Smart home IoT systems have become widely deployed in modern households, enabling convenient functionalities such as remote control, automation, and real-time monitoring. A commonly supported and frequently used capability in these ecosystems is device access sharing, which allows a primary device owner to grant other users permission to control or interact with a device. However, despite its security-critical nature, the security and privacy practices involved in the sharing process itself remain largely under-examined. To address this gap, we conduct a systematic study of device access sharing workflows across 56 commercially available smart home IoT devices spanning diverse vendors and product categories. Through comprehensive analysis of real-world sharing mechanisms, we identify 9 recurring classes of security and privacy risks, including coarse device access constraints, coarse sharing constraints, weak or missing sharing credentials, inability to revoke device access, inability to revoke sharing, lack of transparency regarding invitation acceptance, uncontrolled re-sharing, over-privileged access, and unintended privacy exposure. Our findings reveal widespread and systemic weaknesses in the device sharing implementations of current smart home IoT systems, underscoring that insecure sharing workflows can directly expose users to persistent security and privacy threats.

The last two decades have witnessed the rapid growth of heterogeneous Internet-connected devices in smart homes, which have increasingly become a critical component of the overall Internet ecosystem. However, the diverse nature of these devices with weak security management presents substantial challenges in security and privacy. Many smart home devices fall victim to compromise, subsequently becoming part of botnets exploited by malicious attackers to launch cyberattacks towards other victims. In this paper, we characterize the remote hosts and domains the smart home devices have been communicating with, and more importantly detect if and when these devices communicate with known malicious hosts and domains. Furthermore, we design, implement, and deploy a malicious DNS query blocker system based on the efficient Bloom filter data structure to filter and block outgoing network traffic toward these known malicious hosts and domains, thereby improving the security of smart home networks and the connected devices.

The last few years have witnessed the power of online social media platforms for detecting the outbreaks of the global coronavirus pandemic. However, the explosive and endless data streams in social media have created significant computational challenges for resource-constrained researchers to mine valuable social media data-sets for research discovery. In this paper, we study how to explore sampled and small-scale data streams from social media platforms for effective pandemic surveillance and monitoring. Specifically, we introduce a systematic approach to detect and monitor global pandemics with real-time but sampled Twitter data streams with a combination of document clustering, natural language processing, and Bloom filter. Our approach first uses document clustering to identify coherent tweet clusters from sampled tweets with the same topics and similar contents, and subsequently applies natural language processing to extract the most important and common terms from each cluster. Finally, we design sliding Bloom filters to discover novel terms which potentially capture the underlying emerging events, e.g., early waring signs of global pandemics. Based on real sampled Twitter data streams, we have demonstrated our proposed method is able to effectively detect the early signs of the omicron variant wave of the coronavirus and to provide critical insights on the growth trends and social sentiment during its rapid rise to the dominant coronavirus variant.

Smart homes with various Internet of Things (IoT) devices generate a large amount of network traffic carrying rich information and play an important role in our lives. However, there is a lack of educational material with real case studies to teach undergraduate students smart home security. In this poster paper, we present a holistic curriculum design consisting of five components teaching conceptual understanding of smart home vulnerabilities, capturing and interpreting network traffic for normal and abnormal behaviors of home users and smart devices, and writing reports on smart home security analysis and defense recommendations. A case study on a known vulnerability of Ring doorbell which reveals the password of the smart home Wi-Fi during the initial setup stage is illustrated with the network topology and the captured http traffic. The project is at its initial stage of development by students in a cybersecurity concentration at a primarily undergraduate institution. Students have started collecting and analyzing smart home traffic as a project in the Wireless Network and Security class or through supervised individual undergraduate research studies.

The technology advance and convergence of cyber physical systems, smart sensors, short-range wireless communications, cloud computing, and smartphone apps have driven the proliferation of Internet of things (IoT) devices in smart homes and smart industry. In light of the high heterogeneity of IoT system, the prevalence of system vulnerabilities in IoT devices and applications, and the broad attack surface across the entire IoT protocol stack, a fundamental and urgent research problem of IoT security is how to effectively collect, analyze, extract, model, and visualize the massive network traffic of IoT devices for understanding what is happening to IoT devices. Towards this end, this paper develops and demonstrates an end-to-end system with three key components, i.e., the IoT network traffic monitoring system via programmable home routers, the backend IoT traffic behavior analysis system in the cloud, and the frontend IoT visualization system via smartphone apps, for monitoring, analyzing and virtualizing network traffic behavior of heterogeneous IoT devices in smart homes. The main contributions of this demonstration paper is to present a novel system with an end-to-end process of collecting, analyzing and visualizing IoT network traffic in smart homes.

