Application Layer Traffic Optimization (ALTO) [5] [8] allows operators to guide the peer selection of P2P applications. Using ALTO, operators can reduce inter-domain transmission costs while at the same time P2P applications can improve their performance. Essentially, an ALTO server is a dedicated service (operated by a network operator or ISP) which can guide applications by providing network layer information about resource providers which applications cannot measure themselves. In this work, we study the effect of ALTO-guidance for P2P live streaming applications. In earlier work [6], we studied to what extent the amount of costly inter-ISP traffic can be reduced with ALTO while still fulfilling the stringent requirements of P2P live streaming. In this work we focus on how ALTO can be beneficial from an application/user perspective. We investigate in which scenarios and to what extent ALTO can reduce application-layer delay and chunk loss, thereby improving the perceived Quality-of-Experience (QoE) for users. Based on datasets that model the Internet's AS-level routing topology with high accuracy, we investigate different peer selection strategies to assess the effectiveness of ALTO-guidance in decreasing delay and chunk loss in P2P live streaming applications.

In this paper, we present a novel method to predict the long-term popularity of user-generated content (UGC). At first, the method clusters the dynamics of UGC popularity into a vocabulary of growth in popularity (sequence) by using a mixture model. Eventually, the method assigns to each sequence a topic model to describe the dynamics of the sequence in a compact way. We then use this topic model to identify similar patterns of growth in popularity of newly observed UGC. The proposed method has two key features: First, it considers the historical dynamics of the UGC popularity, and second it provides long-term popularity prediction. Results on the real dataset of UGC show that the proposed method is flexible, and able to accurately forecast the complete growth in popularity of a given UGC.

As the amount of data being exchanged over the network increases, algorithms originally implemented for running on a single machine have been re-designed to work in a distributed manner, with a processing platform that splits tasks among machines and cores. Brand new frameworks have emerged for the analysis of unbound streams of data, aiming at processing data and retrieving information nearly real-time by using clusters of machines. Node failure and recovery are crucial issues related to distributed systems, especially when using commodity hardware and when continuously processing data coming real- time into the system. In this paper we present the performance of the distributed stream-processing platform Blockmon, with the novel fault-tolerant mechanism that we implement on top, and compare it against Spark, the state-of-the art in terms of fault-tolerant stream-processing platform. Our experimental results suggest that Blockmon performs around two times faster than Spark, with a twenty times reduced memory footprint, showing the feasibility of using Blockmon on popular energy- efficient architectures such as the ARM ones.

To assess the performance of caching systems, the definition of a proper process describing the content requests generated by users is required. Starting from the analysis of traces of YouTube video requests collected inside operational networks, we identify the characteristics of real traffic that need to be represented and those that instead can be safely neglected. Based on our observations, we introduce a simple, parsimonious traffic model, named shot noise model (SNM), that allows us to capture temporal and geographical locality of content popularity. The SNM is sufficiently simple to be effectively employed in both analytical and scalable simulative studies of caching systems. We demonstrate this by analytically characterizing the performance of the LRU caching policy under the SNM, for both a single cache and a network of caches. With respect to the standard independent reference model (IRM), some paradigmatic shifts, concerning the impact of various traffic characteristics on cache performance, clearly emerge from our results.

Many network operators have recently started to deploy their own Content Delivery Networks (CDNs) within their administrative domain. Having a CDN deployed within an operator's network has the advantage of potentially placing caches very close to the end user, thereby increasing Quality of Service for the user, while at the same time saving delivery costs for the operator. However, if each network operator hosts its own CDN, there is a need for interconnection among individual CDNs. The standardization of such CDN Interconnection (CDNI) hence has recently started in the IETF and ETSI. In this context, we present the first prototype implementation and evaluation of CDNI request routing facilitated by means of Application Layer Traffic Optimization (ALTO). By advertising network layer topology costs as well as conveying aggregated load on cache clusters, ALTO can enable an upstream CDN to select the best downstream CDN for each content request it intends to redirect. Our experiments study how — by using ALTO — upstream CDN can achieve cost savings while also taking the overall load of the downstream CDN into account.

