Network security has been a significant concern in recent years. Due to the rising number and complexity of cyber-attacks, Machine Learning (ML) models have been proposed to enhance intrusion detection. However, training these models requires extensive data, which is challenging to collect. To tackle this issue, previous work has focused on the generation of synthetic network traffic data using generative neural networks. Considering network traffic as a sequence of packets that contains continuous, discrete, and binary features, we propose a novel approach to learn a discrete representation of network traffic using Vector-Quantized Variational Autoencoders (VQ-VAE). In this paper, we adapt this model to learn how to represent network flows as a sequence of discrete tokens, called NetGlyphs. We evaluate the model on a dataset of Command & Control flows and compare performances to another model that uses a continuous representation. We show that our model is able to, reconstruct the data accurately and better preserve the original distribution. We also find promising results on network traffic generation using a state-of-the-art Transformer model to generate new NetGlyphs sequences that can be decoded back into real network traffic.

5G is a new key technology for future communication networks. It aims at providing a broad range of new services and capabilities for users as well as facilitating its management for network operators (NetOps). Whereas networks still have monolithic architectures, 5G design takes advantage of softwarization and virtualization of its functionalities, for this purpose. However, 5G is also raising a lot of critics, especially related to its energy consumption. This paper then deals with assessing the energetic cost of the future softwarized 5G facilities. To this aim, an experimental platform has been setup taking advantage of the software 5G OpenAirlnterface (OAI) implementation. This paper shows the complexity of designing energy consumption measurement tools. It then exhibits the level of energy consumption of the main 5G components, pointing out the ones that need to be optimized.

Machine learning (ML) is a promising technology for network intrusion detection systems. There is a wide range of ML algorithms that are potential candidates for network intrusion detection systems, as they exhibit very good detection accuracy in average. However, significant detection differences appear when facing different kinds of attacks, some being prone to better detect some particular attack types. They then often appear to complement each other. The challenge then lies in determining the accurate result when several ML models provide different results, and this without any explanation about their decision. To address this challenge, our system aims to reconstruct attack patterns from the outputs of these ML models and presenting them in an interpretable manner. For that, we propose an approach combining ensemble learning and stacking with a meta-learner that works on graphical representation of traffic flows, that then provides the required explainability level for the decisions made. The evaluation of our system, using the CSE-CIC-IDS2018 dataset, demonstrates a significant improvement achieved through the combination of multiple ML algorithms. Furthermore, we emphasize the importance of explainability in network intrusion detection systems and the need for accurate and interpretable models. Our system goes beyond traditional detection methods by reporting anomalous feature pairs and providing visual representations of attack patterns, empowering analysts to better understand and respond to network threats.

A significant research effort in cybersecurity currently deals with Machine Learning-based attack detection. It is aimed at providing autonomous attack detection systems that require less human expert resources, and are then less expensive in time and money. Indeed, such systems are able to autonomously learn about benign and malicious traffic, and to classify further traffic samples accordingly. In such context, hackers start designing adversarial learning approaches in order to design new attacks able to evade from the Machine Learningbased detection systems. The work presented in this paper aims at exhibiting how easy it is to modify existing attacks to make them evade from the Machine Learning-based attack detectors. The Random Forest algorithm has been selected for this work as it is globally evaluated as one of the best Machine Learning algorithm for cybersecurity, and it provides informations on how a decision is made. Indeed, the analysis of the related Random Forest trees helps explaining the limits of this Machine Learning algorithm, and gives some information that could be helpful for making attack detection somewhat explainable. Several other Machine Learning algorithms as SVM, kNN ans LSTM have been selected for evaluating their ability to detect the adversarial attack presented in this paper.

In cellular networks, the emergence of machine communications such as connected vehicles increases the high demand of uplink transmissions, thus, degrading the quality of service per user equipment. Enforcing quality-of-service in such cellular network is challenging, as radio phenomena, as well as user (and their devices) mobility and dynamics, are uncontrolled. To solve this issue, estimating what the quality of transmissions will be in a short future for a connected user is essential. For that purpose, we argue that lower layer metrics are a key feature whose evolution can help predict the bandwidth that the considered connections can take advantage of in the following hundreds of milliseconds. The paper then describes how a 4G testbed has been deployed in order to investigate throughput prediction in uplink transmissions at a small time granularity of 100 ms. Based on lower layer metrics (physical and mac layers), the main supervised machine learning algorithms are used, such as Linear Regressor and Random Forest to predict the uplink received bandwidth in different radio phenomena environment. Hence, a deep investigation of the impact of radio issues on bandwidth prediction is conducted. Further, our evaluation shows that the prediction is highly accurate: at the time granularity of 100 ms, the average prediction error is in the range of 6% to 12% for all the scenarios we explored.