The ubiquitous deployment of IoT devices in smart homes has led to growing research interests in studying the home network traffic for various applications such as network measurements, device profiling, and IoT device event inference. Recent studies have shown that user activities can be inferred from a home network using extracted device event logs. However, existing solutions for user activity inference such as IoTMosaic and$\text{E2AP}$have limitations when handling ambiguities caused by device malfunctions. In this paper, we first identify the challenges faced by the existing user activity inference algorithms and the root causes of their poor performances on certain types of inputs. We then show that useful information can still be obtained even in situations where device malfunctions introduce ambiguities in user activity patterns. We achieve so by designing an extension to the existing algorithms. We also apply our extension in a digital forensics application. Our extensive experimental evaluations demonstrate that our solutions can effectively provide insights to user activity inference despite the presence of indistinguishable user activity patterns.

Recent advances in cyber-physical systems, artificial intelligence, and cloud computing have driven the wide deployment of Internet-of-things (IoT) in smart homes. As IoT devices often directly interact with the users and environments, this paper studies if and how we could explore the collective insights from multiple heterogeneous IoT devices to infer user activities for home safety monitoring and assisted living. Specifically, we develop a new system, namely IoTMosaic, to first profile diverse user activities with distinct IoT device event sequences, which are extracted from smart home network traffic based on their TCP/IP data packet signatures. Given the challenges of missing and out-of-order IoT device events due to device malfunctions or varying network and system latencies, IoTMosaic further develops simple yet effective approximate matching algorithms to identify user activities from real-world IoT network traffic. Our experimental results on thousands of user activities in the smart home environment over two months show that our proposed algorithms can infer different user activities from IoT network traffic in smart homes with the overall accuracy, precision, and recall of 0.99, 0.99, and 1.00, respectively.

The rapid and ubiquitous deployment of Internet of Things (IoT) in smart homes has created unprecedented opportunities to automatically extract environmental knowledge, awareness, and intelligence. Many existing studies have adopted either machine learning approaches or deterministic approaches to infer IoT device events and/or user activities from network traffic in smart homes. In this paper, we study the problem of inferring user activity patterns from a sequence of device events by first deterministically extracting a small number of representative user activity patterns from the sequence of device events, then applying unsupervised learning to compute an optimal subset of these user activity patterns to infer user activity patterns. Based on extensive experiments with sequences of device events triggered by 2,959 real user activities and up to 30,000 synthetic user activities, we demonstrate that our scheme is resilient to device malfunctions and transient failures/delays, and outperforms the state-of-the-art solution.

The recent spate of cyber attacks towards Internet of Things (IoT) devices in smart homes calls for effective techniques to understand, characterize, and unveil IoT device activities. In this paper, we present a new system, named IoTAthena, to unveil IoT device activities from raw network traffic consisting of timestamped IP packets. IoTAthena characterizes each IoT device activity using an activity signature consisting of an ordered sequence of IP packets with inter-packet time intervals. IoTAthena has two novel polynomial time algorithms,sigMatchandactExtract. For any given signature,sigMatchcan capture all matches of the signature in the raw network traffic. UsingsigMatchas a subfunction,actExtractcan accurately unveil the sequence of various IoT device activities from the raw network traffic. Using the network traffic of heterogeneous IoT devices collected at the router of a real-world smart home testbed and a public IoT dataset, we demonstrate that IoTAthena is able to characterize and generate activity signatures of IoT device activities and accurately unveil the sequence of IoT device activities from raw network traffic.

The wide deployment of IoT systems in smart homes has changed the landscape of networked systems, Internet traffic, and data communications in residential broadband networks as well as the Internet at large. However, recent spates of cyber attacks and threats towards IoT systems in smart homes have revealed prevalent vulnerabilities and risks of IoT systems ranging from data link layer protocols to application services. To address the security challenges of IoT systems in smart homes, this paper introduces IoTArgos, a multi-layer security monitoring system, which collects, analyzes, and characterizes data communications of heterogeneous IoT devices via programmable home routers. More importantly, this system extracts a variety of multi-layer data communication features and develops supervised learning methods for classifying intrusion activities at system, network, and application layers. In light of the potential zero-day or unknown attacks, IoTArgos also incorporates unsupervised learning algorithms to discover unusual or suspicious behaviors towards smart home IoT systems. Our extensive experimental evaluations have demonstrated that IoTArgos is able to detect anomalous activities targeting IoT devices in smart homes with a precision of 0.9876 and a recall of 0.9763.

The recent spate of cyber attacks and security threats toward Internet-of-Things (IoT) systems in smart cities, smart homes, and industry 4.0 calls for effective techniques to understand if, when, who, what IoT systems are exploited and compromised by Internet attackers. Toward this end, this article attempts to study DNS behavioral patterns of IoT systems in edge networks as a first step of characterizing their communication patterns and their interactions with IoT users, cloud servers, and other IoT or non-IoT devices in the same edge networks. Specifically, we analyze the temporal-spatial patterns of DNS behaviors of a variety of IoT systems in two dozens of edge networks and develop a simple yet effective Bloom filter mechanism for detecting anomalous traffic patterns based on unusual DNS queries and answers. To the best of our knowledge, this article is the first effort to systematically measure and monitor IoT network traffic from a DNS perspective for providing the security of heterogeneous IoT systems and ensuring IoT user privacy.

