The integration of Mobile Edge Computing (MEC) and Blockchain has emerged as an efficient approach to support the development of secure and delay-sensitive Internet of Things (IoT) applications. Despite these advantages, blockchain-enabled IoT systems face a fundamental challenge because the security and trust benefits of blockchain are accompanied by additional computation and communication overheads that can degrade latency and energy efficiency in resource-constrained environments. This paper develops a unified multi-objective optimization framework for task offloading and resource allocation in blockchain-enabled IoT networks. The considered system architecture incorporates IoT devices, MEC servers, and a cloud data center while explicitly modeling blockchain operations as part of the offloading process. A multi-objective optimization problem is formulated to jointly minimize total system latency and energy consumption while maximizing the aggregate reputation of the selected blockchain management nodes. To solve this problem, two evolutionary solution approaches are employed. The Non-dominated Sorting Genetic Algorithm II (NSGA-II) is used to identify Pareto-optimal trade-off solutions, and a Genetic Algorithm (GA) is adopted to solve a weighted-sum scalarized formulation. Comprehensive simulation results indicate a demonstrable trade-off between latency and energy consumption. Specifically, the analysis reveals that prioritizing high-reputation nodes for blockchain consensus roles significantly reduces transaction verification latency, thereby enhancing the overall system performance despite the operational overheads. The framework allows stakeholders to select solutions that best meet specific IoT application requirements.

Decentralized Federated Learning (DFL) offers a scalable paradigm for collaborative intelligence at the edge, yet its practical efficacy is severely constrained by system heterogeneity. Traditional synchronous protocols enforce rigid, lockstep aggregation barriers, where the training velocity of the entire collective is strictly dictated by the slowest straggler node, inevitably leading to significant idle time and resource underutilization. While asynchronous strategies mitigate latency, they often introduce complex pathologies, such as unbounded staleness and systemic unfairness, because high-performance nodes disproportionately bias the global model toward local data distributions, thereby marginalizing slower contributors. To rigorously reconcile these conflicting trade-offs, this work presents CAFF , a novel asynchronous communication framework for DFL that decouples local optimization from global synchronization via a topology-aware, event-driven protocol. By implementing a topology-aware cache with a strict per-neighbor replacement policy, the mechanism limits per-peer dominance by enforcing a one-slot-per-neighbor cache and exclusive replacement, preventing any peer from contributing multiple updates within a single aggregation event. Furthermore, a configurable staleness filter and a dynamic aggregation threshold ensure robust convergence stability across diverse federation topologies. Extensive empirical evaluations using MNIST, FashionMNIST, CIFAR-10, and SVHN, conducted on a high-fidelity, virtualized testbed across fully connected, star, and ring topologies, demonstrate that CAFF significantly outperforms synchronous baselines. Specifically, in dense network configurations, the framework reduces wall-clock training time by up to 39% and network traffic by up to 75%, while maintaining competitive predictive fidelity with controlled accuracy degradation. These results position CAFF as a robust and scalable efficiency-oriented solution for heterogeneous peer-to-peer learning environments.

As Fifth-generation (5G) networks advance towards future 6G technology, they provide enhanced capabilities in terms of data rates, latency, and connectivity. The expanding and heterogeneous landscape further extends the attack surface with increasing vulnerability to a wide range of dynamic cyber threats. Traditional Intrusion Detection Systems, relying on static signature-based methods, face significant challenges in detecting novel attacks in such complex environments. This paper proposes an explainable hybrid AE-XGBoost framework to address these gaps. In this proposed framework, the deep autoencoder serves as the backbone for two primary tasks: learning robust features from high-dimensional traffic data and synthesizing high-quality samples for minority, underrepresented attack classes. It effectively forms a class-balanced dataset. This is further extended to integrate Shapley Additive Explanations (SHAP), which provide needed interpretability. The framework robustness is determined by an extensive evaluation strategy. Extensive experiments are conducted using a 5-fold cross-validation and cross-dataset validation using three different datasets. The experimental results demonstrate the model effectiveness and promising generalization across the different datasets. Across these settings, the proposed IDS achieves F1-scores between approximately 0.96 and 0.999 and AUC values above 0.97, with only minor performance differences between original and synthetic test samples. SHAP-based analysis further reveals that a small subset of 5G- and TCP-level features consistently dominates the predictions, offering actionable explanations for security analysts. This provides a successful, scalable, and reliable security measure that proves effective and appropriate for 6G mobile network implementations in the near future.

Federated Learning (FL) offers a paradigm for collaborative AI that mitigates raw data exposure, yet the statistical heterogeneity of client data severely constrains its practical application. This non-independent and identically distributed (non-IID) setting induces client drift, leading to unstable optimization and degraded generalization, particularly for under-represented classes. Existing solutions present a difficult trade-off: iterative, regularization-based methods suffer from high communication overhead and a centralized bottleneck, while knowledge-distillation-based approaches rely on impractical artifacts, such as shared public datasets. This work introduces FedEnD , a novel framework that addresses the previous challenge through an efficient, fully decentralized architecture. FedEnD employs a two-stage protocol that decouples local specialist training from a collaborative fusion stage. Following a communication-free training phase, clients perform a one-shot peer-to-peer broadcast that shares (optionally privatized) specialist parameters and lightweight class-count statistics. Each client then uses these statistics to construct a class-distribution-weighted teacher ensemble from the received specialists. Crucially, this ensemble’s knowledge is distilled into a robust global model on each client, using only their local data as unlabeled inputs, obviating the need for a central server or auxiliary data. Extensive experiments on MNIST, FashionMNIST, SVHN, and CIFAR-10 demonstrate that FedEnD outperforms baselines, surpassing robust methods such as SCAFFOLD by +5.7% on complex datasets in pathologically skewed settings. This superior accuracy is achieved while reducing communication bandwidth by 68.6% compared to standard iterative averaging, and by up to 84% compared to gradient-correction methods like SCAFFOLD, highlighting a favorable trade-off between accuracy and communication bandwidth in decentralized learning under severe non-IID partitions.

Context: Decentralized Federated Learning (DFL) is an emerging paradigm that enables collaborative model training without centralized data and model aggregation, enhancing privacy and resilience. However, its sustainability remains underexplored, as energy consumption and carbon emissions vary across different system configurations. Understanding the environmental impact of DFL is crucial for optimizing its design and deployment. Objective: This work aims to develop a comprehensive and operational framework for assessing the sustainability of DFL systems. To address it, this work provides a systematic method for quantifying energy consumption and carbon emissions, offering insights into improving the sustainability of DFL. Methods: This work proposes GreenDFL , a fully implementable framework that has been integrated into a real-world DFL platform. GreenDFL systematically analyzes the impact of various factors, including hardware accelerators, model architecture, communication medium, data distribution, network topology, and federation size, on the sustainability of DFL systems. Besides, a sustainability-aware aggregation algorithm ( GreenDFL-SA ) and a node selection algorithm ( GreenDFL-SN ) are developed to optimize energy efficiency and reduce carbon emissions in DFL training. Results: Empirical experiments are conducted on multiple datasets, measuring energy consumption and carbon emissions at different phases of the DFL lifecycle. Results indicate that local training dominates energy consumption and carbon emissions, while communication has a relatively minor impact. Optimizing model complexity, using GPUs instead of CPUs, and strategically selecting participating nodes significantly improve sustainability. Additionally, using wired communication, particularly optical fiber, effectively reduces energy consumption during the communication phase, while integrating early stopping mechanisms further minimizes overall emissions. Conclusion: The proposed GreenDFL provides a comprehensive and practical approach for assessing the sustainability of DFL systems. Furthermore, it offers best practices for improving environmental efficiency in DFL, making sustainability considerations more actionable in real-world deployments.

The QUIC protocol is now widely adopted by major tech companies and accounts for a significant fraction of today's Internet traffic.QUIC's multiplexing capabilities, encrypted headers, dynamic IP address changes, and encrypted parameter negotiations make the protocol not only more efficient, secure, and censorship-resistant, but also practically unmanageable by firewalls.This opens up doors for attackers that may exploit certain traits of the QUIC protocol to perform targeted attacks, such as data exfiltration attacks.Whereas existing data exfiltration techniques, such as TLS and DNS-based exfiltration, can be detected on a firewall level, QUIC-based data exfiltration is more difficult to detect, since changes in IP addresses and ports are inherent to the protocol's normal behaviour.To show the feasibility of a QUIC-based data exfiltration attack, we first introduce a novel method which leverages the server preferred address feature of the QUIC protocol and, thus, allows an attacker to exfiltrate sensitive data from an infected machine to a malicious server, disguised as a server-side connection migration.The attack is implemented in the form of a proof of concept tool in Rust.We evaluated the performance of five anomaly detection classifiers -Random Forest, Multi-Layer Perceptron, Support Vector Machine, Autoencoder, and Isolation Forest -trained on datasets collected from three distinct network traffic scenarios.The classifiers were trained on ∼ 700K benign and malicious QUIC packets and 786 connection migration events, but were unable to effectively detect the data exfiltration attempts.Furthermore, post-analysis of the traffic captures did not reveal any identifiable fingerprint.As part of our evaluation, we also interviewed five leading firewall vendors and found that, as of today, no major firewall vendor implements functionality capable of distinguishing between benign and malicious QUIC connection migrations.

Artificial intelligence (AI) increasingly influences critical decision-making across sectors. Federated Learning (FL), as a privacy-preserving collaborative AI paradigm, not only enhances data protection but also holds significant promise for intelligent network management, including distributed monitoring, adaptive control, and edge intelligence. Although the trustworthiness of FL systems has received growing attention, the sustainability dimension remains insufficiently explored, despite its importance for scalable real-world deployment. To address this gap, this work introduces sustainability as a distinct pillar within a comprehensive trustworthy FL taxonomy, consistent with AIHLEG guidelines. This pillar includes three key aspects: hardware efficiency, federation complexity, and the carbon intensity of energy sources. Experiments using the FederatedScope framework under diverse scenarios, including varying participants, system complexity, hardware, and energy configurations, validate the practicality of the approach. Results show that incorporating sustainability into FL evaluation supports environmentally responsible deployment, enabling more efficient, adaptive, and trustworthy network services and management AI models.

Personal Bluetooth Low Energy (BLE) trackers such as AirTag help locate lost items but can be misused for stalking. Research indicates that BLE trackers can be identified through their transmitted packets, thus offering potential for machine learning (ML) solutions. However, current packet datasets lack the scale and diversity needed for real-world applicability. This paper presents an open-source $\mathbf{2 0 0}$-hour BLE advertisement packet dataset focused on personal tags, enabling future ML-based device detection approaches. Additionally, introduces the first large-scale BLE data preprocessing framework for efficient and modular BLE packet preprocessing. The Framework is showcased on the dataset, demonstrating feature extraction, labelling, and dynamic plotting. This paper lays the groundwork for IoT device detection in high-density, heterogeneous environments, enabling future advances in BLE device classification.

Bluetooth Low Energy (BLE) is widely used in devices like smartphones and personal trackers, but also raises serious privacy risks, especially related to stalking. Machine Learning (ML)-based methods for detecting BLE trackers across vendors show promise, yet are limited by the scarcity and variability of BLE advertisement packets, which hinders model performance. This paper addresses this limitation by introducing the first publicly available, open-source tool for generating synthetic BLE advertisement packets using a Markov model. Designed for structured time-series data, the model can produce all valid BLE packet permutations, addressing a key data gap for research and training. As a case study, synthetic Samsung SmartTag (nearby) packets are used to augment training data, resulting in a 37% increase in median prediction confidence level in real-world evaluations.

Existing adversarial Domain Generation Algorithms (DGAs) often fail to produce realistic synthetic domains because their sequential models cannot adequately capture complex character dependencies within domain names. This paper presents TITAN DGA, a new approach that addresses this limitation by integrating a Generative Adversarial Network (GAN) with a Transformer-based autoencoder, enabling the model to effectively learn long-range dependencies to generate synthetic domains. The solution incorporates adversarial self-augmentation to enhance evasiveness through iterative retraining. The model learns from its own generated samples using two strategies: a broad approach that improves overall generation quality, and a targeted approach that specifically leverages previously successful evasions to refine the model’s adversarial capabilities. Comprehensive evaluation against multiple state-of-the-art classifiers and competing adversarial DGAs demonstrates that TITAN DGA achieves superior evasion rates while maintaining realism.

Federated Learning (FL) is widely recognized as a privacy-preserving Machine Learning paradigm due to its model-sharing mechanism that avoids direct data exchange. Nevertheless, model training leaves exploitable traces that can be used to infer sensitive information. In Decentralized FL (DFL), the topology, defining how participants are connected, plays a crucial role in shaping the model’s privacy, robustness, and convergence. However, the topology introduces an unexplored vulnerability: attackers can exploit it to infer participant relationships and launch targeted attacks. This work uncovers the hidden risks of DFL topologies by proposing a novel Topology Inference Attack that infers the topology solely from model behavior. A taxonomy of topology inference attacks is introduced, categorizing them by the attacker’s capabilities and knowledge. Practical attack strategies are designed for various scenarios, and experiments are conducted to identify key factors influencing attack success. The results demonstrate that analyzing only the model of each node can accurately infer the DFL topology, highlighting a critical privacy risk in DFL systems. These findings offer insights for improving privacy preservation in DFL environments.

Synthetic data generation, leveraging generative machine learning techniques, offers a promising approach to mitigating privacy concerns associated with real-world data usage. Synthetic data closely resemble real-world data while maintaining strong privacy guarantees. However, a comprehensive assessment framework is still missing in the evaluation of synthetic data generation, especially when considering the balance between privacy preservation and data utility in synthetic data. This research bridges this gap by proposing FEST, a systematic framework for evaluating synthetic tabular data. FEST integrates diverse privacy metrics (attack-based and distance-based), along with similarity and machine learning utility metrics, to provide a holistic assessment. We develop FEST as an open-source Python-based library and validate it on multiple datasets, demonstrating its effectiveness in analyzing the privacy-utility trade-off of different synthetic data generation models. The source code o f FEST is available on Github.

Federated Learning (FL) enables collaborative model training without sharing raw data, preserving participant privacy. Decentralized FL (DFL) eliminates reliance on a central server, mitigating the single point of failure inherent in the traditional FL paradigm, while introducing deployment challenges on resource-constrained devices. To evaluate real-world applicability, this work designs and deploys a physical testbed using edge devices such as Raspberry Pi and Jetson Nano. The testbed is built upon a DFL training platform, NEBULA, and extends it with a power monitoring module to measure energy consumption during training. Experiments across multiple datasets show that model performance is influenced by the communication topology, with denser topologies leading to better outcomes in DFL settings.

Modern Intrusion Detection Systems (IDS) that rely on signature-based detection struggle to detect novel threats like AI-based Command-and-Control (C2) frameworks, highlighting a gap in the ability of current systems to detect and mitigate emerging botnet threats. This work addresses this gap by investigating NimPlant's detection and evasion capabilities. This paper (1) shows strategies to detect NimPlant bots using network traffic analysis, (2) enhances their evasion capabilities using Reinforcement Learning (RL), and (3) evaluates AI-driven evasion against IDS. Using a controlled testing environment, an infected device is simulated by implementing evasion strategies and integrating them into an RL-based AI system. Herewith, AI significantly improves evasion, with the RL-enhanced NimPlant achieving higher detection bypass rates. However, the IDS configuration heavily impacts AI effectiveness, underscoring the need for robust security setups. Thus, recommendations are provided for detecting bot infections and countering AI-enhanced botnets.

Bluetooth Low Energy (BLE)-based trackers have become increasingly widespread due to their affordability, energy efficiency, and integration into Crowd-Sourced Finding Networks (CFNs). CFNs, such as Apple’s Find My system, leverage vast user bases to enable device location even without direct Internet connectivity. However, the expansion of such technologies has raised concerns about security and potential misuse, particularly for unauthorized tracking.This paper investigates whether Received Signal Strength Indication (RSSI) data, when combined with Machine Learning (ML) techniques, can enhance the detection and protection mechanisms for individuals targeted by such misuse. A dataset comprising 13,353 labeled entries was collected using Apple AirTags to simulate various tracking scenarios and used to train and evaluate multiple classification models. Among these, a Decision Tree classifier demonstrated a strong balance between accuracy, F1-score, and overfitting resilience, achieving an accuracy of 85.35%. The model was subsequently integrated into HomeScout, marking a promising step toward proactive misuse mitigation in BLE-tracking ecosystems.

