to those over its emulation on a testbed. We examine the throughput profiles of both networks as a function of the round trip time and their utilization-concavity coefficients, estimated using measurements for common TCP versions. The throughput profile's concave-convex shape and its coefficient are critical indicators of the network performance, qualitatively and quantitatively, respectively. The results indicate their overall agreement between the production cloud network and its emulation using dedicated connections, and a near optimal throughput performance of the former except for a few under-performing connections. Also, the number of parallel flows is found to be a dominant factor in optimizing the throughput across various conditions and TCP versions.

Observation is the foundation of scientific experimentation. We consider observations to be measurements when they are quantified with respect to an agreed upon scale, or measurement unit. A number of metrics have been proposed in the literature which attempt to quantify some property of cyber security, but no systematic validation has been conducted to characterize the behaviour of these metrics as measurement instruments, or to understand how the quantity being measured is related to the security of the system under test. In this paper we broadly classify the body of available security metrics against the recently released Cyber Security Body of Knowledge, and identify common attributes across metric classes which may be useful anchors for comparison. We propose a general four stage evaluation pipeline to encapsulate the processing specifics of each metric, encouraging a separation of the actual measurement logic from the model it is often paired with in publication. Decoupling these stages allows us to systematically apply a range of inputs to a set of metrics, and we demonstrate some important results in our proof of concept. First, we determine a metric's suitability for use as a measurement instrument against validation criteria like operational range, sensitivity, and precision by observing performance over controlled variations of a reference input. Then we show how evaluating multiple metrics against common reference sets allows direct comparison of results and identification of patterns in measurement performance. Consequently, development and operations teams can also use this strategy to evaluate security tradeoffs between competing input designs or to measure the effects of incremental changes during production deployments.

Cognitive load refers to the amount of informationa person can process or hold in working memory. Historically, the psychology community has estimated this quantity objectively by monitoring the involuntary dilations and constrictions of the pupil using medical grade equipment known as pupillometers. At the same time, researchers in the HCI and Ubi Comp communities have hypothesized how cognitive load sensing might be integrated into context aware computing systems, but limitations of sensing cognitive load ubiquitously and reliably prevent the mass integration of such a technology. Our system, Pupil Ware-M, seeks to begin bridging this sensing gap. We build upon a recent platform, Pupil Ware, which measures a user's sub-millimeter pupil dilation from an unmodified camera. We update the Pupil Ware sensing system with a calibration protocol that brings pupillary responses of a diverse range of people and lighting conditions onto a single 0.0-1.0 scale called Cog Point. Furthermore, we update and optimize the algorithms employed to run in real time from a smartphone. We validate the calibration process using eight users in a controlled experiment where cognitive load is simple to determine from its situational context. Discussion of future work and remaining challenges is then described.

In this paper, we study the effect of using Synthetic Minority Oversampling TEchnique on the detection of SMS spam. The study shows an improved spam detection performance of the classifiers trained on semi-synthetic datasets compared to the performance of the same classifiers trained on the original dataset.

Two of the design criteria in wireless sensor networks (WSNs) are the security and reliability of information flow, especially in critical applications. In this research, we propose combining a Crypto-System with Embedded Error Control (CSEEC) with multi-path routing for secure and reliable communication in WSNs. CSEEC is a joint encryption and error correction scheme based on erasure coding. When combined with multi-path routing, the system provides a fault-intrusion tolerant mechanism. The goal is to provide security and reliability for data transmission in multi-path routing by using a single process. The proposed system protects the confidentiality and ensures the delivery of the transmitted information when a number of communication paths fail or get compromised.

The use of smartphones is becoming more pervasive with the launch of applications that can handle every aspect of life. These applications range from simple calender management to more sensitive on-line banking. As a result, the security of these applications is becoming more important day after day. In this paper, the new challenges and factors associated with mobile applications and their security will be highlighted. We focus on malware and phishing attacks, and argue how solutions for regular computers are, in many cases, inapplicable for smartphones. We survey the currently available solutions and conclude with a discussion on open problems and possible future work.