The last decade has witnessed the explosive growth of online social media in users and contents. Due to the unprecedented scale and the cascading power of the underlying social networks, social media has created a new paradigm for sharing information, broadcasting breaking news, and reporting real-time events by any user from anywhere at any time. Many popular social media sites including Twitter provide streaming data services by standard APIs to the broad researcher and developer communities. Given the sheer data volume, rapid velocity, and feature variety of online social media, these sites often supply only a sampled set of streaming data, rather than the full data set to reduce the resource cost of computations, storage, and network bandwidth. In light of the substantial impact of sampling in Twitter data stream, this article explores a combination of spectral clustering, locality-sensitive hashing (LSH), latent Dirichlet allocation (LDA) topic modeling, and differential equation modeling to mitigate the impact of sampling on social media data analysis, in particular on detecting real-world events and predicting information diffusion. Our extensive experiments demonstrate that our proposed method is able to detect effectively the real-time emerging events and predict accurately the cascading pattern of these events from the 1% sampled Twitter data stream. To the best of our knowledge, this article is the first effort to introduce a systematic methodology to study and mitigate the impact of data sampling on social media analysis and mining.

The last decade has witnessed the explosive growth of malicious Internet domains which serve as the fundamental infrastructure for establishing advanced persistent threat command and control communication channels or hosting phishing Web sites. Given the big data nature of Internet traffic data and the ability of algorithmically generating domains and acquiring and registering the domains in a near-automated fashion, detecting malicious domains in real-time is a daunting task for security analysts and network operators. In this paper, we introduce bipartite graphs to capture the interactions between end hosts and domains, identify associated IP addresses of domains, and characterize time-series patterns of DNS queries for domains, and explore one-mode projections of these bipartite graphs for modeling the behavioral, IP-structural, and temporal similarities between domains. We employ graph embedding technique to automatically learn dynamic and discriminative feature representations for over 10,000 labeled domains, and develop an SVM-based classification algorithm for predicting malicious or benign domains. Our model makes the progress towards adapting to the changing and evolving strategies of malicious domains. The experimental results have shown that our proposed algorithm achieves an area under the curve (AUC) of 0.94 based on k-fold cross-validation. To the best of our knowledge, this is the first effort to apply the combination of behavioral modeling and graph embedding for effectively and accurately detecting malicious domains.

The last decade has witnessed research advances and wide deployment of Internet-of-things (IoT) in smart homes and connected industry. However, the recent spate of cyber attacks exploiting the vulnerabilities and insufficient security management of IoT devices have created serious challenges for securing IoT devices and applications. As a first step towards understanding and mitigating diverse security threats of IoT devices, this paper develops a measurement framework to automatically collect network traffic of IoT devices in edge networks, and build multidimensional behavioral profiles of these devices which characterize who, when, what, and why on the behavioral patterns of IoT devices based on continuously collected traffic data. To the best of our knowledge, this paper is the first effort to shed light on the IP-spatial, temporal, and cloud service patterns of IoT devices in edge networks, and to explore these multidimensional behavioral fingerprints for IoT device classification, anomaly traffic detection, and network security monitoring for millions of vulnerable and resource-constrained IoT devices on the Internet.

The challenging requirements of fifth-generation (5G) Internet-of-Things (IoT) applications have motivated a desired need for feasible network architecture, while Named Data Networking (NDN) is a suitable candidate to support the high density IoT applications. To effectively distribute increasingly large volumes of data in large-scale IoT applications, this paper applies network coding techniques into NDN to improve IoT network throughput and efficiency of content delivery for 5G. A probability-based multipath forwarding strategy is designed for network coding to make full use of its potential. To quantify performance benefits of applying network coding in 5G NDN, this paper integrates network coding into a NDN streaming media system implemented in the ndnSIM simulator. The experimental results clearly and fairly demonstrate that considering network coding in 5G NDN can significantly improve the performance, reliability, and QoS. Besides, this is a general solution as it is applicable for most cache approaches. More importantly, our approach has promising potentials in delivering growing IoT applications including high-quality streaming video services.