Federated Learning (FL), introduced in 2016, was designed to enhance data privacy in collaborative model training environments. Among the FL paradigm, horizontal FL, where clients share the same set of features but different data samples, has been extensively studied in both centralized and decentralized settings. In contrast, Vertical Federated Learning (VFL), which is crucial in real-world decentralized scenarios where clients possess different, yet sensitive, data about the same entity, remains underexplored. Thus, this work introduces De-VertiFL, a novel solution for training models in a decentralized VFL setting. De-VertiFL contributes by introducing a new network architecture distribution, an innovative knowledge exchange scheme, and a distributed federated training process. Specifically, De-VertiFL enables the sharing of hidden layer outputs among federation clients, allowing participants to benefit from intermediate computations, thereby improving learning efficiency. De-VertiFL has been evaluated using a variety of well-known datasets, including both image and tabular data, across binary and multiclass classification tasks. The results demonstrate that De-VertiFL generally surpasses state-of-the-art methods in F1-score performance, while maintaining a decentralized and privacy-preserving framework.

Although ransomware has received broad attention in media and research, this evolving threat vector still poses a systematic threat. Related literature has explored their detection using various approaches leveraging Machine and Deep Learning. While these approaches are effective in detecting malware, they do not answer how to use this intelligence to protect against threats, raising concerns about their applicability in a hostile environment. Solutions that focus on mitigation rarely explore how to prevent and not just alert or halt its execution, especially when considering Linux-based samples. This paper presents GuardFS , a file system-based approach to investigate the integration of detection and mitigation of ransomware. Using a bespoke overlay file system, data is extracted before files are accessed. Models trained on this data are used by three novel defense configurations that obfuscate, delay, or track access to the file system. The experiments on GuardFS test the configurations in a reactive setting. The results demonstrate that although data loss cannot be completely prevented, it can be significantly reduced. Usability and performance analysis demonstrate that the defense effectiveness of the configurations relates to their impact on resource consumption and usability.

Recent research has shown that the integration of Reinforcement Learning (RL) with Moving Target Defense (MTD) can enhance cybersecurity in Internet-of-Things (IoT) devices. Nevertheless, the practicality of existing work is hindered by data privacy concerns associated with centralized data processing in RL, and the unsatisfactory time needed to learn right MTD techniques that are effective against a rising number of heterogeneous zero-day attacks. Thus, this work presents CyberForce, a framework that combines Federated and Reinforcement Learning (FRL) to collaboratively and privately learn suitable MTD techniques for mitigating zero-day attacks. CyberForce integrates device fingerprinting and anomaly detection to reward or penalize MTD mechanisms chosen by an FRL-based agent. The framework has been deployed and evaluated in a scenario consisting of ten physical devices of a real IoT platform affected by heterogeneous malware samples. A pool of experiments has demonstrated that CyberForce learns the MTD technique mitigating each attack faster than existing RL-based centralized approaches. In addition, when various devices are exposed to different attacks, CyberForce benefits from knowledge transfer, leading to enhanced performance and reduced learning time in comparison to recent works. Finally, different aggregation algorithms used during the agent learning process provide CyberForce with notable robustness to malicious attacks.

Decentralized Federated Learning (DFL), a paradigm for managing big data in a privacy-preserving and distributed manner, is vulnerable to poisoning attacks where malicious clients tamper with data or models. Current defense methods often assume Independently and Identically Distributed (IID) data across participants, which is unrealistic in real-world applications. In more realistic non-IID contexts, existing defensive strategies face challenges when distinguishing between models that have been compromised and those that have been trained on heterogeneous data distributions (non-IID), leading to diminished efficacy. In response, this paper proposes a framework that employs the Moving Target Defense (MTD) approach to bolster the robustness of DFL models. By continuously modifying the attack surface of the DFL system, the framework aims to mitigate poisoning attacks effectively. The proposed solution includes both proactive and reactive modes, utilizing a reputation system that combines metrics of model similarity and loss, alongside various defensive techniques. Comprehensive experimental evaluations indicate that the MTD-based mechanism significantly mitigates a range of poisoning attack types across multiple datasets with different federation topologies.

Synthetic data generation has emerged as a powerful solution to meet the demand for high-quality, diverse, and privacy-preserving data in many domains. Still, there is an open challenge when dealing with class imbalance and privacy preservation in synthetic tabular data generation. Thus, this study introduces two algorithms: balanced Tabular Generative Adversarial Network (b-TGAN) and balanced Tabular Principle Component Analysis (b-TPCA). While b-TGAN proactively tackles class imbalance by incorporating a re-balancing mechanism and leveraging an Autoencoder, b-TPCA offers a privacy-preserving solution by generating synthetic data using statistical properties. Through experiments on five datasets, this study demonstrates the effectiveness of b-TGAN in generating balanced data, particularly in improving the performance on minority classes. b-TPCA also shows promising results, achieving comparable ML utility to the baseline method while enhancing privacy preservation.

Artificial Intelligence (AI) is a rapidly integrated technology, significantly contributing to advancements like 6G. However, its swift adoption raises considerable security concerns. Large Language Models (LLMs) pose risks such as spear phishing, code injections, and remote code execution. Conventional threat modeling, used in secure software development, faces challenges when applied to AI systems, as existing methodologies are designed for traditional software. Furthermore, AI-specific threat modeling research is sparse and lacks approaches providing practical support or automation. Thus, this demo paper presents ThreatFinderAI, an asset-centric threat modeling and risk assessment framework. ThreatFinderAI fulfills seven steps aligned with AI system design and transforms AI threat and control knowledge bases into a queryable knowledge graph for automated asset identification and threat elicitation. It also proposes business impact analysis and expert estimates for AI threat impact quantification. In the demonstration, ThreatFinderAI is illustrated by securing a customer care application relying on LLMs. Through this, it is demonstrated how the proposed framework can be used to identify relevant threats and practical countermeasures and communicate strategic risk.

The rise of the Internet-of-Things (IoT) and smart homes has resulted in the increased use of ZigBee as the communication protocol of choice in home networks, giving ample opportunity for network monitoring and user profiling, as a consequence, raising a major privacy concern. Yet, there has been little exploration of the extractable information solely from network packets, particularly Philips Hue packets.Especially as, to the authors’ knowledge, there have been no studies examining whether a single network key provides enough generalization to extract data from other unknown ZigBee networks. To address this gap, this paper proposes StealthProfiler, a passive and real-time Proof-of-Concept (PoC) tool designed to identify, classify, and extract devices and events within a Philips Hue network.As a result, the tool was successfully used to extract network events from encrypted Zigbee networks, achieving an accuracy of approximately 94% in identifying devices and events within the network without decrypting network traffic.

Decentralized Federated Learning (DFL) emerges as an innovative paradigm to train collaborative models, addressing the single point of failure limitation. However, the security and trustworthiness of FL and DFL are compromised by poisoning attacks, negatively impacting its performance. Existing defense mechanisms have been designed for centralized FL and they do not adequately exploit the particularities of DFL. Thus, this work introduces Sentinel, a defense strategy to counteract poisoning attacks in DFL. Sentinel leverages the accessibility of local data and defines a three-step aggregation protocol consisting of similarity filtering, bootstrap validation, and normalization to safeguard against malicious model updates. Sentinel has been evaluated with diverse datasets and data distributions. Besides, various poisoning attack types and threat levels have been verified. The results improve the state-of-the-art performance against both untargeted and targeted poisoning attacks when data follows an IID (Independent and Identically Distributed) configuration. Besides, under non-IID configuration, it is analyzed how performance degrades both for Sentinel and other state-of-the-art robust aggregation methods.

In the era of the Internet of Things and Artificial Intelligence (AI), cybersecurity has become a critical challenge. Existing AI-based detection systems have shown merit in detecting heterogeneous malware, but their effectiveness against the next generation of AI-powered ransomware encrypting data intelligently is under discussion. In this context, this work introduces a novel AI-powered ransomware that combines Reinforcement Learning and fingerprints based on system calls to evade AI-based cybersecurity detection systems. More in detail, an RL-based agent utilizes Deep Q-Learning as a learning algorithm, system calls to model device states, and the result of unsupervised learning as input for the reward function. The efficacy of this approach has been evaluated on a Raspberry Pi acting as a real spectrum sensor that hosts a behavioral AI-based anomaly detector. Experiments have compared the AI-based ransomware evasion performance with the literature and analyzed how various benign and realistic behaviors affect evasion performance. Results showed that precise and adaptive evasion capabilities can be learned in a few minutes, motivating the need for better cybersecurity systems.

The advent of Decentralized Physical Infrastructure Networks (DePIN) represents a shift in the digital infrastructure of today’s Internet. While Centralized Service Providers (CSP) monopolize cloud computing, DePINs aim to enhance data sovereignty and confidentiality and increase resilience against a single point of failure. Due to the novelty of the emerging field of DePIN, this work focuses on the potential of DePINs to disrupt traditional centralized architectures by taking advantage of the Internet of Things (IoT) devices and crypto-economic design in combination with blockchains. This combination yields Acurast, a more distributed, resilient, and user-centric physical infrastructure deployment. Through comparative analysis with centralized systems, particularly in serverless computing contexts, this work seeks to lay the first steps in scientifically evaluating DePINs and quantitatively comparing them in terms of efficiency and effectiveness in real-world applications. The findings suggest DePINs’ potential to (i) reduce trust assumptions and physically decentralized infrastructure, (ii) increase efficiency and performance simultaneously while improving the computation’s (iii) confidentiality and verifiability.

Ransomware has remained one of the most notorious threats in the cybersecurity field, for which Moving Target Defense (MTD) has been proposed as a novel defense paradigm. Although various approaches leverage MTD, few of them rely on the operating system and, specifically, the file system, thereby making them dependent on other computing devices, rendering defense against certain threats unrealistic. File-based approaches are less studied here while showing limitations in resource usage and defense effectiveness. Furthermore, existing ransomware defenses merely restore data or detect attacks without preventing them. Thus, this paper introduces the MTFS file system and the design and implementation of three novel MTD techniques – one delaying attackers, one trapping recursive directory traversal, and another one hiding file types. The effectiveness of the techniques is shown in three experiments. First, it is demonstrated that the techniques can delay and mitigate ransomware on real IoT devices. Secondly, in a broader scope, the solution was confronted with 13 ransomware samples, highlighting that it can save 97% of the files. Regarding overhead, the defense system consumes only a small amount of resources, highlighting the feasibility of proactive defense.

Security management of Internet-of-Things (IoT) infrastructures encompassing the entire lifecycle of products and their continuous certification are fundamental functions to guarantee a high level of security. This paper demonstrates a DLT-based platform enabling secure inventorying and management of IoT devices and sensors distributed across multiple stakeholders. This work makes use of the Hyperledger framework, Decentralized Identifiers (DID), and Manufacturer Usage Description (MUD) files for IoT device inventorying and the identification of critical software updates.

The Internet of Things (IoT) involves complex, interconnected systems and devices that depend on contextsharing platforms for interoperability and information exchange. These platforms are, therefore, critical components of real-world IoT deployments, making their security essential to ensure the resilience and reliability of these “systems of systems.” In this paper, we take the first steps toward systematically and comprehensively addressing the security of IoT context-sharing platforms. We propose a framework for threat modelling and security analysis of a generic IoT context-sharing solution, employing the MITRE ATT&CK framework. Through an evaluation of various industry-funded projects and academic research, we identify significant security challenges in the design of IoT context-sharing platforms. Our threat modelling provides an in-depth analysis of the techniques and sub-techniques adversaries may use to exploit these systems, offering valuable insights for future research aimed at developing resilient solutions. Additionally, we have developed an open-source threat analysis tool that incorporates our detailed threat modelling, which can be used to evaluate and enhance the security of existing context-sharing platforms.

The growing concern over malicious attacks targeting the robustness of both Centralized and Decentralized Federated Learning (FL) necessitates novel defensive strategies. In contrast to the centralized approach, Decentralized FL (DFL) has the advantage of utilizing network topology and local dataset information, enabling the exploration of Moving Target Defense (MTD) based approaches.This work presents a theoretical analysis of the influence of network topology on the robustness of DFL models. Drawing inspiration from these findings, a three-stage MTD-based aggregation protocol, called Voyager, is proposed to improve the robustness of DFL models against poisoning attacks by manipulating network topology connectivity. Voyager has three main components: an anomaly detector, a network topology explorer, and a connection deployer. When an abnormal model is detected in the network, the topology explorer responds strategically by forming connections with more trustworthy participants to secure the model. Experimental evaluations show that Voyager effectively mitigates various poisoning attacks without imposing significant resource and computational burdens on participants. These findings highlight the proposed reactive MTD as a potent defense mechanism in the context of DFL.

With the growing popularity of Internet-of-Things (IoT) and the smart home market, third party data stores and remote cloud environments, security and privacy of personal data is the central problem. Since the existing Privacy Enhancing Technologies (PET) have yet to provide a lightweight solution to safeguard privacy within smart homes, this paper presents the Security and Home Integration Framework for IoT (SHIFT). SHIFT leverages an open-source architecture to integrate existing tools, including home assistants and network monitors, into a unified framework designed to monitor and control smart home devices through security policies. The proof-ofconcept prototype for monitoring and controlling smart home device communications using user-defined policies successfully monitors device activity, processes data, and enforces user policies in a live smart home environment. SHIFT gives users control over their devices and data while balancing convenience with privacy and security.

Abstract Federated learning (FL) enables participants to collaboratively train machine and deep learning models while safeguarding data privacy. However, the FL paradigm still has drawbacks that affect its trustworthiness, as malicious participants could launch adversarial attacks against the training process. Previous research has examined the robustness of horizontal FL scenarios under various attacks. However, there is a lack of research evaluating the robustness of decentralized vertical FL and comparing it with horizontal FL architectures affected by adversarial attacks. Therefore, this study proposes three decentralized FL architectures: HoriChain, VertiChain, and VertiComb. These architectures feature different neural networks and training protocols suitable for horizontal and vertical scenarios. Subsequently, a decentralized, privacy-preserving, and federated use case with non-IID data to classify handwritten digits is deployed to assess the performance of the three architectures. Finally, a series of experiments computes and compares the robustness of the proposed architectures when they are affected by different data poisoning methods, including image watermarks and gradient poisoning adversarial attacks. The experiments demonstrate that while specific configurations of both attacks can undermine the classification performance of the architectures, HoriChain is the most robust one.

Digitization increases business opportunities and the risk of companies being victims of devastating cyberattacks. Therefore, managing risk exposure and cybersecurity strategies is essential for digitized companies that aim to survive in competitive markets. However, understanding company-specific risks and quantifying their associated costs is not trivial. Current approaches fail to approximate the individualized financial impact of cyber incidents with a monetary estimation. Additionally, due to limited resources and technical expertise, SMEs, but also large companies, struggle to quantify their cyberattack exposure. Therefore, novel approaches must be built to contribute to a better understanding of the financial loss associated with cyberattacks. This article introduces the Real Cyber Value at Risk (RCVaR), an economical approach for estimating cybersecurity costs using real-world information from public cybersecurity reports. RCVaR identifies the most significant cyber risk factors from various sources and combines their quantitative results to estimate specific cyberattack costs for companies. Furthermore, RCVaR extends current methods to achieve cost and risk estimations based on historical real-world data instead of only probability-based simulations. The evaluation of the approach on unseen data shows the high accuracy and efficiency of the RCVaR in predicting and managing cyber risks. Thus, we argue that the RCVaR is a valuable addition to cybersecurity planning and risk management processes.

The rapid expansion of the Internet of Things (IoT) and Edge Computing has presented challenges for centralized Machine and Deep Learning (ML/DL) methods due to the presence of distributed data silos that hold sensitive information. To address concerns regarding data privacy, collaborative and privacy-preserving ML/DL techniques like Federated Learning (FL) have emerged. FL ensures data privacy by design, as the local data of participants remains undisclosed during the creation of a global and collaborative model. However, data privacy and performance are insufficient since a growing need demands trust in model predictions. Existing literature has proposed various approaches dealing with trustworthy ML/DL (excluding data privacy), identifying robustness, fairness, explainability, and accountability as important pillars. Nevertheless, further research is required to identify trustworthiness pillars and evaluation metrics specifically relevant to FL models, as well as to develop solutions that can compute the trustworthiness level of FL models. This work examines the existing requirements for evaluating trustworthiness in FL and introduces a comprehensive taxonomy consisting of six pillars (privacy, robustness, fairness, explainability, accountability, and federation), along with over 30 metrics for computing the trustworthiness of FL models. Subsequently, an algorithm named FederatedTrust is designed based on the pillars and metrics identified in the taxonomy to compute the trustworthiness score of FL models. A prototype of FederatedTrust is implemented and integrated into the learning process of FederatedScope, a well-established FL framework. Finally, five experiments are conducted using different configurations of FederatedScope (with different participants, selection rates, training rounds, and differential privacy) to demonstrate the utility of FederatedTrust in computing the trustworthiness of FL models. Three experiments employ the FEMNIST dataset, and two utilize the N-BaIoT dataset, considering a real-world IoT security use case.