We propose two approaches to cloak RFID tags using a light-weight symmetric key algorithm called Hummingbird (HB), a state-full, rotor-based system. Deployment of Radio Frequency Identification (RFID) at the individual item level has stalled, partially due to concerns over privacy. To realize the full potential of both increased efficiency in the supply chain and promising new capabilities, RFID tags need to be pushed down beyond the cases and pallets that they are used to track now. In order to gain general acceptance, consumers must feel they have control over the tags they possess. HB has been shown to provide high security within reach of the limited resources of a tag. The proposed approaches provide for tag security by silencing a tag unless it is queried by an authenticated reader, while providing a security model that consumers will understand and with which they will feel comfortable. We conclude with a discussion of the challenges of cloaking tags and show how our protocols may be effectively applied in different environments.

Security fusion is a new paradigm in security for resource-constrained environments. Following this paradigm, strong system-level security is achieved by combining weak primitives from multiple nodes. In this paper, we describe a fusion methodology based on state machine compositions. From the properties of compositions, we devise a challenge-response system that composes low-entropy state machines at individual nodes into one with higher entropy. We use built-in digital logic such as Physical Unclonable Functions (PUFs) to efficiently mass generate and distribute keys. In addition, we draw on the properties of compositions to reduce the key storage complexity at the infrastructure-level, with high coverage and early detectability at the system-level.

Cyber Physical Systems (CPS) is an emerging computing paradigm that is becoming prevalent in various technologies. Achieving a trustworthy CPS requires us to build mechanisms that ensure the integrity and authenticity of these systems. Fortunately with the new advancements in semi-conductor-based technologies, in particular Physical Unclonable Functions (PUFs), we have the potential to build secure couplings between cyber and physical substrates based on intrinsic physical material. In this paper, we share some thoughts on how to utilize the PUF technology for security in CPS. Based on a composition approach, we illustrate the benefits of combining multiple PUF elements, with some inherently bias factor, into one randomly secure and strong system-level PUF.

Security in resource-limited environments poses a great challenge as the nodes comprising such a network are severely limited in processing power and storage. Various security protocols have been proposed for sensor networks and RFID that try to mitigate this problem but they provide security on a point-to-point basis which is weak and easily vulnerable to a number of attacks. In this paper, we discuss architecture for a resource limited environment that enables these networks to achieve better security and reliability while being simple and efficient. Based on the architecture we develop non-cryptographic security mechanisms using state machines for providing basic security services including authenticity and confidentiality. We also introduce the concept of Security Fusion where strong system level security properties are synthesized from weak point-to-point security properties. The strengths of these techniques are analysed so as to offer comparisons with conventional techniques.

Small ad-hoc wireless networks are becoming ubiquitous. Wireless protocols like ZigBee, ANT, and Bluetooth have been targeted towards small devices with limited capabilities. As the volume and sensitivity of data being communicated over these networks increases so does the need for security. The limited capabilities of these devices, however, means the standard in security is out of their reach. Cost and power factors prevent devices from being able to run public key (PK) cryptographic algorithms and standard block ciphers. Using the Needham-Schroeder (NS) symmetric key protocol, we show how Hummingbird, an ultra lightweight symmetric key algorithm, can be used to establish trust between a node and an authentication server (AS). The AS can then use the trust it shares with all nodes in the network to facilitate secure communication between two nodes previously unknown to each other. It also over comes the NS vulnerabilities and provides backwards secrecy up to the point a node is compromised.

Abstract One of the solutions that has been widely used by naive users to protect against phishing attacks is security toolbars or phishing filters in web browsers. The present study proposes a new attack to bypass security toolbars and phishing filters via local DNS poisoning without the need of an infection vector. A rogue wireless access point (AP) is set up, poisoned DNS cache entries are used to forge the results provided to security toolbars, and thus misleading information is displayed to the victim. Although there are several studies that demonstrate DNS poisoning attacks, none to our best knowledge investigate whether such attacks can circumvent security toolbars or phishing filters. Five well‐known security toolbars and three reputable browser built‐in phishing filters are scrutinized, and none of them detect the attack. So ineptly, security toolbars provide the victim with false confirmative indicators that the phishing site is legitimate. Copyright © 2009 John Wiley & Sons, Ltd.

Abstract As cellular telephones and high capacity memory sticks emerge as users' primary repository for data and applications, users will often run applications and display data on remote hosts. The biggest challenge in supporting this mobile data, mobile applications, stationary platform model is ensuring the security and privacy of user applications and data during execution on the remote platforms. Private computing on public platforms (PCPP) is a new application security approach which isolates applications to allow for secure and private execution on third party systems. This paper introduces PCPP and details its five basic building blocks which together ensure that the PCPP protected application's executable code, context, and data remain unaltered, unmonitored, and unrecorded before, during, and after exposure to the remote platform. Copyright © 2009 John Wiley & Sons, Ltd.