Content popularity prediction finds application in many areas, including media advertising, content caching, movie revenue estimation, traffic management and macro-economic trends forecasting, to name a few. However, predicting this popularity is difficult due to, among others, the effects of external phenomena, the influence of context such as locality and relevance to users,and the difficulty of forecasting information cascades.

In this paper we present a distributed mechanism based on Principal Component Analysis (PCA) to profile the behavior of the legitimate users in telephone networks. The idea is to take advantage of probes distributed over the network to obtain a compact snapshot of the users they serve. A collector node effectively combines such information to gather the description of the legitimate-user behavior. Eventually, it distributes the profile to the probes, which perform anomaly detection. Experimental results on several weeks of phone data collected by a telecom operator show that our profiling mechanism is stable over time and allows an operator to decentralize the anomaly detection stage directly to its probes. Furthermore, when compared to a centralized-PCA approach, our technique has the advantage of preventing the creation of polluted profiles, since it avoids that widespread anomalies, which are localized within one (or few) probes, enter into the description of the legitimate-user behavior.

Overload is a challenging problem for a SIP server because the built-in overload control mechanism based on generating rejection messages could not prevent the server from collapsing due to congestion. In this scenario, the paper presents an overload mechanism combining a local and a remote solution. The local part of the overload control mechanism is based on the appropriate queueing structure and buffer management of the SIP proxy. The remote overload control mechanism is based on feedback reports provided by the SIP proxy to the upstream neighbors. These reports permit the traffic regulation necessary to avoid the critical condition of overload. The main paper contributions are the design of key components of a remote control mechanism, the proposal of a new approach for dynamic load estimation, and the use of a prediction technique in the remote control loop.

Monitoring is crucial both to the correct operation of a network and to the services that run on it. Operators perform monitoring for various purposes, including traffic engineering, quality of service, security and detection of faults and mis-configurations. However, the relentless growth of IP traffic volume renders real-time monitoring and analysis of data a very challenging problem. In this paper we introduce Crosstalk, a scalable and efficient distributed monitoring architecture that uses cross-protocol correlation to detect network anomalies. While applicable to a wide range of applications such as botnet detection, spam mitigation and mis-configurations, we pick a point in this application space, concentrating on VoIP attacks. We present extensive simulation results based both on generated calls and on millions of Call Data Records (CDRs) from a large VoIP operator to show our approach's performance and effectiveness.

P2P-TV systems have become part of the Internet landscape (See for instance http://www.pplive.com, http://www.soapcast.com, http://www.tvants.com, and many others). The architecture of these (normally proprietary) applications is generally receiver-driven, in that receivers actively search for suitable peers to download from, trying to maximize their performance. This results in very aggressive applications that generate huge and non optimized traffic loads. The demo summarized in this short paper shows the impact of various P2P streaming options and the efficiency of the Napa-Wine approach (compared to more traditional approaches) by running real streaming clients in realistic conditions. To make this comparison possible, the software developed in Napa-Wine is highly modular and configurable, allowing the user to test different topology management and chunk trading techniques developed within the Napa-Wine project, as well as to configure it to mimic other chunk/peer selection strategies known from literature.

As other signaling protocols in the past, also SIP suffers of server overload leading to performance collapse. In this framework, recent Internet drafts propose the improvements of overload control mechanisms already presented in SIP and/or a closed loop system model for overload avoidance. In this framework, the paper presents the system simulator developed extending the network simulator (ns-2) with logical for local overload control. Furthermore, the paper proposes a new queueing discipline obtained combining the simple first in first out (FIFO) service discipline with the priority one. Then the paper presents a simulation analysis, aimed at evaluating the impact on system performance of different queueing structures, service disciplines, and buffer sizes. Simulation results clearly show that the proposed queueing discipline produces good system performance with a low complexity increase. Finally, the simulation results point out the weakness of the 503 service unavailable message mechanism, which does not introduce significant improvement when combined with the proposed solution.