The rising interest in Intelligent Transportation Systems shines light on a complex task: The evaluation of new applications and services that could prevent accident, regulate traffic, and help the automotive industry in designing energy efficient vehicles. These applications will rely on a new communication channel between vehicles, infrastructure and cloud services, and will have to operate under various network performances. However, testing applications and services in real-life networks is costly and reproducing network behaviour in a controlled environment is challenging. Furthermore, simulation tools lack real-time evaluation capabilities. Therefore, we present in this paper an environment for the real-time emulation of cellular vehicular communications. It allows the user to rapidly and cost efficiently implement and test applications under realistic mobile network performances.

Software-defined Internet eXchange points (SDXs) are a promising solution to the long-standing limitations and problems of interdomain routing. While the proposed SDX architectures have improved the scalability of the control plane, these solutions have ignored the underlying fabric upon which they should be deployed. In this paper, we present Umbrella, a software-defined interconnection fabric that complements and enhances those architectures. Umbrella is a switching fabric architecture and management approach that improves the overall robustness, limiting control plane dependence, and suitable for the topology of any existing Internet eXchange Point (IXP). We validate Umbrella through a real-world deployment on two production IXPs, TouSIX and NSPIXP-3, and demonstrate its use in practice, sharing our experience of the challenges faced.

Despite the efforts made from both the research community and the industry in inventing new methods to deal with distributed denial of service attacks, they stay a major threat in the Internet network. Those attacks are numerous, and can prevent, in most serious cases, the targeted system from answering any request from its clients. Detecting such attacks means dealing with several difficulties, such as their distributed nature or the several evasions techniques available to the attackers. The detection process has also a cost, which includes both the resources needed to perform the detection and the work of the network administrator. In this paper we introduce AATAC (Autonomous Algorithm for Traffic Anomaly Detection), an unsupervised DDoS detector that focuses on reducing the computational resources needed to process the traffic. It models the traffic using a set of regularly created snapshots. Each new snapshot is compared to this model using a k-NN based measure to detect significant deviations toward the usual traffic profile. Those snapshots are also used to provide the network administrator with an explicit and dynamic view of the traffic when an anomaly occurs. Our evaluation shows that AATAC is able to efficiently process real traces with low computational resources requirements, while achieving an efficient detection producing a low number of false-positives.

Network simulators are often used for their simplicity and cost regarding wireless networks. However, their realism is often criticized and their results challenged. The main concern comes from the modeling of the PHY and MAC layers. To assess the performances of these simulators and their models, the results of simulations are often compared with experimental results. However, the comparison methodologies used in these studies may introduce biases. This work focuses on accurately discovering and analyzing the reasons for the calibration problems or implementation bugs in simulators and experimental devices. For this purpose, we leverage the famous Root Cause Analysis (RCA) technique for comparing traces issued from different simulations and real experiments, that includes the study of the root causes of dissimilarities. Throughout the paper, our RCA-based method has been applied to detect and analyze a performance anomaly between NS-3 simulation and our lab wireless testbed when transmitting data over a WIFI 802.11 link. It especially details how low level traffic traces have been generated in both environments for similar scenarios, and how they can accurately be compared and their differences analyzed.

Innovation in interdomain routing has remained stagnant for over a decade. Recently, Internet eXchange Points (IXPs) have emerged as economically-advantageous interconnection points for reducing path latencies and exchanging ever increasing traffic volumes among, possibly, hundreds of networks. Given their far-reaching implications on interdomain routing, IXPs are the ideal place to foster network innovation and extend the benefits of software defined networking (SDN) to the interdomain level. In this paper, we present, evaluate, and demonstrate ENDEAVOUR, an SDN platform for IXPs. ENDEAVOUR can be deployed on a multi-hop IXP fabric, supports a large number of use cases, and is highly scalable, while avoiding broadcast storms. Our evaluation with real data from one of the largest IXPs, demonstrates the benefits and scalability of our solution: ENDEAVOUR requires around 70% fewer rules than alternative SDN solutions thanks to our rule partitioning mechanism. In addition, by providing an open source solution, we invite everyone from the community to experiment (and improve) our implementation as well as adapt it to new use cases.