The recent advances in cutting-edge electronic and computer technologies and wireless communications have paved the way for the proliferation of wireless networks, encompassing cellular, vehicular, body area, underwater, mobile ad hoc, and sensor networks. Wireless networks, allowing communications from any device, anywhere and anytime, bring a wide range of emerging and disruptive applications in manufacturing, healthcare, military, personal entertainment, safety, and rescue. However, the increasing sophistication and scale of cyber security and crimes in wireless networks have challenged traditional techniques of securing devices, applications, and traffic of wireless networks. Particularly, as the threats and vulnerabilities continue to grow in ubiquitous wireless networks, devices, and applications, it is crucial and imperative for researchers and practitioners of wireless networks to understand the entire cyber-attack and crime spectrum on wireless networks and applications and explore new technologies to mitigate and thwart these attacks, as well as to monitor, capture, and analyze security attacks via forensics analysis. The editorial committees have accepted 12 submissions in this special issue and all the papers have gone through a regular reviewing process. Among these accepted papers, four of them are related to Cloud Computing security. In the paper titled ‘PIMRS: achieving privacy and integrity-preserving multi-owner ranked-keyword search over encrypted cloud data’, Li et al. propose a privacy and integrity-preserving multi-owner ranked-keyword search scheme named PIMRS, where an asymmetric scalar-product encryption function is adopted to preserve data privacy and to obtain more precise search results. In the paper titled ‘MEDAPs: Secure Multi-Entities Delegated Authentication Protocols for Mobile Cloud Computing’, three secure multi-entities delegated authentication protocols are proposed for mobile cloud computing. In these protocols, multiple mobile data owners can authorize a group-designated cloud server with signing rights. Irfan et al. present a framework based on security information and event management to efficiently collect evidence for crime investigation, which can benefit cloud forensics in their paper ‘A framework for cloud forensics evidence collection and analysis using security information and event management’. In the paper ‘Efficient Keyword Search over Encrypted Data in Multi-cloud Setting’, Miao et al. propose two keyword search schemes over encrypted data in multi-cloud setting scenarios. The proposed schemes can guarantee data privacy and reliability. Furthermore, the experimental results indicate that the proposed schemes are feasible and efficient in practical applications. Besides cloud computing security, this special issue also involves another 8 papers covering a wide variety of topics. In the paper titled ‘Secure the Internet, one home at a time’, Xu et al. propose a Bloom-filter based analytics framework to capture persistent threats towards the same home routers and to identify correlated attacks towards distributed home networks. This work is the first one to characterize cyber threats towards home networks. In the paper titled ‘Secure multi-unit sealed first-price auction mechanisms’, Li et al. propose three secure, multi-unit, sealed-bid, and first-price auction schemes. An auctioneer is able to verify that the winners have paid the correct amounts in these three schemes. Theoretical analysis is provided to evaluate the security properties, computational complexity, and communication complexity of the auctions. Zhang et al. propose a data aggregation approach where an untrustful aggregator in mobile sensing can collect statistic data from mobile users in their paper titled ‘An Efficient Privacy Preserving Data Aggregation Approach for Mobile Sensing’. This approach preserves user privacy and can perform data integrity verification. Lai et al. propose a secure and privacy-preserving group setup framework, SPGS, for platoon-based VCPS in their paper titled ‘SPGS: A Secure and Privacy-Preserving Group Setup Framework for Platoon-Based Vehicular Cyber-Physical Systems’. Two authentication protocols are also provided accordingly. The security feature and efficiency of SPGS are verified by the thorough analysis. In the paper titled ‘Multi-proxy multi-signature binding positioning protocol’, Xue et al. propose a multi-proxy multi-signature binding positioning protocol, based on which a multi-proxy multi-signature binding positioning protocol is designed. The correctness and security features of the proposed protocols are analyzed. Qi et al. propose an effective steganography attacking method which is not limited by the types of the steganography method in their paper titled ‘Generic attack against robust steganography based on spring transform and geometrization’. The experiment results indicate that the peak signal-to-noise ratio of images can be above 32 dB Q4 while the stego data are destroyed. In the paper titled ‘Active jamming for multi-user information security improvement with the access statuses of users’, Xu et al. propose a novel physical layer scheme for improving multiple users' information security in the next-generation communication systems. The proposed scheme is linear without iteration and it is feasible for multi-user security enhancement. In the paper titled ‘Secured measurement fusion scheme against deceptive ECM attack in radar network’, in order to prevent electronic countermeasure attacks in radar networks, Yang et al. propose a new measurement fusion scheme, which shows better security performance when a DECM attack happens. The authors also perform simulations to demonstrate the superior of their novel scheme. On behalf of the editorial committee, we would like to thank all the authors for contributing their high quality papers to this special issue. We also want to thank all the reviewers for volunteering their time to review the papers and providing valuable comments, which help with improving the quality of the papers. We are also grateful to Prof. Hsiao-Hwa Chen and Prof. Hamid R. Sharif, who are the Editor-in-Chiefs of Security and Communication Networks, for providing us the opportunity to organize this special issue and for their support during the whole publication process.

The rapid growth of residential broadband connections and Internet-enabled home devices have driven the success of many useful applications such as video streaming and remote healthcare. However, poorly managed routers and connected devices in the home are vulnerable under persistent threats and exploitations from cyber attackers across the Internet who continuously identify, compromise, and control devices as part of botnets for launching click fraud, denial of service attacks, spam campaigns. These growing threats and broad damages have made it imperative to understand, characterize, filter, and reduce exploit traffic towards millions of home routers and billions of connected devices in the home. This paper presents a bloom-filter based analytics framework to capture persistent threats towards the same home routers and to identify correlated attacks towards distributed home networks. Our experimental results based on network traffic collected from real homes over 18months have revealed a number of interesting findings on persistent and correlated threats towards home networks, which calls for improved security and management of home networks. To the best of our knowledge, this paper is the first effort to characterize cyber threats towards home networks and to propose a simple and yet effective approach to identify persistent and aggressive attacks towards home networks. Copyright © 2016 John Wiley & Sons, Ltd.