The use of the Internet for VoIP communications has seen an important increase over the last few years, with the Session Initiation Protocol (SIP) as the most popular protocol used for signaling. Unfortunately, SIP devices are quite vulnerable to Denial-of-Service (DoS) attacks, many of them becoming unresponsive and even resetting with floods of only hundreds of packets per second. In this paper we introduce SIP Defender, a new distributed filtering architecture designed to protect SIP devices against large, flooding DoS attacks. In addition, we describe the implementation of the architecture's SIP Controllers, the network devices in charge of performing the actual filtering. We further present testbed performance figures for these, showing that a controller built on commodity hardware can forward an impressive 2.5 million packets per second for small SIP packets while applying one million filters as well as anti-spoofing mechanisms.

Voice-over-IP protocols (e.g., SIP) are vulnerable to many types of attacks. One core challenge in preventing VoIP attacks is to assess the trustworthiness of the caller's identity. Further, spoofing attacks must be prevented by verifying that the call has been initiated by the user belonging to the caller's identity. In this paper, we propose to adapt a Web-of-Trust model to real-time communication in order to assess the trustworthiness of incoming VoIP calls based on the social relationships among users. We present the design of a system which is capable of cryptographically verifying trust chains associated with VoIP users in real-time, i.e., with minimal overhead during the regular processing of signaling messages. We highlight the benefits of such a system as well as its limitations, discuss open issues, and finally present an evaluation of the proposed approach based on a prototypical implementation. Our results show that indeed real-time cryptographic verification of trust chains among users is feasible for VoIP communications.

Nowadays IPTV offers a very wide range of multimedia content. On one side the increasing number of channels improves the chances of each viewer finding relevant content; on the other side it poses serious challenges in the navigation through the program grid. Typically, once a program has been selected, the only way to know what is being broadcasted on another one is by switching the channel. This paper proposes, discusses, and shows a prototype implementation of an innovative IPTV feature called Real-Time Meta-Data (RTMD) for automated recommendations. It provides IPTV systems with simple user-specific live event notification based on user profiles and only for subscribed channels. Event notifications can be automatically associated in the IPTV client with specific class of event reactions (e.g. channel switch) to enhance the IPTV user experience. Furthermore, rather than merely delivering channel-related information (e.g. a goal in a soccer match), this technology is also designed to provide additional services such as user-to-user or community notifications. In order to assess the feasibility of the approach, a small scale proof-of-concept prototype has been implemented. Subsequently, a validation in terms of both integration with existing standards and technical performance has been realized, fulfilling the initial expectations.

The market growth of VoIP infrastructures and services is pushing towards additional facilities to enrich service offer in an open way, thus representing also a differentiating aspect and a competitive advantage for service providers. We claim that the proactive provisioning of estimations about runtime VoIP quality is a crucial facility still missing in VoIP services. For instance, such a facility could be integrated within a Presence Service to inform users of expected quality of VoIP communications towards their contacts before calling them. The paper proposes a novel and scalable solution for proactive quality monitoring, specifically designed for VoIP traffic and based on proper runtime decisions about network partitioning. On top of this monitoring layer, we have designed and implemented an effective and flexible application-level facility for end-to-end QoS estimation. This facility is exploited by an enriched Presence Service in the examined case study. The paper describes the practical experience and the lessons learned in implementing an industrial prototype of the proposal. The prototype is integrated with standard and widespread mechanisms (e.g., SIP Voice Quality Report Event, SIP Answer Mode and SDP Media Loop- back extensions) to facilitate market diffusion and acceptance. First preliminary experimental results show that the proposed prototype achieves accurate quality evaluations and is largely more scalable than traditional end-to-end approaches.

A future where Internet telephony will constitute a target valuable to attack is not so unrealistic. E-mail spam botnets software can be updated to send voice spam (commonly referred to as SPIT, spam over Internet telephony) constituting a huge threat to VoIP-based applications and business. This paper tries to learn from one of the biggest lessons learnt from the e-mail world, i.e. "do not wait until is too late", and proposes a quantitative study, based on a simulation campaign, of SPIT filtering based on the analysis of the call setup protocols. After discussing attack scenarios based on dichotomic choices by the attacker, it presents how the SPIT filtering system can be optimized in order to self-tune parameters achieving high SPIT detection ratio and low false rates at the same time.