Integrated sensing and communication is a novel paradigm using crowdsensing spectrum sensors to help with the management of spectrum scarcity. However, well-known vulnerabilities of resource-constrained spectrum sensors and the possibility of being manipulated by users with physical access complicate their protection against spectrum sensing data falsification (SSDF) attacks. Most recent literature suggests using behavioral fingerprinting and Machine/Deep Learning (ML/DL) for improving similar cybersecurity issues. Nevertheless, the applicability of these techniques in resource-constrained devices, the impact of attacks affecting spectrum data integrity, and the performance and scalability of models suitable for heterogeneous sensors types are still open challenges. To improve limitations, this work presents seven SSDF attacks affecting spectrum sensors and introduces CyberSpec, an ML/DL-oriented framework using device behavioral fingerprinting to detect anomalies produced by SSDF attacks. CyberSpec has been implemented and validated in ElectroSense, a real crowdsensing RF monitoring platform where several configurations of the proposed SSDF attacks have been executed in different sensors. A pool of experiments with different unsupervised ML/DL-based models has demonstrated the suitability of CyberSpec detecting the previous attacks within an acceptable timeframe.

Device fingerprinting combined with Machine and Deep Learning (ML/DL) report promising performance when detecting spectrum sensing data falsification (SSDF) attacks. However, the amount of data needed to train models and the scenario privacy concerns limit the applicability of centralized ML/DL. Federated learning (FL) addresses these drawbacks but is vulnerable to adversarial participants and attacks. The literature has proposed countermeasures, but more effort is required to evaluate the performance of FL detecting SSDF attacks and their robustness against adversaries. Thus, the first contribution of this work is to create an FL-oriented dataset modeling the behavior of resource-constrained spectrum sensors affected by SSDF attacks. The second contribution is a pool of experiments analyzing the robustness of FL models according to i) three families of sensors, ii) eight SSDF attacks, iii) four FL scenarios dealing with anomaly detection and binary classification, iv) up to 33% of participants implementing data and model poisoning attacks, and v) four aggregation functions acting as anti-adversarial mechanisms. In conclusion, FL achieves promising performance when detecting SSDF attacks. Without anti-adversarial mechanisms, FL models are particularly vulnerable with$>$16% of adversaries. Coordinate-wise-median is the best mitigation for anomaly detection, but binary classifiers are still affected with$>$33% of adversaries.

Moving Target Defense (MTD) is a promising approach to mitigate attacks by dynamically altering target attack surfaces. Still, selecting suitable MTD techniques for zero-day attacks is an open challenge. Reinforcement Learning (RL) could be an effective approach to optimize the MTD selection through trial and error, but the literature fails when i) evaluating the performance of RL and MTD solutions in real-world scenarios, ii) studying whether behavioral fingerprinting is suitable for RL, and iii) calculating the consumption of resources in single-board computers (SBC). Thus, the work at hand proposes an online RL-based framework that learns correct MTD mechanisms mitigating heterogeneous zero-day attacks in SBC. The framework considers behavioral fingerprinting to represent SBCs’ states and RL to learn MTD techniques that mitigate each malicious state. It has been deployed on a real IoT crowdsensing scenario with a Raspberry Pi acting as a spectrum sensor. The Raspberry Pi has been infected with different samples of command and control malware, rootkits, and ransomware to later select between four existing MTD techniques. A set of experiments demonstrated the suitability of the framework to learn proper MTD techniques mitigating all attacks (except a harmfulness rootkit) while consuming$\approx 10$% of RAM, and negligible CPU.

With a rising frequency and scale, Distributed Denial-of-Service (DDoS) attacks persist as a critical cybersecurity issue. While shared attack fingerprints aid many intrusion detection systems in identifying threats, their application for DDoS attacks remains limited due to their distinct nature. However, fingerprints observed from multiple locations can provide valuable insights. This paper presents Reassembler, a novel platform for achieving a global DDoS attack analysis using attack fingerprints recorded from various locations. Reassembler consolidates these fingerprints into a unified view allowing to obtain a global overview of DDoS attacks. The evaluation, conducted on four simulated scenarios, demonstrates Reassembler's ability to extract novel properties, such as the count of intermediate nodes and the estimated percentage of spoofed IPs.

Cybersecurity solutions have shown promising performance when detecting ransomware samples that use fixed algorithms and encryption rates. However, due to the current explosion of Artificial Intelligence (AI), sooner than later, ransomware, and malware in general, will incorporate AI techniques to intelligently and dynamically adapt its behavior to be undetected. It might result in ineffective and obsolete cybersecurity solutions, but the literature lacks AI-powered ransomware samples to verify it. Thus, this work proposes RansomAI, a Reinforcement Learning-based framework that can be integrated into existing ransomware samples to adapt their encryption behavior and stay stealthy while encrypting files. RansomAI presents an agent that learns the best encryption algorithm, rate, and duration that minimizes its detection (using a reward mechanism and a fingerprinting intelligent detection system) while maximizing its damage. The proposed framework was validated with Ransomware-PoC, a ransomware that infected a Raspberry Pi 4 acting as a crowdsensor. A pool of experiments with Deep Q-Learning and Isolation Forest (deployed on the agent and detection system, respectively) has demonstrated that RansomAI evades the detection of Ransomware-PoC affecting the Raspberry Pi 4 in a few minutes with >90% accuracy.

The General Chairs and Technical Program Chairs (TPC) are delighted to welcome you to the International Conference on Blockchain and Cryptocurrency (ICBC 2023) being held as an inperson event between May 1 and May 5, 2023, at the Sofitel Downtown hotel Dubai, UAE.

Malware affecting Internet of Things (IoT) devices is rapidly growing due to the relevance of this paradigm in real-world scenarios. Specialized literature has also detected a trend towards multi-purpose malware able to execute different malicious actions such as remote control, data leakage, encryption, or code hiding, among others. Protecting IoT devices against this kind of malware is challenging due to their well-known vulnerabilities and limitation in terms of CPU, memory, and storage. To improve it, the moving target defense (MTD) paradigm was proposed a decade ago and has shown promising results, but there is a lack of IoT MTD solutions dealing with multi-purpose malware. Thus, this work proposes four MTD mechanisms changing IoT devices' network, data, and runtime environment to mitigate multi-purpose malware. Furthermore, it presents a lightweight and IoT-oriented MTD framework to decide what, when, and how the MTD mechanisms are deployed. Finally, the efficiency and effectiveness of the framework and MTD mechanisms are evaluated in a real-world scenario with one IoT spectrum sensor affected by multi-purpose malware.

Bluetooth Low Energy (BLE) personal trackers are affordable devices misused to track nonconsensual individuals. Due to the increased misuse, Apple implemented two detection applications. However, the Android application is limited to user-initiated scans with a fixed detection algorithm. This paper focuses on reducing the misuse of malicious trackers by examining current solutions, potential generic detection approaches, and improving tracker detection times.HomeScout expands detection to the Tile and Samsung Galaxy SmartTag+, and examines the misuse potential of all BLE-enabled devices. HomeScout can reliably detect devices tracking the user as quickly as 1 minute once in motion by optimizing the parameters. The optimal parameter setting for distance is 200 m due to its high recall rate, for occurrence is 2, and for time is 1 minute. Furthermore, HomeScout applies the tracking algorithm to all BLE-enabled devices.

The recent pandemic posed a challenge to several healthcare systems, exposing limited resources and inefficiency in managing PMDs (Portable Medical Devices). This paper reports the experience of an approach enabling hospitals to efficiently find their resources and maximize the usage of PMDs in emergency situations, such as pandemics or natural disasters, when a sudden increase in demand may be anticipated. The key novelty relies on the use of smartphones provided to hospital employees replacing typical stationary gateways spread across a hospital, functioning as mobile gateways with a front-end that assists staff in locating PMDs. As employees approach tagged PMDs, they update their locations in a real-time inventory tracker, delivering accurate data. Experiments were evaluated by contrasting two techniques (fingerprinting and multilateration) based on two different locations (an office and an apartment complex) in Zürich.

Cybersecurity solutions based on machine learning (ML) and behavioral fingerprinting have demonstrated their suitability when detecting heterogeneous malware. However, most solutions are black boxes missing explainable and visual capabilities needed to analyze relevant metrics and malicious behaviors to be collected. In this demonstration, SecBox, a dynamic malware analysis platform with integrated data collection and visualization for malware execution, is presented. To provide a lightweight sandboxing approach, the architecture relies on Linux containers for isolation. The sandboxing and data analysis components of the SecBox architecture are deployed in a test bed to show the analysis of two malware families. In the presented scenario, the Monti ransomware and CoinMiner, a Monero-based cryptojacker are analyzed after obtaining them from a public database.

Traditionally, IoT crowdsensing devices have been outside the cryptomining domain due to their limitations in terms of computational power. In 2014, Monero (XNR) changed this situation forever. Monero is an open-source digital payment token that can be mined in resource-constrained devices like IoT and single-board computers. Despite the Monero advantages, it opened the door for cryptojackers illicitly mining cryptocurrencies by exploiting well-known vulnerabilities of IoT devices. Existing detection solutions provide good performance while detecting the mining phase of cryptojackers, but early detection is desired to avoid malware spreading and resource misuse. Thus, this work proposes a framework that combines device behavioral fingerprinting and machine learning to detect and classify preparatory phases of cryptojackers. The framework has been deployed in a crowdsensing IoT spectrum sensor, Raspberry Pi, infected by a recent cryptojacker called Linux.MulDrop.14. Promising detection results demonstrate the framework’s suitability while detecting early phases of cryptojackers.

It is essential to look at cybersecurity not only as a technical problem but also from economic, societal, and legal perspectives. Companies need to pay more attention to planning and investments in cybersecurity due to different factors, such as budget constraints and complexities involved in the planning and decision-making processes. Also, companies wrongly do not see themselves as the target of a potential cyberattack. Therefore, there is still a need for approaches that support companies, especially Small and Medium-sized Enterprises (SME), during the cybersecurity planning and investment decisions. This PhD thesis addressed cybersecurity planning and investment gaps by proposing the CyberTEA approach. This approach is composed of a five-phase methodology, a framework, and a set of solutions for cybersecurity planning and investment, considering the technical requirements of cybersecurity and its economic dimensions, such as the potential economic impacts of cyberattacks and the cost-benefit of protections available on the market to protect against specific threats. The evaluations and scientific advances of CyberTEA approach was proven valid to support SMEs while also showing the benefits and opportunities for cybersecurity economic approaches.

Telecommunication networks are shifting to multi-cloud environments. This trend is expected to shape the standardization and implementation of future networks. Thus, the protection of virtualized services has become more critical. One of the promising methods to secure virtual resources in that setting is Moving Target Defense (MTD). This paper presents the Network Topology Fuzzer (TopoFuzzer) module, enabling different MTD operations that change the topology of a 5G network. An emphasis is given to live re-instantiations and live migrations of running services and, consequently, security gains against Advanced Persistent Threats (APTs). This work utilizes a 5G testbed to evaluate the TopoFuzzer module and MTD operations on Virtual Network Functions (VNFs).

This work presents a Moving Target Defense (MTD) framework for the protection of network slices and virtual resources in a telco cloud environment. The preliminary implementation provides a closed-loop security management of services with proactive MTD operations to reduce the success probability of attacks, and reactive MTD operations, empowered by a tampering detection and a traffic-based anomaly detection system. MTD strategies are adaptive and optimized with deep reinforcement learning (deep-RL) for balancing costs, security, and availability goals defined in a Multi-Objective Markov Decision Process (MOMDP).

The Internet of Things (IoT), a network of interconnected devices, has grown and gained traction over the last few years. This paradigm can impact our lives while also providing significant economic benefits. However, although resource-constrained IoT devices offer numerous advantages, they are also vulnerable to cyberattacks. As a result, ransomware severely threatens IoT devices managing sensitive and relevant information. Solutions based on Machine and Deep Learning (ML/DL) that consider behavioral data have been identified as promising. However, most detection solutions have been developed for Windows-based systems, which generally have more resources than IoT devices. As a result, these solutions are not suitable for resource-constrained components. In addition, no solution compares the pros and cons of different behavioral dimensions of resource-constrained devices. Thus, this work presents a framework that combines three different behavioral sources with supervised and unsupervised ML/DL algorithms to detect and classify heterogeneous ransomware impacting resource-constrained spectrum sensors. A pool of experiments has demonstrated the suitability of the proposed solution and compared its performance with a rule-based system. In conclusion, the usage of resources combined with local outlier factor and decision tree are the most promising combinations to detect anomalies and classify ransomware while consuming CPU, RAM, and time of devices in a reduced manner.

Crowdsensing platforms collect, process, transmit, and analyze spectrum data worldwide to optimize radio frequency spectrum usage. However, Internet of Things (IoT) spectrum sensors, performing some of the previous tasks, are exposed to software manipulation aiming to execute spectrum sensing data falsification (SSDF) attacks to compromise data integrity and spectrum optimization. Novel intrusion detection systems (IDSs) combining device fingerprinting with machine and deep learning (ML/DL) improve the limitation of traditional solutions and remove the necessity of redundant sensors and reputation mechanisms. However, they fail when detecting SSDF attacks accurately while protecting sensors privacy. This work proposes a novel host-based and federated learning-oriented IDS for IoT spectrum sensors that consider unsupervised ML/DL and fingerprints based on system calls. The framework detection performance and consumption of resources are analyzed in local and federated scenarios with six spectrum sensors deployed on Raspberry Pis. The obtained results significantly improve related work when detecting SSDF attacks while protecting sensors privacy, and consuming CPU, memory, and storage of sensors in a reduced manner.

This demo presents RITUAL, a platform composed of a novel algorithm and a Web application quantifying the trustworthiness level of supervised Machine and Deep Learning (ML/DL) models according to their fairness, explainability, robustness, and accountability. The algorithm is deployed on a Web application to allow users to quantify and compare the trustworthiness of their ML/DL models. Finally, a scenario with ML/DL models classifying network cyberattacks demonstrates the platform applicability.

Recent years saw an increase in voting systems using public permissionless blockchains. Although public blockchains offer transparency and immutability, permissioned consensus is better suited for voting systems’ requirements, because an initial level of trust in authorities is always required. Hence, a permissioned Distributed Ledger (DL) immutably storing the voting system’s audit trail satisfies demands measurably.ProvotuMN 3.0 is a decentralized and receipt-Free (RF) voting system based on an end-to-end verifiable Re-Encryption Mixnet (RMN). RMNs allow for flexible votes and elections and decouple the ballot structure from the cryptographic voting protocol. Thus, ProvotuMN decentralizes trust (i) through the use of cryptographic shuffles and Non-Interactive Zero-Knowledge Proofs (NIZKP) in an RMN executed among DL nodes, (ii) by employing a distributed key generation for election keys, and (iii) by offering a decentralized re-encryption service assuring RF. Performance evaluations performed indicate that the voting scheme is scalable for large-scale voting.

Blockchain (BC) applications face many challenges to comply with the European General Data Protection Regulation (GDPR) i.e., enabling users to hold on to their rights for deleting or modifying their data stored on publicly accessible and immutable BCs. In this regard, this paper proposes an on-chain solution that allows for fine-grained modification (update and erasure) operations on transactions’ (TX) data fields within a BC. The proposed solution is based on a cryptographic primitive called Chameleon Hashing. Via this approach, BC users have the authority to update their data, which are addressed at the TX level with no side effects on the block or chain. By performing and storing data updates, all on-chain traceability and verifiability characteristics of the BC are preserved.

Data confidentiality protection is a must for IoT and crowdsensing platforms, and a challenge due to the constrained nature of their sensors. Currently, the combination of device fingerprinting and anomaly detection systems based on Machine and Deep Learning (ML/DL) techniques is one of the most promising approaches to detect zero-day cyberattacks. However, most of existing work is not suitable for resource-constrained devices or does not deal with cyberattacks affecting data confidentiality of spectrum sensors. Thus, this paper proposes a framework that monitors network interface events of sensors, uses unsupervised learning to create fingerprints, and detects anomalies produced by such cyberattacks. The framework validation has been performed in the crowdsensing platform ElectroSense, where a sensor has been infected by a backdoor leaking different sensitive data during an experiment. A set of unsupervised learning algorithms has been evaluated, being Autoencoder the one showing the best balance when detecting normal behavior and data leakages of different sizes and at frequencies, while providing a reduced detection time and sensor resources consumption.

