Design and Implementation of Algorithms for Traffic Classification

Traffic analysis is the practice of using inherent characteristics of a network flow such as timings, sizes, and orderings of the packets to derive sensitive information about it. Traffic analysis techniques are used because of the extensive adoption of encryption and content-obfuscation mechanisms, making it impossible to infer any information about the flows by analyzing their content. In this thesis, we use traffic analysis to infer sensitive information for different objectives and different applications. Specifically, we investigate various applications: p2p cryptocurrencies, flow correlation, and messaging applications. Our goal is to tailor specific traffic analysis algorithms that best capture network traffic’s intrinsic characteristics in those applications for each of these applications. Also, the objective of traffic analysis is different for each of these applications. Specifically, in Bitcoin, our goal is to evaluate Bitcoin traffic’s resilience to blocking by powerful entities such as governments and ISPs. Bitcoin and similar cryptocurrencies play an important role in electronic commerce and other trust-based distributed systems because of their significant advantage over traditional currencies, including open access to global e-commerce. Therefore, it is essential to the consumers and the industry to have reliable access to their Bitcoin assets. We also examine stepping stone attacks for flow correlation. A stepping stone is a host that an attacker uses to relay her traffic to hide her identity. We introduce two fingerprinting systems, TagIt and FINN. TagIt embeds a secret fingerprint into the flows by moving the packets to specific time intervals. However, FINN utilizes DNNs to embed the fingerprint by changing the inter-packet delays (IPDs) in the flow. In messaging applications, we analyze the WhatsApp messaging service to determine if traffic leaks any sensitive information such as members’ identity in a particular conversation to the adversaries who watch their encrypted traffic. These messaging applications’ privacy is essential because these services provide an environment to dis- cuss politically sensitive subjects, making them a target to government surveillance and censorship in totalitarian countries. We take two technical approaches to design our traffic analysis techniques. The increasing use of DNN-based classifiers inspires our first direction: we train DNN classifiers to perform some specific traffic analysis task. Our second approach is to inspect and model the shape of traffic in the target application and design a statistical classifier for the expected shape of traffic. DNN- based methods are useful when the network is complex, and the traffic’s underlying noise is not linear. Also, these models do not need a meticulous analysis to extract the features. However, deep learning techniques need a vast amount of training data to work well. Therefore, they are not beneficial when there is insufficient data avail- able to train a generalized model. On the other hand, statistical methods have the advantage that they do not have training overhead

Modelling and Design of Resilient Networks under Challenges

Communication networks, in particular the Internet, face a variety of challenges that can disrupt our daily lives resulting in the loss of human lives and significant financial costs in the worst cases. We define challenges as external events that trigger faults that eventually result in service failures. Understanding these challenges accordingly is essential for improvement of the current networks and for designing Future Internet architectures. This dissertation presents a taxonomy of challenges that can help evaluate design choices for the current and Future Internet. Graph models to analyse critical infrastructures are examined and a multilevel graph model is developed to study interdependencies between different networks. Furthermore, graph-theoretic heuristic optimisation algorithms are developed. These heuristic algorithms add links to increase the resilience of networks in the least costly manner and they are computationally less expensive than an exhaustive search algorithm. The performance of networks under random failures, targeted attacks, and correlated area-based challenges are evaluated by the challenge simulation module that we developed. The GpENI Future Internet testbed is used to conduct experiments to evaluate the performance of the heuristic algorithms developed