These growing threats and broad damages have made it imperative to understand, characterize, filter, and reduce exploit traffic towards millions of home routers and billions of connected devices in the home. This paper presents a bloom-filter based analytic framework to capture persistent threats towards the same home routers and to identify correlated attacks towards distributed home networks. Our experimental results based on network traffic collected from real homes over 18 months have revealed a number of interesting findings on persistent and correlated threats towards home networks, which calls for improved security and management of home networks. To the best of our knowledge, this paper is the first effort to characterize cyber threats towards home networks and to propose a simple and yet effective approach to identify persistent and aggressive attacks towards home networks.

The explosive growth of online social networks in recent years have generated massive amount of data-sets in user behaviors, social graphs, and contents. Given the scale, heterogeneity, and diversity of such big data, sampling becomes a simple and intuitive approach to reduce the size of the data-sets for collecting, measuring, and understanding users, behaviors and traffic in online social networks. In this paper, we quantify the impact of random sampling on the analysis of online social networks with Twitter streaming data as a case study. In addition, we design different sampling strategies including community sampling and strata sampling, and evaluate their impact on a broad range of behavioral characteristics of online social networks. Our experimental results show that community sampling has the minimum impact on tweet distributions across users and the structure of retweeting graphs, while achieving the similar data reductions as random and stratified sampling.

Sina Weibo, a Twitter-like microblogging site attracting over 240 million monthly active users to tweet, retweet, and comment, has rapidly become one of the most popular social media sites in China. As many users create new and innovative words on their tweets and comments, it is necessary to extract these emerging words, which do not exist in today's Chinese vocabulary or dictionary. Towards this end, this paper proposes a novel method based on data clustering of Weibo users and tweets for extracting unknown words from Weibo tweets and comments. Specifically, relying on the similarity of the users who post the tweets, we apply a hierarchical clustering to divide Weibo data into distinct groups, e.g., sports, news stories, movies, before extraction. Comparing with the method of unclustered Weibo data, our experimental results have successfully demonstrated the benefits of the proposed data clustering scheme for improving the recall and accuracy of extracting unknown Chinese words from tweets and comments.

The new social media such as Twitter and Sina Weibo has become an increasingly popular channel for spreading influence, challenging traditional media such as TVs and newspapers. The most influential and verified users, also called big-V accounts on Sina Weibo often attract million of followers and fans, creating massive “celebrity-centric” social networks on the social media, which play a key role in disseminating breaking news, latest events, and controversial opinions on social issues. Given the importance of these accounts, it is very crucial to understand social networks and user influence of these accounts and profile their followers' behaviors. Towards this end, this paper monitors a selected group of influential users on Sina Weibo and collects their tweet streams as well as retweeting and commenting activities on these tweets from their followers. Our analysis on tweet data streams from Sina Weibo reveals when and what the followers comment on the tweets of these influential users, and discovers different temporal patterns and word diversity in the comments. Based on the insight gained from follower characteristics, we further develop simple and intuitive algorithms for classifying the followers into spammers and normal fans. Our experimental results demonstrate that the proposed algorithms are able to achieve an average accuracy of 95.20% in detecting spammers from the followers who have commented on the tweets of these influential accounts.

How to effectively distribute and share increasingly large volumes of data in large-scale network applications is a key challenge for Internet infrastructure. Although NDN, a promising new future internet architecture which takes data oriented transfer approaches, aims to better solve such needs than IP, it still faces problems like data redundancy transmission and inefficient in-network cache utilization. This paper combines network coding techniques to NDN to improve network throughput and efficiency. The merit of our design is that it is able to avoid duplicate and unproductive data delivery while transferring disjoint data segments along multiple paths and with no excess modification to NDN fundamentals. To quantify performance benefits of applying network coding in NDN, we integrate network coding into an NDN streaming media system implemented in the ndn SIM simulator. Basing on BRITE generated network topologies in our simulation, the experimental results clearly and fairly demonstrate that considering network coding in NDN can significantly improve the performance, reliability and QoS. More importantly, our approach is capable of and well fit for delivering growing Big Data applications including high-performance and high-density video streaming services.

The new named data networking (NDN) has shifted the Internet from today's IP-based packet-delivery model to the name-based data retrieval model. The architecture shift from IP addresses to named data results in effective content delivery via in-networking cache and direct object retrieval. However, this shift has also created challenges and obstacles for securing data objects and providing appropriate access control on named data due to broad data replications and the loss of network perimeters. This paper designs, implements, and evaluates an encryption and probability based access control model for NDN with video streaming service as a case study. In particularly, we explore a combination of public-key cryptography and symmetric ciphers to encrypt video data for preventing unauthorized access. In addition, we build a bloom-filter probabilistic data structure for pre-filtering Interests from consumers without desired credentials. Our experimental results have demonstrated the capabilities of the proposed model for providing access control while incurring low system and performance overhead on producers and consumers.