Voice-over-IP (VoIP) is a key component of next-generation-networks and rapidly becoming more and more common in the Internet in general. This also increases the demand of VoIP operators for a scalable, distributed and flexible monitoring. But current monitoring architectures are either not designed for including application layer protocol analysis and data acquisition, or they are very specific and static, interacting directly with a certain VoIP product and are not integrated into the general network monitoring. Fully based on the new standards of the IP flow information exchange (IPFIX) and the concept of Mediators we specify a monitoring scheme for the session-initiation-protocol (SIP), the most common protocol used for VoIP. Therefore it integrates the acquisition and processing of VoIP traffic measurements into the general traffic monitoring, building a cost-effective cross-layer monitoring system. In use case examples we show how SIPFIX can cope with many challenges and requirements of SIP monitoring, like correlation of SIP and media traffic observed at different probes, Quality- of-Service evaluation, security and integrity checks, Denial-of- Service defense and real-time status reports.

The use of the Internet as a medium for real-time communications has grown significantly over the past few years. However, the best-effort model of this network is not particularly well-suited to the demands of users who are familiar with the reliability, quality and security of the public switched telephone network. If the growth is to continue, monitoring and real time analysis of communication data will be needed in order to ensure good call quality, and should degradation occur, to take corrective action. Writing this type of monitoring application is difficult and time consuming: VoIP traffic not only tends to use dynamic ports, but its real-time nature, along with the fact that its packets tend to be small, impose non-trivial performance requirements. In this paper we present RTC-Mon, the real-time communications monitoring framework, which provides an extensible platform for the quick development of high-speed, real-time monitoring applications. While the focus is on VoIP traffic, the framework is general and is capable of monitoring any type of real-time communications traffic. We present testbed performance results for the various components of RTC-Mon, showing that it can monitor a large number of concurrent flows without losing packets. In addition, we implemented a proof-of-concept application that can not only track statistics about a large number of calls and their users, but that consists of only 800 lines of code, showing that the framework is efficient and that it also significantly reduces development time.

Recently, establishing a VoIP call using a P2P network instead of regular SIP-servers has been proposed; this novel approach to SIP-signaling is commonly referred to as P2PSIP and technically based on a Distributed Hash Table (DHT). P2P networks are advantageous with respect to reliability and scalability. However, securing DHTs against adversary nodes which intentionally interrupt functionality of the network remains a major research problem. In particular, even if a trusted enrollment server is used for secure identifier assignment of participating nodes, attacks on overlay routing by malicious nodes that have successfully joined the network can still severely degrade the lookup service of the DHT. To gain insight into the ability of callers to reach callees during such attacks on DHT-routing, we present the first P2PSIP implementation that enables to emulate adversary nodes as well as the injection of a large amount of lookup requests (i.e., SIP- Invite requests) in an automated way. Further, we implemented several secure DHT routing algorithms and investigated their effect on the success rate of lookups and the maximum call-setup time in an infiltrated P2PSIP network. In general, our system provides the ability to analyze attacker behavior as well as future novel security techniques in an actual P2PSIP environment with comparably low effort.

In recent times, SIP-based communication systems have become more and more popular (e.g., in open networks, NGN, IMS, etc.). With continuously dropping cost for the usage of such systems (e.g., VoIP, IM, IPTV), many researchers anticipate the amount of unsolicited communication within the network to reach an alarming high level in the near future. Thus, protection of such systems is needed to counter this threat. We present a holistic protection framework for SIP based infrastructures and describe the most recent enhancements of the system.

In this paper we discuss a methodology for performance evaluation of the solutions for vertical handovers between different wireless access technologies in IP network. The performance evaluation is based on simple analytical models and covers both the ideal case (no packet loss) and the real case where there is a given packet loss rate. The methodology is applied to a comparison among three solutions, namely MIPv4, classical SIP mobility management using re-INVITE messages and a SIP based solution called MMUSE (Mobility Management Using SIP Extensions) proposed by the authors.