Network Functions Virtualization (NFV) has been a key part of evolving communication systems in the last few years. However, the life-cycle management of Virtual Network Functions (VNF) is still a not trivial task. Blockchains (BC), due to their decentralization and immutability characteristics, together with the automation provided by Smart Contracts (SC), can be employed to enable such automated and trustworthy VNF management.Thus, this paper proposes VeNiCE to automate the deployment and life-cycle management of VNFs using events emitted on SCs. VeNiCE provides automation and auditability by relying on a BC to provide a decentralized approach for VNF management, which performs management actions, such as VNF deployment and deletion, and based on events and communicates with an SC to provide immutable logging of the VNF life-cycle. VeNiCE provides (i) a frontend for user interaction, (ii) a backend implementing the communication with the NFV framework, and (iii) an SC that emits events, stores VNF allocations, and authenticates users. A prototype of VeNiCE was developed and deployed in the Ethereum BC using OpenStack Tacker as an NFV platform. Experiments were conducted in a real-world deployment of such a prototype to analyze the economic costs of using SCs and the time required to process requests by each component of VeNiCE and the BC. Those results obtained show VeNiCE’s feasibility, highlight its benefits achieved with the automation and provide insights on reducing costs by exploring additional BC platforms and different deployment types, which introduce centralization and management concerns.

Information-Centric Network (ICN) architectures, such as Named Data Networking (NDN), can improve content delivery on the Internet by deploying in-network caching techniques. Replacing the entire established Internet with a novel architecture is a non-trivial task, which is why this work develops a layered network architecture consisting of several smaller NDN-based mobile networks (resp., domains), interconnected using a Distributed Hash Table (DHT)-based network running as an overlay on top of existing Internet infrastructures. Using simulations, we model real-world network characteristics to evaluate the proposed architecture’s performance successfully.

Traditionally, data centers have been the preferred target for ransomware attacks. However, the increasing number of IoT (Internet-of-Things) devices managing valuable data is attracting the attention of cybercriminals and ransomware towards resource-constrained devices. So far, literature has demonstrated the suitability of monitoring the behavior of devices to detect some malware infections. However, most of these existing solutions have been designed and validated in Windows-based systems without computational restrictions.Thus, this work presents a lightweight policy-based framework that uses behavioral fingerprinting to detect anomalies and classify ransomware affecting resource-constrained and Linux-based sensors. The framework detection capabilities have been validated in a resource-constrained spectrum sensor belonging to ElectroSense, a real crowdsensing platform. In particular, three policies, created as a proof-of-concept, resulted in promising findings in terms of detection performance and time, when identifying anomalies by classifying two recent ransomware samples affecting a Raspberry Pi acting as sensor.

Analysis of existing work and studies lead to the observation that BIoT (Blockchain (BC) and Internet of Things (IoT) integration) faces various efficiency issues in IoT-to-BC adaption associated with (a) scalability, (b) energy efficiency, and (c) security. To solve these concerns, at the first step and via experimental analysis of multiple Distributed Applications (dApp), this paper and PhD thesis does identify key BIoT efficiency affecting metrics. In the second step, these metrics are used to design and evaluate an efficient BIoT architecture —termed as BIIT—. Extensive simulations conducted on IoT network proves that BIIT enhances the efficiency of IoT-to-BC communications even for a limiting IoT protocol such as LoRaWAN. As of the third, the design and evaluation of DLIT (Distributed Ledger (DL) for IoT daTa) is presented. DLIT offers a highly scalable and secure DL via a hybrid consensus mechanism, equipped with sharding, and IoT data modification possibilities.

Intents brought significant improvements in network management by the use of intent-level languages. Despite these improvements, intents are not yet fully integrated and deployed in most large-scale networks. As a result, network operators may still experience problems when deploying new intents, for instance, learning a vendor-specific language to understand previously deployed configurations of a network device. Additionally, traditional configurations are distributed across multiple devices, each configured using low-level, vendor-specific languages. As a result, inferring intents from these low-level configurations is a time-consuming process. Furthermore, current solutions for deriving high-level representations from bottom-up configuration analysis do not provide results as intents or have a very limited scope, missing essential details that enhance the representation. In the solution to these shortcomings, a deterministic bottom-up approach was developed to extract intents from network configuration files, which translates them into a high-level intent-defined language. By parsing security configurations from various network devices and translating them into an extended version of the Nile (Jacobs et al. 2018) language, an intent-defined language, the prototype demonstrates the concept of this approach. While three case studies illustrate the effectiveness of the approach proposed in real-world scenarios, additional evaluations exploit dumps of real-world firewall and Network Address Translator (NAT) configurations consisting of rules from different servers and institutions. These evaluations demonstrate that the proposed solution can represent configurations at an intent-level language, maintaining high accuracy while representing key details of low-level configurations.

Blockchains (BC) and Distributed Ledgers (DL) offer favorable properties, especially immutability and decentralization, which are suitable for voting systems’ Bulletin Boards (BB). In recent years, an influx of BC-based voting systems have been observed. Distributing trust among multiple trustees is a crucial reason to adopt BCs and DLs in voting systems. The practical deployment must be decentralized, too, and not just done through virtualizing interconnected systems. As discussed widely, adopting a BC or DL can incur threats to a system that assumed a trusted and centralized Public Bulletin Board (PBB). Therefore, the exploitation of BCs or DLs requires careful consideration of cryptographic mechanisms and the overall system design, as well as the adversary model. Besides these operational necessities, the long-term privacy of ballots is essential. Thus, the key question investigated in this article is: Can BC, and DL-based voting systems be considered harmful? Hence, first (i) requirements of BC-based voting systems are provided, followed by (ii) terminology definitions, and (iii) complemented by the design and implementation of a fully decentralized voting system: Æternum, which achieves Unconditional Privacy (UP) and neither relies on computational hardness assumptions nor on a trusted Trusted Third Party (TTP). Achieving UP is crucial because future adversaries may be able to break hardness assumptions. Æternum does not present a Single-Point-of-Failure (SPoF) either, since (i) the PBB in use is based on a permissioned DL, and (ii) the final tally and proofs can be verified by anyone, without requiring trust in any authority.

Given the growing increase in the number of blockchain (BC) platforms, cryptocurrencies, and tokens, non-technical individuals face a complex question when selecting a BC that meets their requirements (e.g., performance or security). In addition, current approaches that aid such a selection process present drawbacks (e.g., require specific BC knowledge or are not automated and scalable), which hinders the decision process even further. Fortunately, techniques such as Machine Learning (ML) allow the creation of selection models without human interaction by identifying the BC features that match the requirements provided by the user in an automated and flexible manner. Thus, this work presents the design and implementation of an ML-based BC selection approach that employs five ML models to select the most suitable BC given user requirements (e.g., BC popularity, fast block inclusion, or Smart Contract - SC support). The approach follows an ML-specific data flow and defines a novel equation to quantify the popularity of a BC. Furthermore, it details the models’ accuracy and functionality in two distinct use cases, which shows their good accuracy (>85%). Finally, discussions on (a) the ML usefulness, (b) advantages over rule-based systems, and (c) the most relevant features for the BC selection are presented.

This work specifies, implements, and evaluates access management based on face recognition. The system developed uses Internet-of-Things (IoT) for video surveillance, Artificial Intelligence (AI) for face recognition, and Blockchains (BC) for immutable permanent storage and provides excellent properties in terms of image quality, end-to-end delay, and energy efficiency.

Light Detection and Ranging (LiDAR) is used in various applications, from mapping the environment’s topography to self-driving vehicles. Among such applications, the use of LiDAR for indoor tracking and quantifying visitors’ interest (and ensuring safe distancing) is still not widely explored. Technologies based on wireless signals and video captures are typically used for indoor tracking, but they deficits concerning the lack of accuracy of captured signals or the lack of user privacy in the case of traditional surveillance cameras. Despite introducing tracking challenges inherent in the detection based on light reflection, LiDAR-based approaches represent a relatively low-cost solution for accurate indoor tracking. Thus, this paper presents LaFlector, a LiDAR-based indoor tracking system introducing tracking heuristics capable of detecting, classifying, and tracking several objects simultaneously, which are recorded and dynamically displayed in a 2D coordinate system. LaFlector was evaluated based on a low-cost 2D LiDAR hardware (Slamtec Mapper M1M1) and capable of detecting moving objects with high precision, showing in practice that a LiDAR-based can be used to track visitors’ interest and count the number of moving objects.

Due to the increasing number of cyberattacks and respective predictions for the upcoming years with even larger numbers of occurrences, companies are becoming aware not only that the digitization of their businesses is essential, but also that the adoption of efficient cybersecurity strategies is crucial. Therefore, approaches for a better understanding and analysis of cybersecurity are essential.Thus, SecGrid, a Machine Learning (ML) empowered platform for analyzing, classification, and visualization of cyberattacks is introduced. SecGrid implements an extensible set of miners to analyze information from network traces to provide insightful visualizations of malicious traffic given and to classify automatically different types of cyberattacks by using supervised ML. Experiments conducted show high overall usability, scalability in terms of the capacity of the platform to extract information from large files, and high performance and accuracy during the classification of cyberattacks.

While Wireless Sensor Networks (WSN) offer potentials, their limited programmability and energy-limitations determine operational challenges. Thus, a TinyIPFIX-based system was designed, such that this application layer protocol is now usable to exchange data in WSNs efficiently. The system implementation in MicroPython is simple and efficient in comparison to a lower level programming language, while displaying valuable properties in terms of overhead and power efficiency. Furthermore, it demonstrates that MicroPython may pave the way towards Network Function Virtualization (NFV) on Internet- of-Things (IoT) devices by providing highly portable software functions implemented in a high-level programming language.

Distributed Denial-of-Service (DDoS) attacks remain one of the top reasons for business disruption and financial losses. Although mitigation solutions are available on the market, there is still a need for approaches that help network operators understand attack characteristics and behaviors, resulting in better planning of companies' cybersecurity strategies. This paper introduces DDoSGrid, a platform for the analysis and visualization of DDoS attacks. DDoSGrid implements an extensible set of miners to extract, process, and analyze information from network traces (i.e., PCAP files) to provide insightful visualizations for a better understanding and in-depth analysis of DDoS attacks in different scenarios. A case study was performed using an HTTP flood attack scenario to evaluate the feasibility of the approach. DDoSGrid enables real-world DDoS scenarios' analysis, providing an intuitive interface integrated with extensible insightful visualizations and data miners.

Mobile devices expose information about their hardware and manufacturer while searching for available WiFi networks via a Media Access Control (MAC) protocol. Thus, to protect the users' privacy and prevent MAC address tracking, manufacturers typically provide anonymity through MAC randomization techniques by randomly and periodically modifying the MAC address. This paper presents the ASIMOV tracking approach, which shows through the correlation of randomized information concerning the displacement of devices in space-time dimensions that it is possible to gain insights into identifiable device information. The proposed system is entirely passive and uses a combined Received Signal Strength Indicator (RSSI) value-based localization and the Information Elements (IE) transmitted in every IEEE 802.11 probe request frame.

Businesses were moving during the past decades to-ward full digital models, which made companies face new threats and cyberattacks affecting their services and, consequently, their profits. To avoid negative impacts, companies' investments in cybersecurity are increasing considerably. However, Small and Medium-sized Enterprises (SMEs) operate on small budgets, minimal technical expertise, and few personnel to address cybersecurity threats. In order to address such challenges, it is essential to promote novel approaches that can intuitively present cybersecurity-related technical information.This paper introduces SecBot, a cybersecurity-driven conversational agent (i.e., chatbot) for the support of cybersecurity planning and management. SecBot applies concepts of neural networks and Natural Language Processing (NLP), to interact and extract information from a conversation. SecBot can (a) identify cyberattacks based on related symptoms, (b) indicate solutions and configurations according to business demands, and (c) provide insightful information for the decision on cybersecurity investments and risks. A formal description had been developed to describe states, transitions, a language, and a Proof-of-Concept (PoC) implementation. A case study and a performance evaluation were conducted to provide evidence of the proposed solution's feasibility and accuracy.

While the existence of Public Bulletin Boards (PBB) is often formulated as an assumption in related work on Remote Electronic Voting (REV) systems, this work here on Provotum focuses on the practical design and architecture of such a PBB, including its distributed execution. Further, Provotum leverages a public permissioned Blockchain (BC) as a PBB, where only authorized entities can sign blocks, while the general public can verify all BC data. Therefore, Provotum defines a new and fully decentralized BC-based REV system, which deploys a permissioned BC as a PBB and allows for the explicit distribution of trust across different permissioned BC nodes. Provotum is operated in a fully distributed fashion by using Smart Contracts (SC), Distributed Key Generation (DKG), Homomorphic Encryption (HE), and Cooperative Decryption (CD), as well as employing client-side encryption, which enables ballot secrecy, while the BC forms an audit trail, enabling public and End-to-end Verifiability (E2E-V).

The integration of Internet-of-Things (IoT) and Blockchains (BC) for trusted and decentralized approaches enabled modern use cases, such as supply chain tracing, smart cities, and IoT data marketplaces. For these it is essential to identify reliably IoT devices, since the producer-consumer trust is not guaranteed by a Trusted Third Party (TTP). Therefore, this work proposes a Know Your IoT device platform (KYoT), which enables the self-sovereign identification of IoT devices on the Ethereum BC. KYoT permits manufacturers and device owners to register and verify IoT devices in a self-sovereign fashion, while data storage security is ensured. KYoT deploys an SRAM-based (Static Random Access Memory) Physically Unclonable Function (PUF), which takes advantage of the manufacturing variability of devices' SRAM chips to derive a unique identifying key for each IoT device. The self-sovereign identification mechanism introduced is based on the ERC 734 and ERC 735 Ethereum identity standards.

This work develops an integration of Blockchains (BC) with the Internet-of-Things (IoT) using a highly constrained TelosB IoT platform based on the MSP430 processor family and CC2420 IEEE 802.15.4-compliant radio interfaces. The system is evaluated in an indoor office environment focusing on overhead and energy efficiency of BC transaction (TX) transmissions.

In Industry 4.0 (I4), the Industrial Internet of Things (I2oT) data streams are prone to significant data manipulation risks. The integration of Blockchains (BC) with I2oT may become a solution preventing from this problem. This paper provides a blockchain-agnostic Blockchain I2oT (BI2oT) architecture called BIIT that allows developing a broad range of BC applications fully integrating Internet of Things (IoT). The mechanisms introduced in BIIT aim at solutions that provide data reliability, limit the computational overhead, and enhance energy efficiency. BIIT is evaluated through real-world experimentation.

Due to the growing interest in the blockchain (BC), several applications are being developed, taking advantage of the benefits that such technology promises to deliver, such as removal of Trust Third Parties (TTP) to verify transactions and data immutability. However, these applications require certain aspects, such as high transaction throughput or data privacy, that early BC implementations (e.g., Bitcoin) did not provide. Thus, a myriad of novel BC implementations was developed, which introduced the issue of choosing the right implementation for a specific use-case. This paper presents a framework, called PleBeuS, to address this selection issue by allowing users to specify policies that rule the automatic selection of the BC that data will be stored. The selection process relies on a cost-aware approach and considers both public and private implementations and their technical characteristics. Moreover, PleBeuS communicates with a BC-agnostic interoperability API to enforce transactions. The evaluation of the PleBeuS prototype showed that it is possible to automatically select a BC-based on user policies, considering cost thresholds and technical details (e.g., BC throughput, deployment), and reduce manual interaction.

Transactions (TX) sent and executed by a public Blockchain (BC) need to pay a TX fee. The fee is relative to the resources consumed when including the TX into a block. The sender of the TX pays for the fee in the native currency of the BC used. Such a fee protects the network from Denial-of-Service (DoS) attacks and provides incentives for TXs inclusion. BCs that support Smart Contracts (SC), thus, TXs can execute user-provided code, require a mechanism for fee calculation depending on the resources consumed by the code executed. Ethereum uses an elaborated mechanism compared to Bitcoin, leading to an increase in the attack surface of their SCs. The mechanism that makes the Bitcoin script - a limited version of SCs - more secure is the ability to compute, independent of the BC's state, an upperbound on resources needed to execute this TX. Thus, this work proposes a new approach enabling security benefits by defining an upper-bound on resource usage for general SCs. Furthermore, the approach allows for the payment of fees in any currency and not just the native currency of the BC.