Detecting financial fraud is a daunting challenge for banks and credit card companies due to massive amount of transaction data and wide diversity of user behaviors [1]. In recent years social media has demonstrated the capability of crowdsourcing in a broad range of applications, e.g., disseminating breaking news, launching marketing campaigns, and tracking the flu [2], [3], [4]. Inspired by these novel applications, this paper explores the benefits of social media crowdsourcing, in particularly the tweets, re-tweets and comments from Twitter online social network for effectively detecting financial fraud events.

Sina Weibo has become an increasingly critical social media in China for sharing latest news, marketing new products, and discussing controversial issues. The rising importance of Sina Weibo on the society makes it very important to understand “what”, “when”, “who” on hot topics that are being continuously tweeted and searched by millions of active users. In this paper, we develop a systematic approach to characterize temporal distribution of hot topics searched by Sina Weibo users over a four-month time-span and to uncover correlated hot topics that are not only tweeted by the same users, but also appear in the similar set of tweet messages. We analyze real-time Sina Weibo tweet data streams and study volume correlations and temporal gaps between user searches and tweeting activities on hot topics. In addition, we examine the correlations between hot topic searches on social media and on search engines to understand hot topics and user behaviors across different platforms. Given the challenges of analyzing massive amount of tweet data, we explore Hadoop MapReduce framework to effectively process millions of tweets from the collected data-sets, and quantify the performance benefits of MapReduce on analyzing tweet streams. To the best of our knowledge, this paper is the first effort to characterize temporal search patterns of hot topics on Sina Weibo and to study their correlations with tweeting data streams as well as search engine statistics.

As Internet traffic continues to grow in size and complexity, it has become an increasingly challenging task to understand behavior patterns of end-hosts and network applications. This paper presents a novel approach based on behavioral graph analysis to study the behavior similarity of Internet end-hosts. Specifically, we use bipartite graphs to model host communications from network traffic and build one-mode projections of bipartite graphs for discovering social-behavior similarity of end-hosts. By applying simple and efficient clustering algorithms on the similarity matrices and clustering coefficient of one-mode projection graphs, we perform network-aware clustering of end-hosts in the same network prefixes into different end-host behavior clusters and discover inherent clustered groups of Internet applications. Our experiment results based on real datasets show that end-host and application behavior clusters exhibit distinct traffic characteristics that provide improved interpretations on Internet traffic. Finally, we demonstrate the practical benefits of exploring behavior similarity in profiling network behaviors, discovering emerging network applications, and detecting anomalous traffic patterns.

Sina Weibo, one of the most popular online social networks in China, has recently become a critical medium for Internet users to disseminate and discuss breaking news, social events and other information. Although online social networks and social media have received significant attention from the research community, few studies have focused on Sina Weibo due to the lack of data collection. Given the sheer size of Sina Weibo online social network and vast amount of tweets, retweets and comments, this paper introduces a novel community approach for understanding Sina Weibo online social network. Specifically, we collect all Weibo users registered with Shenzhen as primary geographic location, and build a Shenzhen Weibo community graph based on their following or follower relationships. Our experimental results describe interesting graphical characteristics such as clustering coefficients of this community graph, and reveal the impact of user popularity on tweet influence. Through modeling interactions of Shenzhen Weibo users and their tweeted messages with bipartite graphs and one-mode projections, we analyze the similarity of retweeting and commenting activities among these users, and discuss the implications of the findings on understanding different types of user accounts and the motivations of their following and retweeting behaviors. To the best of our knowledge, this study is the first effort to introduce a community approach for understanding the community characteristics of Sina Weibo and characterizing the similarity of retweeting behaviors and following relationships.

The explosive growth of Internet-connected consumer devices in the digital home has made home networks one of the important emerging topics in networking research. A rich body of research efforts have been made to study broadband performance and home network management, little is known about network traffic that are exchanged within home networks or between Internet-connected devices in home networks and end hosts on the Internet. In this paper we design and implement a built-in traffic monitoring system on programmable home routers to collect and analyze incoming, outgoing and internal traffic for residential home networks. To illustrate the applications of the proposed built-in traffic monitoring system, we deploy the system in two real home networks, and demonstrate its capabilities of detecting unwanted traffic towards home networks as well as those suspicious traffic originating from compromised devices in home networks. In addition, our correlation analysis on unwanted traffic towards distributed home networks reveals aggressive scanners on the Internet and sheds lights on traffic characteristics of these scanners.