Nowadays, network intrusion detectors mainly rely on knowledge databases to detect suspicious traffic. These databases have to be continuously updated which requires important human resources and time. Unsupervised network anomaly detectors overcome this issue by using “intelligent” techniques to identify anomalies without any prior knowledge. However, these systems are often very complex as they need to explore the network traffic to identify flows patterns. Therefore, they are often unable to meet real-time requirements. In this paper, we present a new online and real-time unsupervised network anomaly detection algorithm (ORUNADA). Our solution relies on a discrete time-sliding window to update continuously the feature space and an incremental grid clustering to detect rapidly the anomalies. The evaluations showed that ORUNADA can process online large network traffic while ensuring a low detection delay and good detection performance. The experiments performed on the traffic of a core network of a Spanish intermediate Internet service provider demonstrated that ORUNADA detects in less than half a second an anomaly after its occurrence. Furthermore, the results highlight that our solution outperforms in terms of true positive rate and false positive rate existing techniques reported in the literature.

The Internet eXchange Points (IXP) are essential for the Internet evolution as they empower high bandwidth low latency and inexpensive local traffic peering as opposed to transit traffic. On the other side, Software Defined Networking, or SDN for short (and its pre-dominant realization, the OpenFlow protocol) enables more dynamic network programmability to control network behaviour via open interfaces, as opposed to the legacy closed-box solutions and proprietary-defined interfaces. This paper then reports the work that has been done to migrate the TouIX IXP located in Toulouse (France) from a traditional to a full OpenFlow IXP. It especially describes how switches have been selected, configured and installed, and presents the management tools that have been developed, together with performance and service measurements and evaluations. To the best of our knowledge, from may 2015, TouSIX (the SDN evolution of TouIX) is the first Internet Exchange Provider in Europe to fully leverage OpenFlow for its day-to-day operations.

Cloud and network analytics can harness the immense stream of operational data from clouds and networks, and can perform analytics processing to improve reliability, configuration, performance, and security management. In particular, we see a growing trend towards using statistical analysis and machine learning to improve operations and management of IT systems and networks.

Monitoring communication networks and their traffic is of essential importance for estimating the risk in the Internet, and therefore designing suited protection systems for computer networks. Network and traffic analysis can be done thanks to measurement devices or honeypots. However, analyzing the huge amount of gathered data, and characterizing the anomalies and attacks contained in these traces remain complex and time consuming tasks, done by network and security experts using poorly automatized tools, and are consequently slow and costly. In this paper, we present an unsupervised algorithm - called UNADA for Unsupervised Network Anomaly Detection Algorithm - for identification and characterization of security related anomalies and attacks occurring in honeypots. This automatized method does not need any attack signature database, learning phase, or labeled traffic. This corresponds to a major step towards autonomous security systems. This paper also shows how it is possible from anomalies characterization results to infer filtering rules that could serve for automatically configuring network routers, switches or firewalls. The performances of UNADA in terms of attacks identification accuracy are evaluated using honeypot traffic traces gathered on the honeypot network of the University of Maryland. The time latency for producing such accurate results are also presented, especially showing how the parallelization capabilities of the algorithm help reducing this latency.

The heterogeneity barrier breakthrough achieved by the OpenFlow protocol is currently paced by the variability in performance semantics among network devices, which reduces the ability of applications to take complete advantage of programmable control. As a result, control applications remain conservative on performance requirements in order to be generalizable and trade performance for explicit state consistency in order to support varying performance behaviours. In this paper we argue that network control must be optimized towards network device capabilities and network managers and application developers must perform informed design decision using accurate switch performance profiles. This becomes highly critical for modern OpenFlow-enabled 10 GbE optical switches which significantly elevate switch performance requirements. We present OFLOPS-Turbo, the integration of the OFLOPS switch evaluation platform, with the OSNT platform, a hardware-accelerated traffic generation and capture system supporting lossless 10 GbE functionality. Using OFLOPS-Turbo, we conduct an evaluation of flow table manipulation capabilities in a representative collection of 10 GbE production OpenFlow switch devices and interpret the evolution of OpenFlow support by comparison with historical data.