Phishing continue to be one of the most drastic attacks causing both financial institutions and customers huge monetary losses. Nowadays mobile devices are widely used to access the Internet and therefore access financial and confidential data. However, unlike PCs and wired devices, such devices lack basic defensive applications to protect against various types of attacks. In consequence, phishing has evolved to target mobile users in Vishing and SMishing attacks recently. This study presents a client-server distributed architecture to detect phishing e-mails by taking advantage of automatic variable selection in Bayesian Additive Regression Trees (BART). When combined with other classifiers, BART improves their predictive accuracy. Further the overall architecture proves to leverage well in resource constrained environments.

Spam is considered an invasion of privacy. Its changeable structures and variability raise the need for new spam classification techniques. The present study proposes using Bayesian additive regression trees (BART) for spam classification and evaluates its performance against other classification methods, including logistic regression, support vector machines, classification and regression trees, neural networks, random forests, and naive Bayes. BART in its original form is not designed for such problems, hence we modify BART and make it applicable to classification problems. We evaluate the classifiers using three spam datasets; Ling-Spam, PU1, and Spambase to determine the predictive accuracy and the false positive rate.

Private computing on public platforms (PCPP) is a new technology designed to enable secure and private execution of applications on remote potentially hostile public platforms. PCPP uses a host assessment to validate a host's hardware and software configuration and then uses 4 active security building blocks which together allow an application to remain unaltered, unmonitored, and unrecorded before, during, and after execution on the public platform. Privacy protected ELF (PPELF) is the building block used by PCPP to protect application executable code while it is stored on the public platform and to provide a secure binary load mechanism. PPELF is an encrypted binary executable format and methodology which uses just in time decryption during the executable load procedure. In this paper we describe the PPELF file format, our new PPELF binary format loader, and our updates to the GLIBC ELF interpreter to support PPELF. We also provide experimental results detailing the initial load-time and run-time penalty associated with the use of PPELF.

Security toolbars are used to protect naive users against phishing attacks by displaying warnings on suspicious sites. Recently, Web browsers have added built-in phishing filters mimicking the same functionality to detect phishing sites. The present study proposes a new attack to bypass security toolbars and phishing filters via DNS poisoning. Spoofed DNS cache entries are used to forge the results provided to security toolbars and thus misleading information is displayed to the victim. Although there are several studies that demonstrate DNS poisoning attacks, none to our best knowledge, investigate whether such attacks can circumvent security toolbars or phishing filters. Four well-known security toolbars and three reputable browser built- in phishing filters are scrutinized. None of the seven tools detect the attack. Worse still, security toolbars provide the victim with false confirmative indicators that the phishing site is legitimate.

Private computing on public platforms (PCPP) is a new technology designed to enable secure and private execution of applications on remote, potentially hostile, public platforms. PCPP uses a host assessment to validate a host's hardware and software configuration and then uses four active security building blocks which together allow an application to remain unaltered, unmonitored, and unrecorded before, during, and after execution on the public platform. In this paper we develop a key PCPP building block, secure context switch (SCS), which isolates an executing application's context, i.e. its executable code, data segments, heap, and stack, using encryption techniques. Additionally, we detail our implementation of SCS and offer experimental results showing the performance impact of protecting an application with SCS.

Private computing on a public platform (PCPP) is a new paradigm in public computing in which an application executes on a previously unknown remote system securely and privately. The first step in the PCPP process is remote assessment of a prospective remote host to determine whether it is capable of executing the PCPP application and to classify the host as a potential threat or non-threat. This paper explores the use of a naive Bayesian classifier to classify prospective remote hosts. We show that the naive Bayesian classifier learns to recognize subtle patterns in historical host measurements and performs the classification task accurately and with minimal negative performance implications.

Poor memory management leads to memory leaks, which cause significant performance degradation and failure of software. If ignored, such leaks can potentially cause security breaches and holes in applications. The present study shows that memory leaks can be exploited to cause Denial of Service (DoS) of applications. The ultimate goal of this study is to introduce a security profiling technique that can be used to identify security holes in software. We instrument memory leaks in a Java applet using an open source memory profiler based on Java Virtual Machine Profiler Interface (JVMPI). The results show that it is crucial to perform memory profiling prior to application deployment in order to avoid DoS and vulnerability exploits.