Long Range (LoRa) defines a popular modulation scheme based on the chirp spread spectrum technique. It is used in Low Power Wide Area Networks (LP-WANs) for the Internet-of-Things (IoT). Thus, this work here designs, specifies, implements, and evaluates a Cloud Radio Access Network (CRAN) architecture for LoRa networks, while using (a) Software Defined Radios (SDR) to receive/send radio signals and (b) Docker to virtualize the setup. (c) A software modulator is developed to emit signals on the downlink targeting regular LoRa end-device receivers, such as Semtech SX1276 chips. Finally, the network, processing, and cost requirements of the C-RAN implemented are evaluated.

Cyberattacks are the cause of several damages on governments and companies in the last years. Such damage includes not only leaks of sensitive information, but also economic loss due to downtime of services. The security market size worth billions of dollars, which represents investments to acquire protection services and training response teams to operate such services, determines a considerable part of the investment in technologies around the world. Although a vast number of protection services are available, it is neither trivial for network operators nor endusers to choose one of them in order to prevent or mitigate an imminent attack. As the next-generation cybersecurity solutions are on the horizon, systems that simplify their adoption are still required in support of security management tasks. Thus, this paper introduces MENTOR, a support tool for cybersecurity, focusing on the recommendation of protection services. MENTOR is able to (a) to deal with different demands from the user and (b) to recommend the adequate protection service in order to provide a proper level of cybersecurity in different scenarios. Four similarity measurements are implemented in order to prove the feasibility of the MENTOR's enngine. Aug evaluation determines the performance and accuracy of each measurement used during the recommendation process.

Data leaks and privacy scandals have been a growing concern of the last decade. While most traditional, i.e., centralized, online platforms require users to register with their personal data, they potentially expose the user's identity and data to be used for unintended purposes. This work proposes TradeMap as an integrated architecture, designing and enabling an online end-to-end (e2e) trading market place, while supporting anonymous management features. TradeMap addresses the Swiss Financial Market Supervisory Authority (FINMA) regulations by designing a FINMA-complaint Know Your Customer (KYC) platform. Additionally, TradeMap is based on blockchains and employs Ethereum Smart Contracts (SC). Thus, trust and anonymity between the market place and the KYC system relies on zero knowledge proof-based SCs used for user identification processes. With this management approach proposed, the user authentication is only verified within the KYC platform, providing a legally valid and fully anonymous online trading platform.

The blockchain (BC) world is rapidly becoming a universe of several ledgers designed for a specific purpose, holding data previously stored (i.e., siloed) in centralized databases. The use of different BCs for the same purpose could hamper the frictionless exchange of data or value. On one hand, it is natural that there are competing implementations exploring the benefits of BC. On the other hand, the problem of siloed data re-emerges, with respect to isolated chains. In this regard, BC interoperability is necessary to connect different BCs, exchanging information and assets. Moreover, to foster BC employment, developers must be able to interact with such different BCs without knowing the details of each implementation. This paper presents a novel solution, called Bifröst, to store and retrieve data on different BCs. Bifröst employs a notary scheme, which allows for connectivity to different BCs. The presented prototype is highly modular and currently implements seven adapters to popular BC implementations, including Bitcoin, Ethereum, and Stellar. The developed prototype was evaluated concerning performance, security, and data size to verify the feasibility of such an implementation and assess design decisions taken during its development.

Network Functions Virtualization (NFV) is transforming the way in which network operators acquire and manage network services. By using virtualization technologies to move packet processing from dedicated hardware to software, NFV has introduced a new market focused on the offer and distribution of Virtual Network Functions (VNF). Infrastructure Providers (InP) can benefit from an NFV market by providing their infrastructures to fulfill demands of end-users that, in turn, acquire VNFs-as-a-Service (VNFaaS). In this context, solutions that promote the competition between InPs can lead to lower prices, while increasing VNF performance to accommodate specific demands of end-users. In this paper, BRAIN, a blockchain-based reverse auction is presented to introduce an auditable solution in which InPs can compete to host VNFs taking into account the demands of each particular end-user. Such a solution helps reduce costs involved in VNF's commercialization and also monetize NFV-enabled infrastructures. BRAIN is supported by a case study that provides evidence of the solution's feasibility and effectiveness. A discussion regarding blockchain advantages and drawbacks in this use-case (e.g., additional costs and time) concludes this paper.

BitTorrent (BT) is still widely used for, mostly, illegal file sharing despite the emergence of legal streaming services. Besides piracy BT traffic can be a challenge for networks and their management due to flash crowds. Measurements provide data to understand regional and temporal traffic patterns supporting network management. This work presents a large data set comprising three months of BT measurements from 2016, comprising more than 70,000 swarms and 6,600 samples. To identify the regions, Autonomous Systems (AS), and content responsible for the most traffic the raw measurement data is transformed and aggregated into graphs centered around countries, ASes, and videos. By calculating node-centric graph metrics the important actors in those graphs are identified and the changes over time are investigated. The results show that English-speaking countries are most important for the distribution of video files and that most traffic results from Philippine ASes and one Dutch AS belonging to a server hosting company. Furthermore, strong weekly patterns are observed which are effected by the release of popular content causing weekly flash crowds. The measurements presented herein raise doubt that anti-piracy measures are effective, showing that the piracy problem needs to be addressed on a global level since users can easily circumvent local measures taken. For network operators those results mean that traffic can be expected as soon as new popular content is released and that the destinations and source will change in the long term.

This work proposes an IoT- and Blockchain-based, distributed system, for automated measuring, storing, and monitoring of water and air quality in environments such as lakes, mountains, urban areas, or factories. Comparable state-of-the-art solutions, require human interaction to access the data or require high power consumption or space requirements, or they are based on centralized architectures. The proposed pollution monitoring system here, on one hand, employs LoRa to address the high power consumption and long-range transmission challenges of IoT protocols. On the other hand, it is designed to be fully decentralized by using the Ethereum Blockchain to store and retrieve the data recorded by IoT sensors. Thus, data integrity is provided without the need for a Trusted Third Party (TTP) and data is collected and captured automatically without any manual operations needed. Observations on the four different types of sensors for measuring Potential Hydrogen (PH), Turbidity, Carbon monoxide (CO), and Carbon dioxide (CO2), revealed a high accuracy with the expected time-lines of measurements, non-falsified experimental values collected and can be used as reliable evidence of presence of pollution.

Smart Contracts (SC) extend the applicability of Blockchains (BC) in various decentralized use cases. This work demonstrates the design and implementation of a trading application which, employs SC and Ethereum BC. This Decentralized Application (Dapp) provides flexibility in requesting user Identity (ID) directly by seller/hirer and buyers/renter. To provide trust, deposits are paid by two sides while setting up contracts. WiFi- Direct is the chosen Device to Device (D2D) communication protocol which provides high data rates and secure data transmission. Light-Weight SC are introduced in this work which, use D2D communications for sending sold or rented object's or each party's images, and ID data directly to other party instead of storing them in the public BC to reduce the costs. Evaluations in terms of D2D deployment, transaction costs, and privacy, indicate that this system is time-efficient and manages the process in a cost-efficient fashion without the need to store and publish all of the user's ID information in BC.

Multi-resource allocation in data centers determines a network and service management task of crucial importance. While, traditionally computing systems are shared based on a single resource, it was shown that in data centers this simplification often impedes overall efficiency and fairness. Therefore, newer approaches consider data center resource allocations as a multi-resource allocation problem. However, the capability of these approaches to reach overall fairness or efficiency is limited due to theoretical assumptions they make or due to practical means they deploy to control resources. This survey: 1) details all steps necessary to allocate data center resources and puts these steps in relation to each other; 2) highly relevant concepts in support of fair data center resource allocations, such as utility functions and allocation characteristics, are discussed and compared; and 3) in turn, major approaches to allocate multiple data center resources in a fair manner are outlined, mapped to practical steps and economically driven-targets, and compared with respect to their suitability of being applied in today's data centers.

Blockchains are on the top of the Gartner Hype Cycle 2016 and many start-ups are integrating blockchains into their technology portfolio. While blockchains have emerged in the context of financial applications, non-financial application areas are of interest as well. In this paper, modum.io is presented, a start-up that uses IoT (Internet of Things) sensor devices leveraging blockchain technology to assert data immutability and public accessibility of temperature records, while reducing operational costs in the pharmaceutical supply-chain. The medical industry has many complex and strict environmental control process (e.g., temperature and humidity) to ensure quality control and regulatory compliance over the transport of medical products. The sensor devices monitor the temperature of each parcel during the shipment to fully ensure GDP regulations. All data is transferred to the blockchain where a smart contract assesses against the product attributes. As modum.io is not the only non-financial start-up working with blockchains, a list of areas and other start-ups is provided that aim to reduce bureaucracy, distribute the infrastructure, and saving costs using blockchains.

Peer-to-Peer (P2P) systems measurements are still a relevant research topic, since insights in large swarm sizes and churn are not yet available for the BitTorrent network. To improve existing measurement methodology, this work here tackles the aspect of swarm size estimation and complete collection in the BitTorrent network. For this purpose the Coupon Collector Problem is modified and formulated as the BitTorrent Peer Collector (BTPC) Problem. Thus, (a) simulations are used to test simple and maximum likelihood estimation for hidden swarm sizes, (b) an analytical solution to the BTPC problem is presented, and (c) measurements are used to evaluate estimators of the BTPC model. Obtained results show that this estimation works well for classical trackers and that churn constantly influences measurements. Those results show that more peers use the Main-line DHT than a single tracker, however, client implementations challenge those models working well for trackers.

Video-on-demand and live streaming services are about to take over video discs. Video streaming services typically cannot compete with the content available in Peer-to-Peer (P2P) file sharing networks. Thus, content providers can use P2P systems to identify content to include in their offer. This work defines a novel method to apply Social Network Analysis (SNA) on video streaming or download traces. Those traces are abstracted int a two-mode graph, which is projected to a content-centric one mode graph (ConNet). SNA measures are used on a ConNet to classify a content-centric graph and provide a general interpretation and insights into the system the traces were collected from. To evaluate the proposed method, real world traces acquired from BitTorrent (BT) swarms sharing movies and television (TV) shows are used to construct 48 hourly graphs to show the evolution of the graph. The results show that the video network can be classified as scale-free, that SNA measures can be used as an alternative popularity indicator, and that the network evolves over time and exhibits diurnal patterns. Finally, this work shows that the proposed method can be applied to real world traces and provides a novel perspective on video consumption.

Charging for Quality-of-Experience (QoE) is the key to overcome the monopoly of the Mobile Termination Rates (MTR) market. An Axiomatic QoE model (AQX), which considers simultaneously technical and non-technical parameters, is proposed to estimate end-user's QoE. AQX is used as a bidding metric in the Auction-based Charging User-centric System (AbaCUS). AbaCUS defines the Mobile (Virtual) Network Operator (MvNO) maximizing end-user's QoE. An automatic and on-demand MvNO selection mechanism is then used to register end-users mobile devices in the desired MvNO. This mechanism has been implemented and evaluated in terms of its time and energy efficiency.

Autonomic communications aim to provide the quality-of-service in networks using self-management mechanisms. It inherits many characteristics from autonomic computing, in particular, when communication systems are running as specialized applications in software-defined networking (SDN) and network function virtualization (NFV)-enabled cloud environments. This paper surveys autonomic computing and communications in the context of software-driven networks, i.e., networks based on SDN/NFV concepts. Autonomic communications create new challenges in terms of security, operations, and business support. We discuss several goals, research challenges, and development issues on self-management mechanisms and architectures in software-driven networks. This paper covers multiple perspectives of autonomic communications in software-driven networks, such as automatic testing, integration, and deployment of network functions. We also focus on self-management and optimization, which make use of machine learning techniques.

Vehicular Ad-hoc Network (VANET) communications are mobile communication alternatives allowing vehicles to exchange information among them with a suitable forwarding scheme. The forwarding scheme is a mechanism to select proper candidate nodes as the intermediate node. Current angle-based forwarding schemes take into account a Horizontal Relative Angle (HRA) and propose Vertical Relative Angle (VRA) as an alternative. The introduction of a filtering concept, implementing both HRA and VRA, restricts the number of insignificant candidates. Under various VANET communication factors (e.g., network density, mobility, and road level topology) the work presented here investigates the VRA scheme to improve the forwarding decision especially in the three-dimensional case within a large city environment.

Adoption of any new technology in an organization is a crucial decision as it can have its impact at technical, economical, and organizational level. One of such decisions is related to adoption of Cloud-based services in an organization. Cloud Computing provides elastic resources as per the demand and provides the facility to pay as per the use. Thus, it is changing the way IT infrastructure is used today with huge benefit of cost savings. However, if the solution adopted by an organization is not fulfilling the requirements, it can have tremendous negative consequences at technical, economical, and organizational level. Therefore, the decision to adopt Cloud-based services should be based on a methodology that supports a wide array of criteria for evaluating the available alternatives. Also, as these criteria or factors can be mutually interdependent and conflicting, a trade-offs-based methodology is needed to make such decisions. This paper, therefore, discusses the design, implementation, and evaluation of the prototype developed for automating the theoretical methodology of Trade-offs based Methodology for Adoption of Cloud-based Services (TrAdeCIS) developed in (Garg and Stiller, 2014). This system is based on Multi-attribute Decision Algorithms (MADA), which selects the best alternative, based on the priorities of criteria of decision maker. In addition the applicability of this methodology to the adoption of cloud-based services in an organization is validated with several use-cases towards the end of the paper. Furthermore, the extendibility of this system to other domains is being evaluated with respect to Train Operating Companies, who wish to find out the best alternative of providing Internet connectivity and voice calls on-board trains.

In recent years fairness problems in data centers have been pointed out and job/Virtual Machine (VM) scheduling has been chosen as a solution approach. Clouds are a special case of data centers, where resources are deployed by VMs in a highly dynamic manner during VM runtime. However, scheduling only allows influencing resource allocations, when VMs are instantiated, i.e., before runtime. Thus, runtime prioritization bears a great potential to manage cloud resources and promote fairness in clouds, especially, when VMs run over long periods. Nevertheless, runtime prioritization is not leveraged accordingly. This paper defines fairness as handicapping VMs of heavy users during runtime to allocate more resources to VMs of light users. Thereby, the need to make assumptions on user's utility functions is avoided, while different fairness notions can be captured by adapting the definition of heaviness. Guidelines for this definition are provided to ensure incentives to configure and utilize VMs adequately. Finally, OpenStack is extended in its implementation by a decentralized fairness service to enforce fairness according to this definition. The fairness service's functionality is certified by experiments in terms of overhead and fairness promotion.

Decentralized systems, such as overlay networks or content delivery networks, form a virtual network on top of a physical network leading to inefficiencies in handling network traffic as physical locations are not considered. Therefore, this work investigates, analyzes, and evaluates two feasible network locality metrics for decentralized systems to overcome such inefficiencies. Furthermore, those metrics to determine network locality have been implemented and evaluated within an international testbed. These metrics evaluated consider aspects of path stability and path symmetry. The evaluation performed did reveal that the stability and symmetry metrics provide accurate locality indication.

WiFi-enabled devices broadcast a vast amount of data without being associated to any access points. To study and analyze this data, a generic passive WiFi tracking system called Probr was developed. Probr manages various types of WiFi capturing devices, collects captured WiFi traces, processes collected WiFi traces, and visualizes WiFi activities via its Web interface. Probr supports several on-line analysis use cases and is extensible with respect to custom storage solutions to fit further use cases. Thus, Probr is the first system of that kind known, enabling full device administration and provided completely as Open Source. A case study conducted demonstrates the capabilities of Probr for use cases such as room utilization estimation, indoor device localization, tracking a person's presence between multiple Probr-equipped locations, and analysis of device vendor preferences.

Since Video-on-Demand (VoD) streaming and general overlay traffic, especially file sharing, are causing the main portion of today's Internet traffic, Internet Service Providers (ISP) face (a) challenges of network congestion during peak hours and (b) tussles between Video Content Providers (VCP) and ISPs, which can lead to congestion. However, dedicated traffic traces are not available today due to (a) the lacking interest of VCPs to share their internal data, e.g., avoiding problems with privacy issues, and (b) the unavailability of measurement studies for overlay networks that are neither too specific nor cover more than a snap-shot of the network, which does reflect the essential traffic evolution over time. Thus, this paper bridges this gap between suitable traffic data and a video consumption analysis by (1) the development and prototyping of a new system to continuously monitor Video Consumption in Overlay Networks (VIOLA), resulting in an extensive and comprehensive measurement data set for detailed network evolutions over time in case of BitTorrent, and (2) a generic and reusable geographic visualization approach termed GeoChart, which aggregates selected data into a generic data structure to visualize them on a map.