Detecting SPam over Internet telephony (SPIT) and preventing users from it is a raising concern in the research community. At the time of writing some solutions have been already proposed but, to the authors' best knowledge, no extensive study of prevention effectiveness has been published. This paper presents a modular simulator which was built in order to test SPIT prevention systems' effectiveness that is specifically tailored to deal with upcoming SPIT threat and takes into account VoIP and SPIT-specific configurations and parameters. Making use of the developed simulator, the paper also presents a preliminary study on how the single modules can be optimized by means of the simulator and how multiple detection mechanisms can cooperate in order to achieve higher detection accuracy. Moreover the paper provides effectiveness results showing how the modular approach is the most promising for dealing with the SPIT threat.

SPam over Internet Telephony (SPIT) is expected to become a very serious issue in the next years. The threat is going to spin out from the well known email spam problem by bot nets being re-programmed to initiate not just spam emails but also Voice over IP (VoIP) calls. Preventing SPIT is a new problem, because many well-established methods for blocking email spam cannot be applied. Currently, several SPIT prevention methods are being proposed but SPIT prevention research is still at a very early stage. In this paper, we propose an innovative way to detect SPIT calls by comparing applying hidden Turing tests that compare them with typical human communication patterns. For passing these tests, significant resource consumptions at the SPIT generating bot nets would be required which contradicts the spammer's objective of placing as many SPIT calls as possible, The proposed method has several advantages compared to other methods that also interact with the caller. We validated its feasibility with a prototype implementation that we integrated into our modular VoIP security system called VoIP SEAL.

Most Internet telephony applications currently use either TCP or UDP to carry their voice-over-IP (VoIP) traffic. This choice can be problematic, because TCP is not well suited for interactive traffic and UDP is unresponsive to congestion. The IETF has recently standardized the new Datagram Congestion Control Protocol (DCCP). DCCP has been designed to carry media traffic and is congestion-controlled. This paper experimentally evaluates the voice quality that Internet telephony calls achieve over prototype implementations of basic DCCP and several DCCP variants, under different network conditions and with different codecs. It finds that the currently-specified DCCP variants perform less well than expected when compared to UDP and TCP. Based on an analysis of these results, the paper suggests several improvements to DCCP and experimentally validates that a prototype implementation of these modifications can significantly increase voice quality.

In operational networks, services are delivered according to specific service level agreements (SLAs). To ensure the SLAs stipulated with the users, providers make use of traffic monitoring and measurement tools controlling their highspeed IP networks. In order to improve the scalability of the measurement systems, techniques which allow to reduce the total amount of data to be collected and processed are currently being standardized in the IETF packet sampling (PSAMP) Working Group. Among packet sampling techniques, hash-based one is the only capable of providing a feasible framework to monitor one-way delays (OWDs). This paper is focused on the experimental validation of SLAs conformance in operational networks using hash-based packet sampling techniques. The results presented hereafter are obtained from the analysis of traffic traces collected at two different points of operational networks. Such results are fundamental to validate the whole hash-based packet sampling framework, because they complement the already available results on the uniformity of distribution, computation speed and statistical properties of the hash functions calculated by using single point traces.

SPam over Internet telephony (SPIT) is expected to become a threat inhibiting the delivery of voice services over the Internet in the near future both because of its technical and economical characteristics. Experiences with email SPAM and its analogies with SPIT suggest that SPIT will be difficult to detect with a single detection method. Moreover, personalized management of detection strategies will be needed to increase effectiveness and to adapt the methods to special environments. This paper presents a modular framework for SPIT prevention designed to be easily manageable and extensible. Additionally, the framework makes use of a two-stage architecture in order to exploit the knowledge coming both from the signaling and from the media flows while still allowing real-time delivery of the media content to the user. Following the experience gained with our prototype implementation we also present the most important design issues we encountered and suggest solutions to these issues.

A lot of network management applications rely on the measurement of the delay experienced by packets between two observation points (one way delay). In this paper we describe an implementation of a passive OWD measurement system composed of a set of synchronized measurement points that observe selected packets and report transit timestamps to a collector station. Measurement points can be standalone probes or be embedded in routers. We first describe the system design and then focus on the implementation issues of the two building blocks of the system, the measurement points and the one way delay data collector.