Mathematical modeling is an important approach to study information diffusion in online social networks. Prior studies have focused on the modeling of the temporal aspect of information diffusion. A recent effort introduced the spatiotemporal diffusion problem and addressed the problem with a theoretical framework built on the similarity between information propagation in online social networks and biological invasion in ecology [1]. This paper examines the spatio-temporal characteristics in further depth and reveals that there exist regularities in information diffusion in temporal and spatial dimensions. Furthermore, we propose a simpler linear partial differential equation that takes account of the influence of spatial population density and temporal decay of user interests in the information. We validate the proposed linear model with Digg news stories which received more than 3000 votes during June 2009, and show that the model can describe nearly 60% of the news stories with over 80% accuracy. We also use the most popular news story as a case study and find that the linear diffusive model can achieve an accuracy as high as 97:41% for this news story. Finally, we discuss the potential applications of this model towards finding super spreaders and classifying news story into groups.

It is our great pleasure to welcome you to the 32nd IEEE International Performance, Computing, and Communications Conference (IPCCC 2013) on December 6 – 8, 2013 at Coronado Island Marriott Resort & Spa, San Diego, California. IPCCC is a premier venue of IEEE Computer Society for researchers from academia, government, and industry to present, explore and discuss latest research advances in the performance of computer and communication systems.

The rapid growth of broadband connections and home networks has created new application opportunities such as video streaming and remote health care. However, managing and securing the increasingly complicated home networks has remained a serious challenge for most home users who have little technical expertise to manage their home networks and connected devices. Towards this end, we will demonstrate HomeTPS, a traffic profiling system for home networks that collects, analyzes and makes sense of home network traffic. The demonstration will show automatic traffic collection from programmable home routers, informative traffic summary reports and behavior profiles for Internet-capable home devices, and real-time discovery of anomalous traffic from Internet attackers or from compromised devices in home networks.

Recent years have witnessed rapid growth of innovative and disruptive Internet services such as video streaming and peer-to-peer applications. As network traffic of these applications continues to grow, it has become a challenging task to understand their communication patterns and traffic behavior of end hosts engaging in these applications. This paper presents a novel approach based on behavioral graph analysis to study social behavior of Internet applications based on bipartite graphs and one-mode projection graphs. Through a vector of graph properties including coefficient clustering that capture social behaviors of end hosts, we discover the inherent clustered groups of Internet applications that not only exhibit similar social behavior of end hosts, but also have similar characteristics in the aggregated traffic. In addition, we demonstrate the usage of the proposed approach in detecting emerging applications and anomalous traffic patterns towards Internet applications.

Effectively managing multiple data centers and their traffic dynamics pose many challenges to their operators, as little is known about the characteristics of inter-data center (D2D) traffic. In this paper we present a first study of D2D traffic characteristics using the anonymized NetFlow datasets collected at the border routers of five major Yahoo! data centers. Our contributions are mainly two-fold: i) we develop novel heuristics to infer the Yahoo! IP addresses and localize their locations from the anonymized NetFlow datasets, and ii) we study and analyze both D2D and client traffic characteristics and the correlations between these two types of traffic. Our study reveals that Yahoo! uses a hierarchical way of deploying data centers, with several satellite data centers distributed in other countries and backbone data centers distributed in US locations. For Yahoo! US data centers, we separate the client-triggered D2D traffic and background D2D traffic from the aggregate D2D traffic using port based correlation, and study their respective characteristics. Our findings shed light on the interplay of multiple data centers and their traffic dynamics within a large content provider, and provide insights to data center designers and operators as well as researchers.

This paper explores the behavior similarity of Internet end hosts in the same network prefixes. We use bipartite graphs to model network traffic, and then construct one-mode projection graphs for capturing social-behavior similarity of end hosts. By applying a simple and efficient spectral clustering algorithm, we perform network-aware clustering of end hosts in the same prefixes into different behavior clusters. Based on information-theoretical measures, we find that the clusters exhibit distinct traffic characteristics which provides improved interpretations of the separated traffic compared with the aggregated traffic of the prefixes. Finally, we demonstrate the applications of exploring behavior similarity in profiling network behaviors and detecting anomalous behaviors through synthetic traffic that combines Internet backbone traffic and packet traces from real scenarios of worm propagations and denial of service attacks.

In this short paper, we present a preliminary design of a behavior profiling system in wireless home network (WHN) for network security monitoring. Figure 1 illustrates a schematic architecture of the behavior profiling system that is deployed in a typical wireless home network. The goals of the proposed behavior profiling system are to i) actively learn the traffic patterns of wireless home networks, ii) detect anomalous behavior from inside networks as well as from the Internet. Based on network traffic patterns for each computer, the system builds baseline behavior profiles, and subsequently detects events of interest through behavior deviations. The contributions of this work are two-fold. First, we propose to build the behavior profiles for each computer in WHNs towards a deep understanding of the traffic patterns in wireless residential networks. Secondly, we present a systematic architecture that aims to detect anomalous behavior through real-time traffic profiling.

Recent spates of cyber attacks towards cloud computing services running in large data centers have made it imperative to develop effective techniques to detect anomalous behaviors in the "clouds". In this paper, we propose to use the distributions of IP address octets and centroid based measures to characterize the inherent IP structure in high-volume data center traffic, and subsequently design a simple yet effective algorithm to detect abnormal traffic patterns caused by network attacks such as worms, virus, and denial of service attacks. We evaluate the effectiveness and efficiency of this algorithm with synthetic traffic that combines real data center traffic collected from a large Internet content provider with worm traces and denial of service attacks. The experiment results show that our algorithm consistently diagnoses the abnormal traffic from normal ones, and does so in a short time with a low false alarm rate. We believe that the proposed approach could be potentially deployed in real-time data center environments to enhance the security and high availability of cloud computing.