Reliability and stability for connectivity are the important factors to enhance inter-vehicular communication. In order to achieve such factors, challenges especially in a large city environment due to signal attenuation and a typically poor transmission coverage issues are investigated. Both issues are caused by the existence of obstacles (i.e., overpass constructions and buildings) and road level topology (i.e., a three-dimensional case). Thus, this paper investigates explicitly the horizontal and vertical transmission distances that apply in a three-dimensional case. These distances are covered by existing propagation models of a large city by modeling them as a log-distance path loss with obstacle fading. The scenario of the dedicated three-dimensional case is simulated through the introduction of Vertical Relative Angles (VRA) and Horizontal Relative Angles (HRA) as supporting factors for the forwarding decision. The evaluation shows that applying HRA and VRA reach higher delivery ratio and reduces relatively lower delay in a large city scenario.

Today, users demand comfortable frameworks and development environments independent of applications. CoMaDa 1.0 - a framework for Configuration, Management, and Data handling of sensor data - is such a framework for dealing with sensor data in an operational manner. It includes a widget to Xively, a third party service provider, to visualize sensor data collected in graphs. This results in a dependency to Xively, which is not acceptable by users today anymore due to the need for clear trustworthiness and reliability. The uploaded data must follow format specifications by Xively and API updates in the upload procedure are periodically required due to changes by Xively. In case of changes the entire widget in CoMaDa 1.0 must be updated resulting in unacceptable interrupts and downtimes for CoMaDa users. Additionally, users demand trustworthy services, which are not necessarily provided, if a third party is involved, because users lose control of their data. Thus, the visualization service in CoMaDa 1.0 was updated by including Google Charts in CoMaDa 1.1 to provide the same services as Xively, specifically visualizing single sensor types (e.g., temperature or humidity), without any third party involvement storing collected sensor data. Additionally, extended visualization services were included like a layered visualization of the same sensor types to improve the comparability of collected data (e.g., temperature measured by different sensors). CoMaDa 1.1 offers herewith a data visualization independent of data storage at third parties.

Technical advancements in virtualization and Service-oriented Architectures, the technology backbone of Cloud Computing (CC), along with the availability of high speed Internet has escalated the performance of CC in terms of elasticity, throughput, agility, or response time. However, according to the Gartner's Hype cycle of 2014, CC is at the "Trough of Disillusionment", which hints at "waning of interest as the implementations fail to deliver" [7]. The reason for this situation is the lack of a methodological impact analysis for adopting cloud-based services in an organization. In the context of CC an impact analysis is complicated due to the complex architecture of services and presence of influencing factors from multiple dimensions (technical, economical, and organizational). This paper, therefore, extends and evaluates the methodology "Impact Analysis Methodology for Cloud-based Services (IAMCIS)" that quantifies the impact of cloud-based services before they are adopted in an organization [6]. The methodology is illustrated in combination with a use-case obtained from a survey conducted with 17 organizations (with varied domain of expertise, size, and geographical scope), who plan to adopt or have adopted cloud-based services for fulfilling their IT requirements.

Cloud Computing has emerged as a paradigm that relies on sharing resources over the network and, therefore, potentially has cost advantages in terms of lower variable and capital cost. However, the adoption of cloud-based technology for a given IT (Information Technology) setting is a complex decision as it is influenced by multiple interdependent factors. To successfully adopt cloud-based services and evaluate their consequential impact, relevant factors, which denote the performance of such services, have to be identified. This paper, therefore, analyzes and identifies relevant technical, economical, and organizational factors. This is performed as exploratory research consisting of performing (a) a literature review and (b) multiple case-studies with 17 organizations, who have adopted or plan to adopt cloud-based services. Also, as these factors are not mutually exclusive, this paper discusses interrelations of these factors and its complexity.

Finding a parking space in urban areas is a daily challenge for drivers across the world, due to the increasing amount of vehicles and the limited amount of parking spaces. Drivers who are looking for a parking space in peak hours are often forced to drive around city blocks until they spot a free parking space. This process is termed in literature "cruising for parking" and is proven to (a) cost a lot of time and gas for drivers, (b) generate unnecessary traffic load, and (c) affect the environment negatively due to increased vehicle emissions. This work proposes a Parking Monitoring and Management System (PMMS) that collects, processes, and presents data about available parking spaces and their tariffs within a geographical region. The end-user application of the PMMS, parkITsmart, delivers at drivers bird's-eye view concerning the parking availability. To facilitate this, the PMMS gathers data from drivers', vehicles, their mobile phones, and Parking Inspectors (PIs). This work shows that in the Internet-of-Things (IoT) environment, "pairing" cars and drivers' mobile phones, collecting data from their sensors, and from PIs in a parking monitoring and management system, can decrease significantly cruising times for parking and can increase the time demands of the parking controlling process.

Peer-to-Peer (P2P) systems have been deployed on millions of nodes worldwide in environments that range from static to very dynamic and therefore exhibit different churn levels. Typically, P2P systems introduce redundancy to cope with loss of nodes. In distributed hash tables, redundancy often fixed during development or at initial deployment of the system. This can limit the applicability of the system to stable environments or make them inefficient in such environments. Automatic network configuration can make a system more adaptable to changing environments and reduce manual configuration tasks. Therefore, this paper proposes an automatic replication configuration based on churn prediction that automatically adapts its replication configuration to its environment. The mechanism termed dynamic replication mechanism (dynamic RM) developed and evaluated in this paper is based on exponential moving averages to predict churn that is used itself to determine a replication factor meeting a certain reliability threshold. Simulations with synthetic data and experiments with data from torrent trackers show that the behavior can be predicted accurately in any environment, from low churn rates to diurnal and high churn rates.

The performance gap between mobile phones and computers shrinks with advancing mobile phone technology. Powerful mobile devices with fast networking are capable of participating in overlay networks. However, a challenge is the limited power capacity of mobile devices, as networking is one of the most battery-draining functionality of mobile phones, yet essential for the participation in an overlay network. Thus, this paper proposes an energy-efficient relay mechanism. A buffered relaying mechanism with push notifications allows mobile phones to remain longer in the sleep mode. The evaluation confirms a reduction of the energy consumption. While only 6% of energy can be saved in WiFi, up to 28% less battery is consumed in a 3G cellular network. These insights are used for the prototypical implementation of a distributed file synchronization client on Android.

Mobile users' Quality-of-Experience (QoE) is degrading as network usage increases while Internet Service Providers (ISP) face increased inter-domain traffic. This paper presents a network traffic management mechanism, named RBHORST, addressing these inefficiencies. RB-HORST exploits home routers by using them as caches and forming an overlay network between them to transfer content. To shift traffic from peak hours, RB-HORST employs predictions based on social network properties and based on similarity in the overlay network. To further improve user QoE, home routers allow trusted mobile devices to offload their mobile connection to the local WiFi. Simulation results show that an overlay is imperative for the success of the proposed caching mechanism. Especially ISPs with a large number of customers can benefit if only every thousandth user shares its router, reducing inter-domain traffic by half and superseding an ISP operated cache. The presented implementation proves that the concept is technically feasible and can be deployed and run on constrained devices.

Wireless Sensor Network (WSN) is a fundamental technology of the Internet of Things (IoT). Group communications in the form of broadcasting and multicasting incur efficient message deliveries among resource-constrained sensors in IoT-enabled WSNs. Secure and efficient key management is significant to protect the authenticity, integrity, and confidentiality of multicast messages. This paper develops two group key establishment protocols for secure multicast communications among resource-constrained devices in IoT. The applicability of the two protocols are analyzed and justified by performance and security analysis.

In the Internet Protocol (IP) ecosystem, Quality-of-Experience (QoE) is important information needed by Service Providers (SP) to improve their services. However, end-user's satisfaction, which can be reflected by QoE metrics, cannot be easily measured like technical variables, such as bandwidth and latency. QoE can either be estimated through mathematical models or it can be measured through an experimental setup. In this work a Voice-over-Internet Protocol-based (VoIP) QoE measurement setup has been designed to capture end-user's QoE in VoIP services. The data measured during these experiments are used to define all necessary parameters of the Deterministic QoE model (DQX) in this VoIP scenario. Such a calibration of the model is essential to adapt it to the particular service and its technical and non-technical conditions in which it is used. Furthermore, those DQX results achieved are compared with those results of the IQX Hypothesis and the E-Model, being proposed by the ITU-T. Thus, it is finally shown that DQX can capture more accurately end-user's QoE in VoIP scenarios.

Measuring the impact of technical variables, such as latency, bandwidth, or resources priority-access, on Quality-of-Experience (QoE) of various services demands an extensive feedback from end-users, when those variables change. Estimating QoE in a given scenario becomes harder, when non-technical variables, such as price, need to be considered in addition to technical ones. In any case, detailed feedback that correlates all variables affecting QoE is needed by end-users for each service separately. In this work a deterministic mathematical model (DQX) encapsulating user demands, service characteristics, and variable specifications is proposed to formalize the QoE calculation, considering one or multiple and diverse variables. The output of QoE functions presented here can be normalized such that results will be compatible with the five-point scale Mean Opinion Score (MOS), proposed by the ITU-T.

Despite of the observed Cloud Services' (CS) heterogeneity, e.g., different APIs (Application Programming Interface), different accounting and charging models, and different security and privacy levels, one common aspect is that CSs provide a large amount of storage. CSs provide generic storage when it accepts to store data in any data type (e.g., Dropbox, Amazon S3). CSs provides data-specific storage when it accepts to store data only represented in specific data types (e.g., Google Picasa, SoundCloud). Therefore, PiCsMu (Platform-independent Cloud Storage System for Multiple-Usage) was developed to (1) aggregate multiple CSs' storage despite of the accepted data type, (2) provide enhanced privacy, and (3) enable a Peer-to-Peer (P2P) file sharing network relying on CSs' storage instead of peers' storage. The demonstrator use case shows how a PiCsMu user can upload, download, and share files with other PiCsMu users, especially highlighting: (a) the hybrid approach used by the PiCsMu system, showing that data is stored in CSs and the P2P network acts as a management overlay; (b) the PiCsMu social capabilities, showing that PiCsMu users are able to find and share content to existing Online Social Network friends; and (c) the fragmentation and data encoding, showing that both processes enable higher privacy levels since data is stored in multiple different CSs and is imperceptible to CSs' data validation.

A manual selection of the Mobile Network Operator (MNO) to be used on a mobile device is possible through the respective user interface. Furthermore, mobile devices can be adjusted to select automatically the MNO based on the strongest signal strength, among the list of those MNOs the Subscriber Identity Module (SIM) card is allowed to be registered with. However, so far in modern mobile operating systems, such as Android and iOS, there is no available method in the public developer's Application Programming Interface (API), which allows for an automatic and on-demand selection of the MNO by third-party applications. Recently, various research approaches assume the existence of an automatic and on-demand MNO selection mechanism to achieve different goals, such as breaking the termination rates monopoly (AbaCUS) or minimizing the non-ionizing radiation of mobile/wearable devices. The interest of such a mechanism has been raised three years ago by the Android developers community. Thus, this work here presents an automatic and on-demand MNO selection mechanism, that has been designed and implemented on the Android platform. For evaluation purposes the energy and end-to-end (e2e) time consumption while switching among MNOs using this mechanism is evaluated and as an applied example the data consumption of AbaCUS signaling messages is measured.

The use of smartphones has been increasing in the last few years. Many open standards and accessible Application Programming Interfaces (API) make it easier for developers to achieve their ideas and many communities, such as xda developers, or stackoverflow provide good questions and answers concerning mobile application development. Questions on how to search for available MNOs and how to switch a Mobile Network Operator (MNO) programmatically on Android devices already arose in 2010. Until the work concluded here, an answer of those questions have not been published. The main reason is that there are no methods provided in the public Android API that allows for performing such tasks. In this work here two mechanisms allowing for (a) an automatic and on-demand MNO selection and (b) an MNO look-up mechanism have been developed for the Android platform. The efficiency of these mechanisms has been evaluated with respect to power and time consumption.

Many Cloud services provide generic (e.g., Amazon S3 or Dropbox) or data-specific Cloud storage (e.g., Google Picasa or SoundCloud). Although both Cloud storage service types have the data storage in common, they present heterogeneous characteristics: different interfaces, accounting and charging schemes, privacy and security levels, functionality and, among the data-specific Cloud storage services, different data type restrictions. This paper proposes PiCsMu (Platform-independent Cloud Storage System for Multiple Usage), a novel approach exploiting heterogeneous data storage of different Cloud services by building a Cloud storage overlay, which aggregates multiple Cloud storage services, provides enhanced privacy, and offers a distributed file sharing system. As opposed to P2P file sharing, where data and indices are stored on peers, PiCsMu uses Cloud storage systems for data storage, while maintaining a distributed index. The main contribution of this work is to show the feasibility to store arbitrary data in different Cloud services for private use and/or for file sharing. Furthermore, the evaluation of the prototype confirms the scalability with respect to different file sizes and also shows that a moderate overhead in terms of storage and processing time is required.

Analyzing IP traffic is an important task on which many network management applications are based. Cisco's Net-Flow system is one of the most widely used approaches for accomplishing a measurement and collection of flow records, needed to analyze traffic. Working with NetFlow means to involve very large amounts of data, while the collection, storing, and enabling of analyzers demands the access to this data in the fastest possible manner. Thus, this paper addresses this challenging task and presents a newly developed cooperative caching approach (CoopSC) that can be used to improve access time and data transfers between the centralized flow-based storage solution and those analyzers in operation. Such an improvement can positively influence the performance of flow-based solutions. Therefore, this approach NMCoopSC (Network Management CoopSC) has been validated, and experiments show that NMCoopSC improves the performance of NetFlow-based range queries.

It is not easy to supervise and manage nonstandard and illegal network operations in open wireless environment with multi-hop relay transmission in Mesh networks. To solve the non-repudiation issue on a user's posting operation when accessing the Internet via a wireless Mesh network, a novel non-repudiation scheme for a user's posting operation is proposed based on the user Behavior Authentication Code (BAC). By using of user's BAC, the protocol stack and authentication frame in the MAC layer of a Mesh network are reconstructed and improved so as to process the data flow conveniently in the multi-gateway mode, which ensure the secure aim of a posting operation's controllability and detectability. Simulation experiment results show the validity and feasibility of the scheme proposed.

Radiommender is a fully-distributed, peer-to-peer on-line radio. Users can share their music collection and explore music collections of other users. The difference to current file sharing systems is that songs do not need to be searched individually - a distributed recommender system is used to estimate user preference. Recommendation is done with a combination of an implicit voting system that assigns songs to search terms and an affinity network that correlates user interest. The demonstration shows the software functionality and includes the visualization of affinity graphs built by the recommender system.

Semantic caching is a technique used for optimizing the evaluation of database queries by caching results of old queries and using them when answering new queries. CoopSC is a cooperative database caching approach, which extends the classic semantic caching approach by allowing clients to share t

This thesis investigated how performance of today's IP traffic metering and analysis applications can be improved by moving from a centralized, high-performance infrastructure, which executes these tasks, to distributed mechanisms, which combine available resources of multiple devices. The results achieved show that distributed IP traffic metering and analysis leverages bottleneck problems. The distributed IP traffic approach DITA does not solve all problems of handling such large amounts of data in very short time by itself, but proposes an orthogonal approach to existing solutions. DITA revelas that combining distributed IP traffic metering and analysis reaches better and higher performance sampling and aggregation mechanisms, which do provide a very flexible and the open solution to analyzing IP traffic in future high-speed networks. This has been achieved by the facts that all mechanisms designed for DITA - and their prototypical implementations - are based on standard protocols and open-source technologies. DITA determines the first approach to distributed IP traffic metering and analysis known today, which (a) addresses the different bottlenecks of traffic analysis in a generic way, and (b) is self-organizing, offering a scalable solution to regular traffic increases.