Stress-testing has been widely used by businesses, governments, and other organizations to evaluate the strength of their web applications against various attacks. However, the quality of these tests is under constant scrutiny to determine their effectiveness. The present study compares four stress-testing tools, by performing the tests on two major web-based applications. All of the tools used are open source, and run on Win32 platform. The test scenarios are recorded from server log files to make the tests more realistic. Lastly, we discuss how to use stress-testing tools as a measure to avoid Denial of Service attacks on web servers and web applications.

In this paper, we address the problem of providing differentiated levels of protection in MAN/WAN Ethernet environments. The IEEE 802.3ad bundling mechanism of Link-Aggregation is used to mitigate disruption of traffic due to link failure. We focus on the network design problem of accommodating Ethernet Virtual Connections (EVCs) traffic with given protection requirement with minimum budget utilizing novel Traffic Engineering (TE)based schemes. The initial investment cost of linkaggregate upgrade can be recovered by providing differentiated survivability services to customers.

Since so many diverse systems are placed in the network, without a coherent set of response-actions, the network may be ineffective in recovering from a state of unrest or failure. Typically, after the loss of a signal some equipment may initiate a recovery mechanism, others will sound alarms, and still others will do nothing. In some cases, the alarm propagation causes multiple actions over several protocol layers or a single protocol may handle the event. This paper investigates a master protocol mechanism for coordinating the actions taken by the responding protocols.

A prototype system developed to convert a behavioral representation of a Boolean function in OBDD form into an initial structural representation is described and experimental results are given. The system produces a multilevel circuit using heuristic rules based on properties of a subset of spectral coefficients. Since the behavioral description is in OBDD form, efficient methods are used to quickly compute the small subset of spectral coefficients needed for the application of the heuristics. The heuristics guide subsequent decompositions of the OBDD, resulting in an iterative construction of the structural form. At each stage of the translation, the form of the decomposition is chosen in order to achieve optimization goals.

This paper evaluates the concurrent error detection capabilities of system-level checks, using fault and error injection. The checks comprise application and system level mechanisms to detect control flow errors. We propose Enhanced Control-Flow Checking Using Assertions (ECCA). In ECCA, branch-free intervals (BFI) in a given high or intermediate level program are identified and the entry and exit points of the intervals are determined. BFls are then grouped into blocks, the size of which is determined through a performance/overhead analysis. The blocks are then fortified with preinserted assertions. For the high level ECCA, we describe an implementation of ECCA through a preprocessor that will automatically insert the necessary assertions into the program. Then, we describe the intermediate implementation possible through modifications made on gee to make it ECCA capable. The fault detection capabilities of the checks are evaluated both analytically and experimentally. Fault injection experiments are conducted using FERRARI to determine the fault coverage of the proposed techniques.

The performance evaluation of large self-healing SONET mesh networks is of great interest to the telecom industry. In this paper, we first modify a model that has been proposed originally for the reliability analysis of SONET networks, for the performance evaluation of such networks. Then, we propose a hierarchical approach that will not only reduce the complexity of the analysis, but also improve the accuracy. The sensitivity of the performance metrics to the traffic distribution and the performance of individual subnetworks are studied experimentally.

Recently, a parametric State Reward Markov Model (SRMM/p) has been developed for the reliability and availability analysis of self-healing SONET mesh networks [2]. In this paper, we investigate the factors that affect the run-time complexity of the model presented in [2]. In order to accelerate the reliability and availability analysis, we present an approach that aggregates a set of states in the model based on 2-phase hypoexponential distribution. A comparison of the original and the reduced model, with respect to runtime complexity and accuracy, is carried out by applying the models for the analysis of few complex networks.

Several algorithmic models have been proposed to estimate software costs and other management parameters. Early prediction of completion time is absolutely essential for proper advance planning and aversion of the possible ruin of a project. L.H. Putnam's (1978) SLIM (Software LIfecycle Management) model offers a fairly reliable method that is used extensively to predict project completion times and manpower requirements as the project evolves. However, the nature of the Norden/Rayleigh curve used by Putnam renders it unreliable during the initial phases of the project, especially in projects involving a fast manpower buildup, as is the case with most software projects. In this paper, we propose the use of a model that improves early prediction considerably over the Putnam model. An analytic proof of the model's improved performance is also demonstrated on simulated data.