Recent outages in several Web services have demonstrated the potential damage of availability disruptions, since millions of end users rely on these services powered by thousands of servers in large-scale Internet data centers. As Internet data centers continue to grow in scale and complexity, it has become a daunting task to monitor and manage thousands of servers simultaneously. This paper presents a cooperative monitoring framework to continuously monitor availability of thousands of servers in Internet data centers. We propose a simple yet effective algorithm for locating monitor nodes for the purposes of load balancing and resilience, and demonstrate the performance of this method through simulations based on dataset collected from a large Internet content provider. The results show that the monitoring load are well divided among the servers in the data centers, and cooperative monitoring adapts gracefully to the events of monitoring node failures.

This paper presents the design and implementation of a real-time behavior profiling system for high-speed Internet links. The profiling system uses flow-level information from continuous packet or flow monitoring systems, and uses data mining and information-theoretic techniques to automatically discover significant events based on the communication patterns of end-hosts. We demonstrate the operational feasibility of the system by implementing it and performing extensive benchmarking of CPU and memory costs using a variety of packet traces from OC-48 links in an Internet backbone network. To improve the robustness of this system against sudden traffic surges such as those caused by denial of service attacks or worm outbreaks, we propose a simple yet effective filtering algorithm. The proposed algorithm successfully reduces the CPU and memory cost while maintaining high profiling accuracy.

The current best-effort Internet cannot readily provide the service guarantees that VoIP applications often require. Path switching can potentially address this problem without requiring new network mechanisms, simply by leveraging the robustness to performance variations available from connectivity options such as multi-homing and overlays. In this paper, we evaluate the effectiveness and benefits of path switching in improving the quality of VoIP applications, and demonstrate its feasibility through the design and implementation of a prototype gateway. We argue for an application-driven path switching system that accounts for both network path characteristics and application-specific factors (e.g., codec algorithms, playout buffering schemes). We also develop an application path quality estimator based on the ITU-T E-model for voice quality assessment, and an application-driven path switching algorithm that dynamically adapts the time scales over which path switching decisions are made to maximize voice quality. Through network emulation and experiments over a wide-area multi-homed test bed, we show that, with sufficient path diversity, path switching can yield meaningful improvements in voice quality. Hence by exploiting the inherent path diversity of the Internet, application-driven path switching is a viable option in providing quality-of-service to applications.

Recent spates of cyber-attacks and frequent emergence of applications affecting Internet traffic dynamics have made it imperative to develop effective techniques that can extract, and make sense of, significant communication patterns from Internet traffic data for use in network operations and security management. In this paper, we present a general methodology for building comprehensive behavior profiles of Internet backbone traffic in terms of communication patterns of end-hosts and services. Relying on data mining and information-theoretic techniques, the methodology consists of significant cluster extraction, automatic behavior classification and structural modeling for in-depth interpretive analyses. We validate the methodology using data sets from the core of the Internet. The results demonstrate that it indeed can identify common traffic profiles as well as anomalous behavior patterns that are of interest to network operators and security analysts.

This work explores the feasibility of improving the performance of end-to-end data transfers between different sites through path switching. Our study is focused on both the logic that controls path switching decisions and the configurations required to achieve sufficient path diversity. Specifically, we investigate two common approaches offering path diversity multi-homing and overlay networks - and investigate their characteristics in the context of a representative wide-area testbed. We explore the end-to-end delay and loss characteristics of different paths and find that substantial improvements can potentially be achieved by path switching, especially in lowering end-to-end losses. Based on this assessment, we develop a simple path-switching mechanism capable of realizing those performance improvements. Our experimental study demonstrates that substantial performance improvements are indeed achievable using this approach.

Route flap damping (RFD) is anecdotally considered to be a key contributor in the stability of the inter-domain routing system. It works by suppressing advertisements about persistently flapping routes, which otherwise would propagate throughout the Internet. It was recently shown that relatively stable routes, i.e., routes that fail occasionally, can be incorrectly suppressed by this mechanism for substantially long periods of time. This can be traced back to the complex interaction between BGP path exploration and the mechanism used by RFD to identify route flaps. In this paper we study the distinctive feature that distinguishes the sequence of updates following a single network event from that of persistently unstable routes. Based on this characteristic, we propose a new BGP route flap damping algorithm, RFD+, with the following properties - 1) it can correctly distinguish between route flaps and normal path exploration; 2) it suppresses routes that are frequently and persistently changing; and 3) it does not affect routes that fail occasionally. We present the algorithm and discuss its relevant properties; simulation studies are also conducted to illustrate the performance of our algorithm.

No abstract available.