Traditional Network Intrusion Detection Systems (NIDSs) rely on either specialized signatures of previously seen attacks, or on expensive and difficult to produce labeled traffic datasets for profiling and training. Both approaches share a common downside: they require the knowledge provided by an external agent, either in terms of signatures or as normal-operation profiles. In this paper we describe UNIDS, an Unsupervised NIDS capable of detecting 0-day attacks, i.e., network attacks for which no signature is yet available, without using any kind of signatures, labeled traffic, or training. UNIDS uses a novel unsupervised outliers detection approach based on Sub-Space Clustering and Multiple Evidence Accumulation techniques to pin-point different kinds of network intrusions and attacks such as DoS/DDoS, probing attacks, propagation of worms, buffer overflows, illegal access to network resources, etc. In this paper we make the strong point that the de-facto approach for NIDS, namely the application of rule-based detection techniques, can be highly harmful for the protected network in case of 0-day attacks. In contrast, we show how UNIDS can work as a complementary system to current NIDS to detect the occurrence of previously unseen attacks. For doing so, we compare the performance of a standard rule-based NIDS against UNIDS to detect 0-day attacks in the well-known KDD99 dataset. In addition, we also compare the performance of UNIDS against other popular unsupervised detection techniques to detect attacks in traces collected at two operation networks.

To make networks more reliable, enormous resources are poured into all phases of the network-equipment lifecycle. The process starts early in the design phase when simulation is used to verify the correctness of a design, and continues through manufacturing and perhaps months of rigorously trials. With over 7,000 Internet RFCs and hundreds of IEEE standards, a typical piece of networking equipment undergoes hundreds of conformance tests before being deployed. Finally, when deployed in a production network, the equipment is tested regularly. Throughout the process, a relentless battery of tests and measurement help ensure the correct operation of the equipment.

The last decade has seen an increasing interest for wireless communications. With the current use of smart-phones and tablets, together with the rise of the Internet of Things, the number of mobile nodes in networks is significantly changing the way they are managed. Indeed, these wireless networks are highly dynamic, mainly, regarding topology and traffic matrices. The high dynamism of mobile nodes can for instance impact the connectivity of the network, or the role of the nodes in the routing graph. Given this increasing complexity, network's service management requires to be as autonomous as possible. However, autonomy can not be achieved unless the network is able to assess and understand its own behavior. In this paper, we propose an assessment index (SA) based on nodes' satisfaction and its self-estimation algorithm for wireless mobile networks.We then provide events' collection and distributed mining methods allowing nodes to analyze the evolution of this index.We illustrate our framework and characterize the estimation error for various network properties under NS3 simulations.

Driven by the well-known limitations of port and payload-based analysis techniques, the use of Machine Learning for Internet traffic analysis and classification has become a fertile research area during the past half-decade. In this paper we introduce a novel unsupervised approach to identify different classes of IP flows sharing similar characteristics. The unsupervised analysis is accomplished by means of robust clustering techniques, using Sub-Space Clustering, Evidence Accumulation, and Hierarchical Clustering algorithms to explore inter-flows structure. Our approach permits to identify natural groupings of traffic flows, combining the evidence of data structure provided by different partitions of the same set of traffic flows. The technique is further used to build an automatic flow classification model, using a semi-supervised-learning-based approach. The approach uses only a reduced fraction of labeled flows to map the identified clusters into their associated most-probable originating application, which strongly simplifies its calibration. We evaluate the performance of our techniques using real traffic traces, additionally comparing their performance against previously proposed clustering-based classification methods.

In this paper we propose dVirt, a distributed virtualized infrastructure enabling network operators to better grasp the routing mechanisms and anticipate network behavior. dVirt offers an emulated layer 2 connectivity that allows accurate simulation of IP routing and protocol dynamics. Using virtualization and Quagga routing software, we achieve scalable simulations while keeping a realistic model of the routing layer. To illustrate the benefits of simulating networks with dVirt, we study a well-known simple Border Gateway Protocol (BGP) topology subject to routing oscillations. dVirt allows for quick deployment of this topology and easy monitoring of BGP message exchanges.

The race for innovation is driving Internet evolution. Internet software developers have to create more complex systems while enduring the pressuring time to market. Therefore, end-host software have bugs, vulnerabilities and cannot be trusted. That's why, among others, network Intrusion Detection System (IDS), Intrusion Prevention System (IPS), firewall or other network devices monitor such software to prevent unexpected behaviors. However, their functionalities are limited by design, because they can only handle a configuration of predefined monolithic protocol layerings. In this paper we present Luth, a midpoint inspection device that relies on the composition and parallelization of predefined midpoint inspectors (MI). We present the main functionalities offered by its configuration language and interpreter. Finally, we benchmark a prototype implemented in OCaml. This prototype runs in the user space of a GNU/Linux operating system, by means of the libnet filter_queue library. We show how it efficiently inspects and filters DNS hidden-channels encapsulated into 20 GRE tunnels.