The popularity of video sharing over the Internet has increased significantly. High traffic generated by such applications at the source can be better distributed using a peer-to-peer (P2P) overlay. Unlike most P2P systems, LiveShift combines both live and on-demand video streaming while video is transmitted through the peer-to-peer network in a live fashion, all peers participate in distributed storage. This adds the ability to replay time-shifted streams from other peers in a distributed and scalable manner. This paper describes an adaptive fully-distributed mesh-pull protocol that supports the envisioned use case and a set of policies that enable efficient usage of resources, discussing interesting trade-offs encountered. User-focused evaluation results, including both channel switching and time shifting behavior, show that the proposed system provides good quality of experience for most users, in terms of infrequent stalling, low playback lag, and a small proportion of skipped blocks in all the scenarios studied, even in presence of churn.

Trackers are used in peer-to-peer (P2P) networks for provider discovery, that is, mapping resources to potential providers. Centralized trackers, e.g., as in the original BitTorrent protocol, do not benefit from P2P properties, such as no single point of failure, scalability, and load balancing. Decentralized mechanisms have thus been proposed, based on distributed hash tables (DHTs) and gossiping, such as BitTorrent's Peer Exchange (PEX). While DHT-based trackers suffer from load balancing problems, gossip-based ones cannot deliver new mappings quickly. This paper presents B-Tracker, a fully-distributed, pull-based tracker. B-Tracker extends DHT functionality by distributing the tracker load among all providers in a swarm. Bloom filters are used to avoid redundant mappings to be transmitted. This results in the important properties of load balancing and scalability, while adding the ability for peers to fetch new mappings instantly. B-Tracker shows, through simulations, improved load balancing and better efficiency when compared to pure DHTs and PEX.

Service Level Objectives (SLOs) - the core of a Service Level Agreement (SLA) - reflect major Quality-of-Service (QoS) requirements of customers on a service for a given price. SLOs need to be updated, if those requirements change. This leads to an update of the SLO auditing implementation. However, in many existing implementations, efforts are required to adapt to SLO changes, and even more efforts are needed for dynamic adaptations. Thus, a new SLO auditing design is essential to be able to reduce such efforts to the bare minimum. This is especially essential, if the service landscape and relevant QoS parameters are changing frequently. Thus, to meet this core functional requirement of an automated auditing, a generic auditing framework, applicable to any SLO, is presented in this paper, where the analysis of a general audit task, the identification of its sequence of subtasks (functional decomposition), and the development of a respective audit specification for each subtask has been performed. A use case and examples are presented to describe and apply the concept in detail. An SLO auditing application, which was prototyped, is not restricted to a certain set of QoS parameters, but it is dynamically reconfigurable and extensible according to changing demands. The work shows that it has become quite easy to instantiate an auditing application for new SLOs. Additionally, third parties would be able to offer SLO auditing services to a service provider separately.

The management of services offered within identity federations comprises not only the traditional service elements but also those management requirements derived from the federation's specification. However, since a discrepancy between the management needs related to payment and the capabilities offered by the federation's protocols can be observed, this paper aims to provide a solution to bridge this gap. SAML is currently used in many identity federations as a language and protocol for transmitting critical data about a participant's authentication and his/her attributes. Authorization based upon attributes often fulfils the requirements within a non-commercial context. However, whenever payment is required, federation partners have to establish a solution to handle it. Whilst commercial service providers may often use their already established payment solutions, for semi-commercial providers as well as for micropayments and niche-providers, a new approach may be required. Therefore, this paper proposes to use the identity federation language SAML to build such a new solution. Using the novel designed SAML Payment Assertion, SAML is able to handle all the payment-related processes without compromising security. These benefits provided by the protocol and the language would raise the interests for new service providers to join federations that are built upon SAML.

Analysis of IP traffic is highly important, since it determines the starting point of many network management operations, such as intrusion detection, network planning, network monitoring, or accounting and billing. One of the most utilized metering data formats in analysis applications are IP (Internet Protocol) flow records. With the increase of IP traffic, such traffic analysis applications need to cope with a constantly increasing number of flow records. Typically, centralized approaches to IP traffic analysis have scalability problems, which are addressed by replacing existing hardware with more powerful CPUs and faster memory. In contrast, this paper developed and implemented SCRIPT (Scalable Real-time IP Flow Record Analysis), which defines a scalable analysis framework that can be used to distribute flow records to multiple nodes performing traffic analysis in order to balance the overall workload among those nodes. Due to its generic design, the framework developed can be extended and used to distribute other metering data, such as packet headers, payloads, or accounting records.

Network and service performance measurements are essential in IF (Internet Protocol) networks, e.g., for network management, network monitoring, and service quality assurance. In order to measure the service quality received by individual users, a service-specific measurement system is required. Therefore, this paper develops and implements the Network and Service Quality Measurement (NSQM) architecture, which integrates network- and service-specific measurements and can configure all measurement components on demand and according to service signaling in order to setup network-wide measurements in an automated manner. NSQM supports the correlation of measurement data from multiple locations, enabling the determination of link-specific and end-to-end performance characteristics. NSQM allows for measurements at different aggregation levels, including service-class and per-flow measurements. It integrates both active and passive measurements and supports a fine-grained selection of traffic to be measured, which reduces the amount of measurement data to be collected and processed.

Resource allocations determine an important management task for operational Grids and networks, especially under the constraint of commercially offered resources. Therefore, the need for an optimal allocation of this task arises, and this paper proposes a trust-incentive-based combinatorial double auction algorithm for these resource allocations in Grids. The key and new contribution is the design of a trust-incentive mechanism, which is integrated into an existing combinatorial double auction algorithm (a) to improve the performance of Grid resource allocation and (b) ensure that trust values of participating bidders (typically Grid users, termed peers) are considered. In the newly developed trust-incentive-based algorithm, each peers' trust value is adopted to adjust their bids in the process of the combinatorial double auction. After each transaction, peers participating in the transaction rate each other to setup and update the bilateral trust relationship. Those simulation results obtained demonstrate that the algorithm proposed can improve the efficiency of resource sharing greatly by providing applicable incentives to trustworthy peers to contribute more resources. Moreover, this algorithm can identify and eliminate malicious peers in the system to enhance the Grid security level in that respect.

In informal data sharing environments, misspellings cause problems for data indexing and retrieval. This is even more pronounced in mobile environments, in which devices with limited input devices are used. In a mobile environment, similarity search algorithms for finding misspelled data need to account for limited CPU and bandwidth. This demo shows P2P fast similarity search (P2PFastSS) running on mobile phones and laptops that is tailored to uncertain data entry and uses available resources efficiently. In this demo, users publish and search for textual content containing misspellings without relying on query logging, as done by Google, and with a minimum distributed indexing infrastructure. Similarity search is supported by using the concept of deletion neighborhood to evaluate the edit distance metric of string similarity.

Peer-to-Peer (P2P) systems gained popularity and are responsible for a large share of today's Internet traffic. Nevertheless, their dynamic nature and the intended lack of control through central instances make their behavior unpredictable and, therefore, it is difficult to achieve a high level of Quality-of-Service for P2P traffic. Thus, peers are themselves responsible for dealing with these issues by applying so-called self-organization mechanisms to deal with their heterogeneity, unpredictable behavior, and asymmetric resources. This paper discusses and classifies relevant self-organizing aspects of P2P systems, including metrics and mechanisms. Hereby, the key focus is in better understanding on how such self-organizing mechanisms - originally designed to improve the performance of P2P overlays - affect the underlying Internet infrastructure.

Monitoring of Service Level Objectives (SLOs) determines an essential part of Service Level Agreement (SLA) management, since customers are to be reimbursed, if a provider fails to fulfil them. By automating this process, a timely detection of a violation is possible. The compliance approach must be flexible to adapt to potential changes, must be scalable with respect to the amount of data, and has to support multi-domain environments. This paper determines a Hosted Streaming Services scenario and defines relevant SLOs. Key requirements are derived, the respective architecture is designed, and the approach is implemented prototypically based on a generic auditing framework. Further-more, a new scheme is proposed that considers the degree and duration of SLO violations in calculating reimbursements.

Accounting is a key task in commercial networks. With the increasing number of IP-based services and mobility support, accounting needs to evolve towards an integrated, service-oriented accounting approach in a mobile environment. Therefore, this dissertation digest paper presents the Service-oriented Tailored Accounting Configuration (STACO) architecture that enables a service-oriented accounting configuration management in a mobile, multi-domain networking environment. Additionally, it presents the Diameter flow accounting application as an extension to the Diameter protocol in order to integrate IP flow accounting into any Diameter-based infrastructure and to support an efficient transfer of IP flow records.

Incentive schemes in Peer-to-Peer (P2P) networks are necessary to discourage free-riding. One example is the Tit-for-Tat (TFT) incentive scheme, a variant of which is used in BitTorrent to encourage peers to upload. TFT uses data from local observations making it suitable for systems with direct reciprocity. This paper presents CompactPSH, an incentive scheme that works with direct and indirect reciprocity. CompactPSH allows peers to establish indirect reciprocity by finding intermediate peers, thus enabling trade with more peers and capitalizing on more resources. CompactPSH finds transitive paths while keeping the overhead of additional messages low. In a P2P file-sharing scenario based on input data from a large BitTorrent tracker, CompactPSH was found to exploit more reciprocity than TFT which enabled more chunks to be downloaded. As a consequence, peers are allowed to be stricter to fight white-washing without compromising performance.

Peer-to-peer (P2P) systems are, in contrast to client-server (C/S) systems, fault-tolerant, robust, and scalable. While C/S distributed file systems, such as NFS (network file system) or SMB (server message block), do not scale with respect to the number of clients and exhibit a single point of failure, P2P file systems have the potential to cope with an increasing number of participants. Thus, this paper presents DRFS (distributed reliable file system), a P2P file system for cooperative environments. DRFS uses random, content-independent identifiers for data storage, while maintaining high performance and low overhead with many concurrent reads and writes. A dynamic replication mechanism ensures data availability, even under high churn. The application scenario considers an office environment, where DRFS is installed on employees' machines, who store and request files. DRFS has been implemented using the Filesystem in Userspace (FUSE) interface, in order to provide users with transparent read and write operations. Experiments show the benefits of such a peer-to-peer architecture, when a small number of peers reads or writes in parallel: DRFS performs better than NFS, as soon as 6 peers read or write in parallel a 32 MB file. For unpopular files, it is also more reliable than IgorFS.

One of the key challenges in peer-to-peer networks is the design of incentives to encourage peers to share their resources. Incentives are necessary in order to exploit the full potential of these systems. The tit-for-tat incentive scheme, as used in BitTorrent for example, has proven to be a successful approach in P2P file sharing systems, where peers have direct relations and share the same kind of resources. However, in P2P systems where different kind of resources are shared between peers with non-direct relations, the design of incentives remains a challenge. In this paper, a large-scale, fully decentralized P2P collaboration network is shown, where peers share not only bandwidth and storage space, but also contribute by editing articles and voting for or against changes. A new incentive scheme is proposed which supports non-direct relations and provides incentives for sharing different kind of resources. The incentive scheme is based on a reputation system that assigns a reputation value to every peer reflecting its previous behavior in the network. Based on this value, the service level is differentiated, i.e. the higher a peer's reputation the better the quality of service it can get from the network. The service differentiation has been analyzed and simulated with rational, irrational and altruistic peers based on game theory concepts.

The storage of IP traffic traces increasingly grows more complex, since data flows tend to increase largely over time. Network operatorpsilas backbones generate each day hundreds of gigabyte of IP flow records that need to be stored and analyzed. Handling such amount of data requires a high-performance hardware and software. One way to leverage performance requirements of a storing and analysis of traffic data is to design a distributed platform to replace centralized solutions existing today. This paper designs a scalable storage platform for IP flow records. The evaluation of the implemented prototype shows that such an approach can offer a good and practical solution for storing and retrieving high amounts of IP flow records.

IP traffic measurements form the basis of several network management tasks, such as accounting, planning, intrusion detection, and charging. High-speed network links challenge traditional IP traffic analysis tools with their high amount of carried data that needs to be processed within a small amount of time. Centralized traffic measurements for high-speed links typically require high-performance capturing hardware that usually comes with a high cost. Software-based capturing solutions, such aslibpcaporPFRING, cannot cope with those high data rates and experience high packet losses. Thus, this paper proposes a scalable architecture and its implementation for Distributed Packet Capturing (DiCAP) based on inexpensive off-the-shelf hardware running Linux operating system. The prototype designed has been tested as an implementation and was evaluated against other Linux capturing tools. The evaluation shows that DiCAP can perform loss-less IP packet header capture at high-speed packet rates when used alone and that it can highly improve the performance oflibpcapofPFRINGwhen used in combination with those.

Peer-to-peer (P2P) systems show numerous advantages over centralized systems, such as load balancing, scalability, and fault tolerance, and they require certain functionality, such as search, repair, and message and data transfer. In particular, structured P2P networks perform an exact search in logarithmic time proportional to the number of peers. However, keyword similarity search in a structured P2P network remains a challenge. Similarity search for service discovery can significantly improve service management in a distributed environment. As services are often described informally in text form, keyword similarity search can find the required services or data items more reliably. This paper presents a fast similarity search algorithm for structured P2P systems. The new algorithm, called P2P fast similarity search (P2PFastSS), finds similar keys in any distributed hash table (DHT) using the edit distance metric, and is independent of the underlying P2P routing algorithm. Performance analysis shows that P2PFastSS carries out a similarity search in time proportional to the logarithm of the number of peers. Simulations on PlanetLab confirm these results and show that a similarity search with 34,000 peers performs in less than three seconds on average. Thus, P2PFastSS is suitable for similarity search in large-scale network infrastructures, such as service description matching in service discovery or searching for similar terms in P2P storage networks.

The increasing assortment of devices with IP connectivity contributes to the high popularity of video sharing over the Internet. High traffic generated by such applications at the source can be better distributed using a peer-to-peer overlay, since every user forwards information to other users. Current implementations target either live or on demand video streaming. LiveShift is an application that combines both approaches. While video is transmitted through the peer-to-peer network in a live fashion, all peers participate in a distributed storage. This adds ability to replay time-shifted streams from other peers in a distributed and scalable manner. For the demonstration, a decentralized network is used, with peers running on EMANICSLab nodes and notebook computers.

Flow accounting in IP networks is used by network operators for various purposes, such as network management, traffic management, or traffic analysis. In order to integrate flow accounting into an Authentication, Authorization, and Accounting (AAA) infrastructure, this work designs and evaluates an accounting extension to the Diameter protocol - termed Diameter IP Flow Accounting (IPFA) application - in support of the efficient transfer of IP flow records. The new Diameter IPFA application has been implemented as a prototype and its evaluation shows that it achieves a better performance for the transfer of IP flow records than the traditional Diameter accounting approach.

The provisioning of remote and composed services in support of various application areas has dramatically increased over recent times. Thus, the concept of Grids has evolved, in the sense of a common platform for electronic service provisioning in multi-domain environments. While, traditionally, Grids have seen a quite static existence, many new service compositions have to take place on-demand and for certain periods of time only. To tackle those issues the concept of Virtual Organizations (VO) delivers a highly suitable representation of such dynamic Grids. However, one important open problem at this stage is the lack of applicable, distributed, and efficient accounting schemes for commercial resource and service consumptions. Even for simple management purposes, e.g., sampling or archiving, this functionality is essential. Therefore, a comprehensive model for Grid accounting has been developed and suitable accountable units have been defined, in which an underlying activity- and resource-based accounting model covers economic cost theory. Furthermore, this work is based on a service model proposed for service provisioning in dynamic VOs, overcoming the typically static nature of traditional Grids.

Future all-IP networks will support a variety of high-value IP-based services including the upcoming integration of today's non-IP services offered by mobile telecommunication providers. Besides postpaid charging, prepaid charging will play an important role in all-IP environments due to the financial control of providers and customers, thus determining effective economic management means for Internet services. Since existing prepaid charging solutions do not meet imposed all-IP requirements, a novel approach-TICA (time interval calculation algorithm)-with three variants has been presented recently in [14,16]. To prove its optimized performance for many service mixes foreseen, this paper performs a thorough evaluation based on different scenarios. Additionally, comparing TICA's overall performance with existing online charging solutions shows TICA's promising results in terms of way smaller quantity of credit checks required and smaller financial risks for providers to be achieved. Finally, the three TICA variants reveal a clear sensitivity to defined input parameters. These findings indicate that a numbers of suitable settings can be used by service providers.

This application track paper describes the key technology advances achieved through a component-based design process, meeting right on track all key requirements of management systems for biometric data, such as data protection acts, flexible user and device handling, installation, and operation functions, and grouping functionality for users and devices according to dedicated office environmental needs.

