Recent research on Internet traffic classification algorithms has yield a flurry of proposed approaches for distinguishing types of traffic, but no systematic comparison of the various algorithms. This fragmented approach to traffic classification research leaves the operational community with no basis for consensus on what approach to use when, and how to interpret results. In this work we critically revisit traffic classification by conducting a thorough evaluation of three classification approaches, based on transport layer ports, host behavior, and flow features. A strength of our work is the broad range of data against which we test the three classification approaches: seven traces with payload collected in Japan, Korea, and the US. The diverse geographic locations, link characteristics and application traffic mix in these data allowed us to evaluate the approaches under a wide variety of conditions. We analyze the advantages and limitations of each approach, evaluate methods to overcome the limitations, and extract insights and recommendations for both the study and practical application of traffic classification. We make our software, classifiers, and data available for researchers interested in validating or extending this work.

Spelling errors when typing a URL can be exploited by website-squatters: users are led to phony sites in a phenomenon we call parasitic URL naming. These phony sites imitate popular websites and try to extract personal information from unsuspecting users, or simply advertise and sell products to users. In this paper, we conduct a massive study in order to quantify the extent of this parasitic URL naming We start with a corpus of 900 popular websites, which we refer to as original URLs, and generate roughly 3 million URLs by varying the original names systematically and exhaustively. Over a period of 60 days, we analyze how many sites have URLs very similar to our original URLs. We find that parasitic URL naming is a wide-spread problem and quantify the extent of this issue. We believe that this work will provide the first step towards research and tools to combat web-fraud.

YouTube like media portals have changed the way users access media content in the Internet. Among many popular media sharing websites, some of the most popular ones are YouTube [7], Google-Video [4], Yahoo-Video [6], Metacafe [5], Flickr [3] and BlipTV [1]. Two factors along with the ubiquity of the Web have bolstered tremendous growth of these sites, namely, availability and media quality.

Dimension attributes in data warehouses are typically hierarchical, and a variety of OLAP applications (such as point-of-sales analysis and decision support) call for summarizing the measure attributes in fact tables along the hierarchies of these attributes. For example, the total sales at different stores can be summarized hierarchically by geographic location (e.g., state/city/zip_code/store), by time (e.g., year/month/day/hour), or by product category (e.g., clothing/outerwear/jackets/brand). Existing OLAP tools help to summarize and navigate the data at different levels of aggregation (e.g., jackets sold in each state during December 2006) via drill-down and roll-up operators. OLAP tools are also used to characterize changes in these hierarchical summaries over time (e.g., the sales in December 2006 compared to sales in December 2005 over different locations) to detect anomalies and characterize trends. When the number of changes identified is large (e.g., the total sales at many locations differed significantly from their expectations), one seeks explanations. In this paper, we are interested in parsimonious explanations of changes in measure attributes aggregated along an associated dimension attribute hierarchy. We propose a natural model of explanation that makes effective use of the dimension hierarchy and describes changes at the leaf nodes of the hierarchy (e.g., individual stores in the location hierarchy) as a composition of "node weights" along each node's root-to-leaf path in the dimension hierarchy; each node weight constitutes an explanatory term. For example, sales in California stores were three times expected sales; sales in San Jose stores were higher by a factor of two (six times expected sales), whereas sales in Los Angeles stores were lower than the statewide increase by a factor of 1.5 (two times expected sales).

Dimension attributes in data warehouses are typically hierarchical (e.g., geographic locations in sales data, URLs in Web traffic logs). OLAP tools are used to summarize the measure attributes (e.g., total sales) along a dimension hierarchy, and to characterize changes (e.g., trends and anomalies) in a hierarchical summary over time. When thenumber of changes identified is large (e.g., total sales in many stores differed from their expected values), a parsimonious explanation of the most significant changes is desirable. In this paper, we propose a natural model of parsimonious explanation, as a composition of node weights along the root-to-leaf paths in a dimension hierarchy, which permits changes to be aggregated with maximal generalization along the dimension hierarchy. We formalize this model of explaining changes in hierarchical summaries and investigate the problem of identifying optimally parsimonious explanations on arbitrary rooted one dimensional tree hierarchies. We show that such explanations can be computed efficiently in time essentially proportional to the number of leaves and the depth of the hierarchy. Further, our method can produce parsimonious explanations from the output of any statistical model that provides predictions and confidence intervals, making it widely applicable. Our experiments use real data sets to demonstrate the utility and robustness of our proposed model for explaining significant changes, as well as its superior parsimony compared to alternatives.

We found a formula for aggregate throughput of arbitrarily given number of competing additive-increase, multiplicative-decrease connections (TCP congestion avoidance mode) for a bottleneck, under assumption that loss events over connections are non synchronized. The formula captures throughput-deficiency due to the additive-increase and multiplicative-decrease adaptation. The formula suggests that already a few connections are sufficient to almost entirely eliminate this throughput deficiency. The result reveals the aggregate throughput insensitivity on the way losses are assigned over competing connections over time, for any given number of competing connections. The result is validated by simulations and Internet measurements. The latter validates the model in cases when analysis assumptions are met, but also encounters cases of the throughput deficiency due to synchronization of loss events and the receiver window constraint. The results would inform on the throughput efficiency of parallel TCP transfers, an approach used widely for bulk data transfer.

We study the effect of the IP router buffer size on the throughput of HighSpeed TCP (HSTCP). We are motivated by the fact that, in high speed routers, the buffer size is important, as a large buffer size might be a constraint. We first derive an analytical model for HighSpeed TCP and we show that for a small buffer size, equal to 10% of the bandwidth-delay product, HighSpeed TCP can achieve more than 90% of the bottleneck capacity. We also show that setting the buffer size equal to 20% can increase the utilization of HighSpeed TCP up to 98%. On the contrary, setting the buffer size to less than 10% of the bandwidth-delay product can decrease HighSpeed TCP's throughput significantly. We also study the performance effects under both DropTail and RED AQM (active queue management). Analytical results obtained using a fixed-point approach are compared to those obtained by simulation.

This paper studies distributed choice of retransmission probabilities in slotted ALOHA. Both the cooperative team problem as well as the noncooperative game problem is considered. In previous work that has focused on the maximization of throughput, it was shown that in heavy load, this maximization is obtained at the cost of a huge delay of backlogged packets. This motivates us to investigate the delay minimization problem as well as the multicriterion problem of minimizing the average expected delay (or maximizing the throughput) subject to constraints on the expected delay of backlogged packets. A Markov chain analysis is used to obtain optimal and equilibrium retransmission probabilities and expected delays analysis.

The current congestion-oriented design of TCP hinders its ability to perform well in hybrid wireless/wired networks. We propose a new improvement on TCP NewReno (NewReno-FF) using a new loss labeling technique to discriminate wireless from congestion losses. The proposed technique is based on the estimation of average and variance of the round trip time using a filter, called flip flop filter, that is augmented with history information. We show the comparative performance of TCP NewReno, NewReno-FF and TCP Westwood through extensive simulations. We study the fundamental gains and limits using TCP NewReno with varying loss labeling accuracy (NewReno-LL) as a benchmark. Lastly our investigation opens up important research directions. First, there is a need for a finer grained classification of losses (even within congestion and wireless losses) for TCP in heterogeneous networks. Second, it is essential to develop an appropriate control strategy for recovery after the correct classification of a packet loss.