The Internet is organized as a collection of administrative domains, known as Autonomous Systems (ASes). These ASes interact through the Border Gateway Protocol (BGP) that allows them to share reachability information. Adjacent routers in distinct ASes use external BGP (eBGP), whereas in a given AS routes are propagated over internal BGP (iBGP) sessions between any pair of routers. In large ASes where a logical full-mesh is not possible, confederations or route reflectors (RRs) are used. However, these somewhat scalable alternatives have introduced their own set of unpredictable effects (persistent routing oscillations and forwarding loops causing an increase of the convergence time) addressed in the literature [1].

On-line end-to-end Service Level Agreement (SLA) monitoring is of key importance nowadays. For this purpose, past recent researches focused on measuring (when possible) or estimating (most of the times) network QoS or performance parameters. Up to now, attempts to provide accurate techniques for estimating such parameters have failed. In addition, live reporting of the estimated network status requires a huge amount of resources, and lead to unscalable systems. The originality of the contribution presented in this paper, relies on the statement that the accurate estimation of network QoS parameters is absolutely not required in most cases: specifically it is sufficient to be aware of service disruptions, i.e. when the QoS provided by the network collapses. For this purpose, we propose an algorithm for disruption detection of network services. The proposed solution is based on the use of the well-known Kullback-Leibler Divergence algorithm. More specifically, we work on simple to measure time series, i.e. received inter-packet arrival times. In addition of efficiently detecting network QoS disruptions, the algorithm, also drastically reduces the required resources, and the overhead produced by the traffic collection for scalable SLA monitoring systems. The validity of the proposal is verified both in terms of accuracy and consumed resources in a real testbed, using different traffic profiles.

The occurrence of a traffic anomaly is always responsible for a degradation of performance. The anomaly can be observable, at some scale, in different ways: an increase in the number of packets, an increase in the number of bytes, a concentration of packets around a port number, etc. In this paper we propose an anomaly independent methodology for detecting such traffic anomalies and to classify them. To accomplish that, we integrate previous work in a multi-criteria tomographic analysis process, criteria being bytes, packets or flow rate, port number or address distribution, etc. As a demarcation from this inspiring work, this new methodology is based on a multi-scale analysis, which always permits the exhibition of anomalies on at least one parameter at one time scale. The motivation for using simple parameters deals with making the interpretation of anomalies simpler, and mitigation mechanisms obvious. In addition, this methodology associates to each anomaly a set of parameters that is able to characterize the anomaly and will serve as a signature for it. This paper presents this methodology, the related algorithm for anomaly detection, and its application on several real traffic traces captured on several networks: Auckland university, GEANT and Renater.

The goals of the present contribution are twofold. First, we propose the use of a non-Gaussian long-range dependent process to model Internet traffic aggregated time series. We give the definitions and intuition behind the use of this model. We detail numerical procedures that can be used to synthesize artificial traffic exactly following the model prescription. We also propose original and practically effective procedures to estimate the corresponding parameters from empirical data. We show that this empirical model relevantly describes a large variety of Internet traffic, including both regular traffic obtained from public reference repositories and traffic containing legitimate (flash crowd) or illegitimate (DDoS attack) anomalies. We observe that the proposed model accurately fits the data for a wide range of aggregation levels. The model provides us with a meaningful multiresolution (i.e., aggregation level dependent) statistics to characterize the traffic: the evolution of the estimated parameters with respect to the aggregation level. It opens the track to the second goal of the paper: anomaly detection. We propose the use of a quadratic distance computed on these statistics to detect the occurrences of DDoS attack and study the statistical performance of these detection procedures. Traffic with anomalies was produced and collected by us so as to create a controlled and reproducible database, allowing for a relevant assessment of the statistical performance of the proposed (modeling and detection) procedures

In this paper we present a methodology for detecting traffic anomalies. To accomplish that, and as a demarcation from similar works, we combine multi-scale with a multi-criteria tomography process analysis. With a complete knowledge of traffic anomalies, we intend to define anomalies signatures that could be used in a large range of scopes as traffic engineering, routing and intrusion detection systems, and much more.