When considering mobile or nomadic users of commercial grid services, today's grids have to be reflected with regard to potential functional extensions needed, as well as emerging consequences on business modeling. In-line with a formalized investigation of such mobile grids, the concept of a mobile dynamic virtual organization (MDVO) is introduced, and relevant potentials are illustrated by means of a business scenario in e-health and tourism.

The adoption of the Internet Protocol (IP) by a number of non-IP network operators, such as telecom or cable TV operators, opens the path toward new business models. IP will allow operators to provide a unified wired as well as wireless access to a wide range of services to their users. Additionally, using the same communication protocols and standard interfaces, enables different providers to coordinate any type of resources in virtual organizations (VO) and supports the composition of services aggregated across multiple domains. On one hand, such an open environment requires new business models to be adopted by the involved parties. On the other hand, grid middleware infrastructure supporting integrated accounting, charging, pricing, and billing across multiple domains has to be in place to facilitate service provisioning in multiple VOs. Based on the relevant set of requirements derived, a new and extended A4C Architecture (Authentication, Authorization, Accounting, Auditing, Charging) has been developed, implemented, and evaluated for mobile grids providing pervasive access to knowledge.

Peer-to-peer (P2P) systems are flexible, robust, and self-organizing resource sharing infrastructures which are typically designed in a fully decentralized manner. However, a key problem of such systems are peers overusing a resource. This paper presents a fully decentralized scheme to achieve fair use in P2P systems, which does not require a priori information about a peer. The approach developed is based on a scarce resource trading scheme (SRTCPU), which utilizes CPU time as a form of payment. SRTCPU provides an incentive to offer CPU time in return of consuming a scarce resource. A distributed DNS has been implemented as an example application that uses SRTCPU.

Accounting of service usage is one of the main tasks of service providers in their operation and management processes, providing the necessary information for the subsequent charging process. Because of the increasing number and diversity of services in IP-based networks, accounting has to provide flexible and extensible means supporting different service specific accounting attributes in order to meet the providers' requirements. Furthermore, users typically access services of different providers, resulting in a service composition in a multi-provider environment. After identifying key players in this scenario, this paper presents a service model, classifying different service types, and proposes an architecture (SMArch) for a common accounting scheme, which is implemented based on the IPDR framework and reference code

As of today, grids provide the technology, applications, and platforms for a seamless access to resources, services, and content in a fully decentralized world of distributed information, computing power, and information technology business. Grid computing is about resource sharing and coordinated problem solving in dynamic, multi-institutional virtual organization. Increasingly, advanced grid approaches address knowledge grids. Therefore, the goal is to create a transparent grid infrastructure, to make the grid invisible and to overcome today's rather static approaches. Thus, the dynamic virtual organizations (DVOs) approach provides the right incentives to act as an enabler for invisible grids. First, this paper studies DVOs and its grid service management requirements. Second, a concept for service management of DVOs is presented

Accounting is an essential task for commercial service usage, determining the collection of metered data and correlating it into accounting records. The accounting data generated, describing the service usage of users, serves as input for the subsequent charging process. Because of the diversity of IP-based services and the variety of network technologies, a generic accounting management is required, specifically tailored to user and provider needs. A mobile and multi-domain environment determines additional challenges. This work defines a generic, technology-, and service-independent configuration management of accounting in a mobile, heterogeneous, and multi-provider environment. The proposed accounting process enables a user-and service-specific accounting configuration. It is based on the diameter protocol, specifying required extensions, which include new commands and attribute-value-pairs

P2P networks are becoming increasingly popular for a wide variety of applications going beyond pure file sharing. However, a commercial use of P2P technology is currently not possible as efficient and reliable market mechanisms are missing. This paper presents PeerMart, a distributed technology in support of a market for trading P2P services. PeerMart combines the economic efficiency of double auctions with the technical efficiency and resilience of structured P2P networks. The system is implemented on top of a redundant P2P infrastructure and is being evaluated with respect to scalability, efficiency, and reliability.

The 3G environment is promising a wide range of services with a variety of pricing structures and billing schemes for use over different network operator domains, i.e., a federated environment. A key success factor is to respond to customers' desires to choose the billing scheme that suits their needs, to subscribe to all services as a service package, and to pay for them via a single bill regardless of service type, service location, service providers and network operators. Furthermore, customers may want to choose their services and compose a package dynamically without paying attention to the billing scheme used. The main premise of this paper is that pre-paid and post-paid billing schemes will merge and customers will use services according to their account balance and credits, as opposed to their billing scheme. The requirement on service providers is to use OSS (operations support system) functions and the accompanying information model to support diverse pricing and billing schemes, which is a complex task. This paper presents key OSS functions and an information model that tackle this complexity. Challenges are described and requirements are defined. Related efforts are highlighted, and the context surrounding this work is laid out in detail. Finally, individual entities of information model and OSS functions are defined and an example using flow-chart to illustrate interaction of functions is presented.

Auction-based pricing mechanisms offer the flexibility of setting prices for goods dynamically and efficiently based on current supply and demand. This paper presents PeerMart, a new mechanism which combines the economic efficiency of auction-based pricing with the technical performance and resilience of P2P networks. PeerMart supersedes the need for a central auctioneer by distributing broker functionality over all peers in the network. A structured and redundant P2P overlay network design is applied to achieve scalability and robustness even in the presence of malicious peers.

The new accounting configuration management based on diameter is highly suitable for wireless and mobile communication systems. The diameter protocol extensions by new commands and new AVP's result in a complete and standard-conforming approach. This paper draws the conclusion that the service-oriented accounting configuration management proposed complies with all requirements defined. The common layer above any network access technology is the IP layer and all diameter extensions proposed fit well. User and service profiles enable mobile and wireless network operators to have the best available flexibility to add new services, assign new services to users, and, by providing the respective accounting definitions, have a user- and service-specific accounting configuration in place

Service-oriented peer-to-peer architectures combine the benefits of service-oriented architectures and peer-to-peer networks, such as loose coupling and sealability. They also support service composition, the combining of existing services into new ones. Until now, only composition service strategies for a single peer acting as a service composer have been investigated. Therefore, this paper investigates the market for composed services. It is shown that this market forms an oligopoly and, thus, requires incentive-compatible service pricing. In consequence, the vickrey procurement auction VETO has been developed determining the pricing mechanism in a fully distributed manner. It is proven that VETO is incentive-compatible and maximizes the market's welfare. Furthermore, the VETO protocol is specified and it is shown that this protocol prevents collusion within the auction. Still, VETO upholds the peer-to-peer paradigm by only relying on the peers which are taking part in the auction, no additional trusted entities or super-peers are required

Today's Internet technology is able to support different quality-of-service (QoS) classes to meet different application and user requirements. Combined with the support of user mobility, service providers offer differentiated services not only to their own customers, but also to roaming users. This offer is accompanied normally by more complex pricing schemes which require a complex accounting of the real service consumption. As commercial provisioning of Internet services needs to meet security requirements of providers as well as users, the service consumption must be provable to justify billing and to protect users and providers against other malicious parties. This paper develops the NorCIS architecture (non-repudiation of the consumption of Internet services) and its detailed protocol interactions which allow for the generation and transfer of non-repudiation evidences of service consumptions in a mobile Internet protocol (IP)-based environment. An evidence structure is proposed, supporting a variety of accounting schemes and including information which are used to protect against various attacks. In addition, NorCIS proposes the use of virtual identifiers within evidences to support the privacy of users' identities.

With the increasing number of commercial services in the Internet, the support of a charging process among participating providers becomes highly relevant. In this paper, an architecture is proposed which provides a user-friendly environment for content-based service access. It supports the exchange of charging information between multiple providers. In addition, the approach enables users to receive a single invoice only, containing all the details of accessed services and their charges.

While scalable mechanisms for lookup of unique ID in peer-to-peer (P2P) systems have been found, scalability remains an issue for P2P keyword search. Therefore, a new solution, the SHARK algorithm, has been proposed. Constructing a symmetric redundant hierarchy of nodes and information objects allows for efficient query routing toward small semantic clusters of peers. To show this algorithm's applicability, a detailed specification of the SHARK protocol and a thorough evaluation of its performance is provided. In addition to proving the validity and technical feasibility of the algorithm, this forms the basis for large scale use in several P2P applications. While providing rich keyword search functionality, it is shown that SHARK can easily achieve four orders of magnitude scalability improvement over Gnutella-like networks, greatly outperforming approaches like expanding ring search or associative overlays.

Summary form only given. Due to the commercialization of the Internet its traffic as well as content being transmitted requires suitable mechanisms, which enable a service provider to charge for the traffic or content. This tutorial provides an overview of the key aspects, technology, and related work being essential for an effective and efficient approach to account for respective data, which may be used for the charging process. This includes on the technology side a discussion of accounting systems as well as on the economic side an overview of applicable pricing schemes. The problem of single- and multi-provider scenarios is addressed and an outlook on future areas of research and interest given.

The design of an extended and generic authentication, authorization, accounting, and charging architecture (AAAC Arch.) has been performed within the IST project MobyDick. In addition, this architecture has been implemented to address MobyDick's main objective: to facilitate the deployment of a ubiquitous mobile IPv6-based, quality-of-service (QoS)-aware infrastructure through a flexible and evolutionary AAAC Architecture. While the AAAC Arch. is based on the DIAMETER protocol, basic concepts developed cover session and services models, user profiles to allow for user mobility and QoS-aware authorization. Based on those basic building blocks for the extended AAAC Arch., the implementation of user registration, service authorization, metering, accounting, charging, and auditing is discussed. The paper closes with the presentation of the two trial sites used and their testbeds.

We present a token-based accounting mechanism that alleviates the free riding problem in P2P networks. The approach is complemented by distributed pricing as a flexible and viable scheme to incite users to share valuable content and to efficiently balance requests among all peers based on economic decisions.

Charging of services in a distributed system will become more and more important for systems which are utilized commercially. Such an important distributed system exists in the form of a computational grid (CG), offering a variety of services on different layers to many users: academic and industrial ones. Although by itself a CG defines a research and operational problem area, the dedicated task of charging CG services, by definition a new grid service has to be considered crucial, once a large number of users share computational resources as well as services offered by a CG. The potential synergies for applying a similar concept to all layers and different types of services within a computational grid should be exploited. Safely assuming that the Internet will form the all-embracing communication technology in use in the near future, differentiated services architecture-based communication layer services will offer the potential to differentiate higher layer and distributed services of the CG.

While differentiated services (DiffServ) offer a suitable technology support for quality-of-service (QoS) in multi-service networks, there is a lack of appropriate and technically feasible pricing schemes which would mainly provide an incentive for customers to choose efficiently among various service classes. This paper presents the basics of an implementation of recent developments in the area of charging differentiated services, in detail an Internet charge calculation and accounting system (ICCAS), including its modular architecture, components, open interfaces and databases. Finally, the explicit application of the newly developed cumulus pricing scheme (CPS) onto the ICCAS and DiffServ is discussed as a suitable example use.

This paper presents a novel mechanism that enables scalable service deployment over programmable heterogeneous networks. For ease of service deployment, it is expected that network management tools will require the network itself to participate in this task so as to be able to scale to very large number of network elements, with widely varying programmability levels. The type of services considered is very broad, ranging from routing services involving only selected nodes of a network to end-to-end services spanning the entire network. Successive steps of the mechanism to deploy new services into a network automatically are presented. The algorithmic structure of the mechanism described is then illustrated by several examples showing its applicability and complexity.

The design of tariff schemes for packet-based network services, especially for differentiated Internet services, has turned out to be a non-trivial task. This is mainly due to the issue of how to account for the immense number of individual packets. This paper proposes a paradigm shift and argues that the solution of this feasibility problem is not a matter of coping with complexity, but instead a question of multidimensional mappings of time-scales. The cumulus pricing scheme (CPS) as introduced and investigated here turns out to be a good example for the resulting simple, transparent, market-managed, and feasible Internet tariff schemes.

Since the Internet is on the move to provide differentiated services, for the backbone based on the differentiated services architecture (DiffServ), suitable management mechanisms are required. Scalable solutions for overload management are a must, such as economically-driven functions of charging and pricing. Future commercial networks need to offer as well a new view of pricing, considered as management information. Therefore, the Cumulus pricing scheme (CPS) explicitly proposed here for the DiffServ technology is the only approach known so far, which defines a clear relation between different time scales of measurement, accounting, and charging periods. The scheme is flexible enough to allow network management according to actual forces of the market. CPS's implementation is supported by a designed generic Internet charging system offering a service-independent architecture and integrating interchangeably economically-controlled network management functions of charge calculation and pricing. In particular, it has been applied to DiffServ and the new CPS.

Mobility of users in a future Internet has become a reality due to highly mobile end-systems. However, the new dimension of protocol functionality, Mobile IP, resource control, quality of service (QoS) support and AAA (authentication, authorization and accounting) features extended by charging schemes are still to be integrated effectively. Therefore, this position paper addresses these three areas of research concern, discusses basic concepts and outlines major problem fields still to be worked on.

The resource management for ASHMEN (ATM over Shared Media Networks) is concerned with Quality-of-Service (QoS) support and QoS provision in the local area networking environment in order to offer wide area ATM (Asynchronous Transfer Mode) services over shared media networks. Based on a prototypical implementation, including the design of a highly flexible resource management scheme, empirical values in terms of statistical QoS guarantees for delay and throughput have been investigated. The approach developed determines that in-advance performance assumptions can be maintained during the operation of ATM connections between an ATM backbone and ASHMEN-capable end systems attached to a shared media network via an Attachment Device.

Distributed multimedia applications require a variety of communication services. These services and different application requirements have to be provided and supported within: (1) end-systems in an efficient and integrated manner, combining the precise specification of quality-of-service (QoS) requirements, application interfaces, multicast support, and security features and (2) the network. The Da CaPo++ system presented in this paper provides an efficient end-system middleware for multimedia applications, capable of handling various types of applications in a modular fashion. Application needs and communication demands are specified by values in terms of QoS attributes and functional properties, such as encryption requirements or multicast support. Da CaPo++ automatically configures suitable communication protocols, provides for an efficient runtime support, and offers an easy-to-use, object-oriented application programming interface. While its applicability to real-life applications was shown by prototype implementations, performance evaluations have been carried out yielding practical experiences and numerical results.

The need for algorithms providing synchronization between audio and video data was driven by the advent of multimedia applications in distributed environments. Numerous algorithms have been proposed, but there is a lack of methodologies to assess these algorithms, to compare them and to determine the algorithm best suited for a given networking and end-system environment and application. In this paper a methodology to assess synchronization algorithms for distributed multimedia applications is presented. The methodology is based on four quality of service (QoS) parameters for synchronization comprising: asynchrony, synchronization error probability, synchronization delays, and buffer requirements. An analytical analysis of these parameters is performed. A key feature of this methodology, is that it parameterizes the network, the end-system, and the application. Thus, it allows for the assessment of any synchronization algorithm independent from the network and end-system. Influences of the infrastructure on synchronization can be determined by the proposed methodology.

With the advent of networked and distributed multimedia applications, requirements of middleware for providing advanced communication services changed. The needs in well suited architectures for delivering unchanged high network performance to multimedia applications and flexible communication services increased. In any case, applications have to access services of multimedia middleware and they are required to be programmed on top of these systems. Therefore, the developed application programming interface takes into account service specifications in terms of quality of service and an easy to use and intuitively programmable communication service for multimedia applications. This interface for advanced multimedia middleware hides away communication relevant information from applications and provides a minimal set of interface functions and operations.

In contrast to traditional one-to-one applications, distributed multimedia applications are based on communication scenarios that involve huge but often limited groups of participants. In general, tele-teaching and virtual reality scenarios require multicasting capabilities that have to deal with reliable data, e.g., simulation data, in addition to isochronous data, e.g., audio or video, that allow for losses depending an the compression technique or color tables. In particular, reliable control messages are needed for multicast signalling purposes. Existing networks have to be enhanced by integrating reliable multicast data transmission protocols to overcome this deficiency. The presented approach provides a network independent error-control scheme for a multicast protocol, offering a high stability in the local area, and an adaptable solution for metropolitan and wide area networks.

A framework containing a number of resources, languages, and tools for generating customized protocols that support diverse multimedia applications running on high-performance networks is described. The framework facilitates the configuration of application-tailored, function-based communication protocols that are automatically synthesized from high-level specifications.

A function-based communication model that allows applications to request individually tailored services from the communication subsystem is presented. Based on service requirements and available resources, suitable protocol machines are configured to serve the application. This configuration is done using a proper combination of functional modules. The concept of layering is therefore abandoned for both flexibility and efficiency reasons.>