This paper presents a model which can be used to characterize the diagnosability of Algorithm-Based Fault Tolerant (ABFT) systems. In the model, the relationship between processors computing useful data, the output data, and the check processors is defined in terms of matrix entries. Necessary and sufficient conditions for detecting and locating faults in the processors are derived, and based on them, efficient algorithms to evaluate the fault detection and location capabilities of the system are developed.

A technique for software fault-tolerance on a distributed object-oriented system is presented. It provides software fault tolerance as well as resilience to the object failures. The technique is an extension of the active object replication schemes. Using the property of encapsulation, a group of objects with multiple implementations sharing a common interface can be treated as if they are a group of replicated objects. The resilience from hardware failures is achieved by the replication of computation. The software fault tolerance is attained by the design diversity. The application layer implementation of the technique is discussed.

Spectral methods for analysis and design of digital logic circuits have been proposed and developed for several years. The widespread use of these techniques has suffered due to the associated computational complexity. This paper presents a new approach for the computation of spectral coefficients with polynomial complexity. Usually, the computation of the spectral coefficients involves the evaluation of inner products of vectors of exponential length. In the new approach, it is not necessary to compute inner products, rather, each spectral coefficient is expressed in terms of a measure of correlation between two Boolean functions. This formulation coupled with compact BDD representations of the functions reduces the overall complexity. Further, some computer aided design applications are presented that can make use of the new spectrum evaluation approach. In particular, the basis for a synthesis method that allows spectral coefficients to be computed in an iterative manner is outlined. The proposed synthesis approach has the advantage that it can accommodate a wide variety of constituent gates, including XOR gates, and complex subfunctions for realizing the circuits.>

In this paper, we investigate the problem of modifying a synthesized circuit to improve its path sensitizability. It is shown that a large number of paths, which cannot be sensitized using single-transition tests, are redundant paths and they can be removed by appropriate modification of the circuit. The effect of these modifications on area and performance of the circuit has been analyzed. For the paths which are neither redundant nor sensitizable using single-transition tests, it is shown that they can be sensitized using multiple-transition tests. Results obtained on some common benchmark examples suggest the validity and viability of this approach.>

We develop an object-oriented framework to support fault tolerance in distributed systems using nested atomic actions. The inherent properties of the object-oriented programming paradigm enhance the error detection and recovery capabilities of the fault tolerance schemes. In our approach, error detection is performed locally within the object, whereas the recovery from errors is accomplished either locally within the object or globally across the active objects. We develop a queue-based backward recovery scheme for the global object restoration which greatly reduces the performance and storage overhead when compared to the existing schemes. We illustrate our approach with the help of prototype implementations.

The analysis of fault-tolerant multiprocessor systems that use concurrent error detection (CED) schemes is much more difficult than the analysis of conventional fault-tolerant architectures. Various analytical techniques have been proposed to evaluate CED schemes deterministically. However, these approaches are based on worst-case assumptions related to the failure of system components. Often, the evaluation results do not reflect the actual fault tolerance capabilities of the system. A probabilistic approach to evaluate the fault detecting and locating capabilities of online checks. in a system is developed. The various probabilities associated with the checking schemes are identified and used in the framework of the matrix-based model. Based on these probabilistic matrices, estimates for the fault tolerance capabilities of various systems are derived analytically.>

The design of fault-tolerant hypercube multiprocessor architecture is discussed. The authors propose the detection and location of faulty processors concurrently with the actual execution of parallel applications on the hypercube using a novel scheme of algorithm-based error detection. System-level error detection mechanisms have been implemented for three parallel applications on a 16-processor Intel iPSC hypercube multiprocessor: matrix multiplication, Gaussian elimination, and fast Fourier transform. Schemes for other applications are under development. Extensive studies have been done of error coverage of the system-level error detection schemes in the presence of finite-precision arithmetic, which affects the system-level encodings. Two reconfiguration schemes are proposed that allow the authors to isolate and replace faulty processors with spare processors.>

A generalization of existing real numer codes is proposed. It is proven that linearity is a necessary and sufficient condition for codes used for fault-tolerant matrix operations such as matrix addition, multiplication, transposition, and LU decomposition. It is also proven that for every linear code defined over a finite field, there exists a corresponding linear real-number code with similar error detecting capabilities. Encoding schemes are given for some of the example codes which fall under the general set of real-number codes. With the help of experiments, a rule is derived for the selection of a particular code for a given application. The performance overhead of fault tolerance schemes using the generalized encoding schemes is shown to be very low, and this is substantiated through simulation experiments.>