The Internet is on the way of becoming the universal communication network, and then needs to provide various services with guaranteed quality for all kinds of applications. Denial of service (DoS) attacks are then more efficient in a guaranteed multi-services network than in the "old" best effort Internet. Indeed, with best effort services, a DoS attack has to forbid the target of the attack to communicate. With a multi-services network, it is sufficient to make the network not respect the SLA (service level agreement) committed with clients, what is easier and can be performed using simple flooding attacks. Then, the question is: how does a DoS attack impact the quality of service (QoS) of a network given that networks are hugely over-provisioned, and that DoS attacks never succeed to completely overflow these high speed networks? This paper aims at answering this question as we do believe that it can help for defending the network against such attacks. The analysis of DoS attacks has been performed using traffic monitoring tools on the Internet. In particular, the analysis of attacks shows that they are increasing long range dependence (LRD) in the traffic, breaking the invariant power laws of normal Internet traffic. It is also explained in the paper, based on some normal traffic traces characterization and analysis why LRD is such a bad parameter for having good QoS.

How to provide quality of service (QoS), has been a major issue for the Internet for the past decade. Though many proposals have been put forward in the areas of differentiated and guaranteed services, none have met the needs of users and operators. Efforts have been stymied by the complexity of the Internet, its myriad systems of interconnection, and by the technological heterogeneity of these systems. They have also run up against poor general knowledge of traffic characteristics that are largely unknown. In particular, recent monitoring projects showed that Internet traffic exhibited huge variations, leading to non-stationary traffic, and thus making difficult to guarantee a stable QoS. This paper then proposes a new measurement based architecture (MBA) and its related mechanisms (as the measurement signaling protocol (MSP) for instance, aiming at signaling to network components network information in real time) suited for coping with actual non-stationary traffic, and with the actual split topology of the Internet for which each domain provides a particular QoS. The idea of our measurement based networking (MBN) approach relies on a real time analysis of traffic characteristics and QoS evolution, and on the design of mechanisms able to adapt their reactions accordingly. The benefits of MBN are illustrated on a case study: a new measurement based congestion control (MBCC) which aims at smoothing traffic (making it more stable and stationary) and optimizing the use of network resources. Some preliminary results, based on NS-2 simulations, show the perfect suitability of this new mechanism for improving traffic characteristics and multi-domain QoS in the Internet, given the complexity and variability of actual traffic.

This paper proposes a new approach for making simulations realistic. This approach is based on the principle of "trace driven simulation", i.e. using the results of the actual traffic traces analysis in order to reproduce the same experimental conditions in simulation. The main principle of the approach proposed in this paper deals with making simulation traffic sources replay under certain conditions - the actual traffic traces grabbed on actual networks. This paper describes the implementation of this approach in the NS simulator, and evaluates it by comparing the characteristics of the traces obtained with our replay approach with original data traces. The parameters that are considered for making the comparison are the usual traffic parameters as throughput, packet rate, etc., but also everything that is related to traffic dynamics, i.e. the second order statistical moments as autocorrelation of traffic or long range dependence.

Our goal is to design a traffic model for uncongested IP backbone links that is simple enough to be used in network operation, and that is protocol and application agnostic in order to be as general as possible. The proposed solution is to model the traffic at the flow level by a Poisson shot-noise process. In our model, a flow is a generic notion that must be able to capture the characteristics of any kind of data stream. We analyze the accuracy of the model with real traffic traces collected on the Sprint IP backbone network. Despite its simplicity, our model provides a good approximation of the real traffic observed in the backbone and of its variation. Finally, we discuss three applications of our model to network design and management.

The paper presents the architecture and the design of a distributed videoconferencing application called N-TSVS. The structure of the cooperative groups supported by N-TSVS is defined and modelled by graphs: their vertices describe the group members and their edges represent the information sharing between the cooperative agents. The group dynamicity is modelled by valid configurations that are subgroups of members in which data exchanges can occur. A group membership service and an associated protocol that manage the dynamic cooperative groups are formally designed, validated and integrated inside N-TSVS. The multimedia data processing is developed in a separate way using multithreading functionalities and is coupled to the group membership service.

This paper presents an architecture that enforces time requirements and gives minimal end-to-end delays for multimedia applications. The layers and mechanisms allowing the system to fulfill the selected synchronization, i.e., the logical relationships and timed interval semantics, are presented. The proposed approach relies on the use of a formal model based on extended time Petri nets, i.e., the time stream Petri net model (TStreamPN), that allows the user to completely specify the time requirements of a given application. The architecture implements, in the application layer and on top of asynchronous environments, the requested quality of service (perceived by the user) with respect to time. At the transport layer, the use of a partial order transport service improves the reactive response of the communication transfers. Its principles are presented together with a presynchronization sublayer that makes the partial order transport service match the applicative synchronization requirements. Moreover, measurements on the implementation of a videoconference system show that the requirements of the quality of service are fulfilled.