Traffic and task allocation in networks and the cloud

Communication services such as telephony, broadband and TV are increasingly migrating into Internet Protocol(IP) based networks because of the consolidation of telephone and data networks. Meanwhile, the increasingly wide application of Cloud Computing enables the accommodation of tens of thousands of applications from the general public or enterprise users which make use of Cloud services on-demand through IP networks such as the Internet. Real-Time services over IP (RTIP) have also been increasingly significant due to the convergence of network services, and the real-time needs of the Internet of Things (IoT) will strengthen this trend. Such Real-Time applications have strict Quality of Service (QoS) constraints, posing a major challenge for IP networks. The Cognitive Packet Network (CPN) has been designed as a QoS-driven protocol that addresses user-oriented QoS demands by adaptively routing packets based on online sensing and measurement. Thus in this thesis we first describe our design for a novel ``Real-Time (RT) traffic over CPN'' protocol which uses QoS goals that match the needs of voice packet delivery in the presence of other background traffic under varied traffic conditions; we present its experimental evaluation via measurements of key QoS metrics such as packet delay, delay variation (jitter) and packet loss ratio. Pursuing our investigation of packet routing in the Internet, we then propose a novel Big Data and Machine Learning approach for real-time Internet scale Route Optimisation based on Quality-of-Service using an overlay network, and evaluate is performance. Based on the collection of data sampled each $2$ minutes over a large number of source-destinations pairs, we observe that intercontinental Internet Protocol (IP) paths are far from optimal with respect to metrics such as end-to-end round-trip delay. On the other hand, our machine learning based overlay network routing scheme exploits large scale data collected from communicating node pairs to select overlay paths, while it uses IP between neighbouring overlay nodes. We report measurements over a week long experiment with several million data points shows substantially better end-to-end QoS than is observed with pure IP routing. Pursuing the machine learning approach, we then address the challenging problem of dispatching incoming tasks to servers in Cloud systems so as to offer the best QoS and reliable job execution; an experimental system (the Task Allocation Platform) that we have developed is presented and used to compare several task allocation schemes, including a model driven algorithm, a reinforcement learning based scheme, and a ``sensible’’ allocation algorithm that assigns tasks to sub-systems that are observed to provide lower response time. These schemes are compared via measurements both among themselves and against a standard round-robin scheduler, with two architectures (with homogenous and heterogenous hosts having different processing capacities) and the conditions under which the different schemes offer better QoS are discussed. Since Cloud systems include both locally based servers at user premises and remote servers and multiple Clouds that can be reached over the Internet, we also describe a smart distributed system that combines local and remote Cloud facilities, allocating tasks dynamically to the service that offers the best overall QoS, and it includes a routing overlay which minimizes network delay for data transfer between Clouds. Internet-scale experiments that we report exhibit the effectiveness of our approach in adaptively distributing workload across multiple Clouds.Open Acces

A Cross-Layer Modification to the DSR Routing Protocol in Wireless Mesh Networks

A cross-layer modification to the DSR routing protocol that finds high throughput paths in WMNs has been introduced in this work. The Access Efficiency Factor (AEF) has been introduced in this modification as a local congestion avoidance metric for the DSR routing mechanism as an alternative to the hop count (Hc) metric. In this modification, the selected path is identified by finding a path with the highest minimum AEF (max_min_AEF) value. The basis of this study is to compare the performance of the Hc and max_min_AEF as routing metrics for the DSR protocol in WMNs using the OPNET modeler. Performance comparisons between max_min_AEF, Metric Path (MP), and the well known ETT metrics are also carried out in this work. The results of this modification suggest that employing the max_min_AEF as a routing metric outperforms the Hc, ETT, and MP within the DSR protocol in WMNs in terms of throughput. This is because the max_min_AEF is based upon avoiding directing traffic through congested nodes where significant packet loss is likely to occur. This throughput improvement is associated with an increment in the delay time due to the long paths taken to avoid congested regions. To overcome this drawback, a further modification to the routing discovery mechanism has been made by imposing a hop count limit (HCL) on the discovered paths. Tuning the HCL allows the network manager to tradeoff throughput against delay. The choice of congestion avoidance metric exhibits another shortcoming owing to its dependency on the packet size. It penalises the smaller packets over large ones in terms of path lengths. This has been corrected for by introducing a ModAEF metric that explicitly considers the size of the packet. The ModAEF metric includes a tuning factor that allows the operator determine the level of the weighting that should be applied to the packet size to correct for this dependence

Data Management Strategies for Relative Quality of Service in Virtualised Storage Systems

The amount of data managed by organisations continues to grow relentlessly. Driven by the high costs of maintaining multiple local storage systems, there is a well established trend towards storage consolidation using multi-tier Virtualised Storage Systems (VSSs). At the same time, storage infrastructures are increasingly subject to stringent Quality of Service (QoS) demands. Within a VSS, it is challenging to match desired QoS with delivered QoS, considering the latter can vary dramatically both across and within tiers. Manual efforts to achieve this match require extensive and ongoing human intervention. Automated efforts are based on workload analysis, which ignores the business importance of infrequently accessed data. This thesis presents our design, implementation and evaluation of data maintenance strategies in an enhanced version of the popular Linux Extended 3 Filesystem which features support for the elegant specification of QoS metadata while maintaining compatibility with stock kernels. Users and applications specify QoS requirements using a chmod-like interface. System administrators are provided with a character device kernel interface that allows for profiling of the QoS delivered by the underlying storage. We propose a novel score-based metric, together with associated visualisation resources, to evaluate the degree of QoS matching achieved by any given data layout. We also design and implement new inode and datablock allocation and migration strategies which exploit this metric in seeking to match the QoS attributes set by users and/or applications on files and directories with the QoS actually delivered by each of the filesystem’s block groups. To create realistic test filesystems we have included QoS metadata support in the Impressions benchmarking framework. The effectiveness of the resulting data layout in terms of QoS matching is evaluated using a special kernel module that is capable of inspecting detailed filesystem data on-the-fly. We show that our implementations of the proposed inode and datablock allocation strategies are capable of dramatically improving data placement with respect to QoS requirements when compared to the default allocators

Bounds Computation for Symmetric Nets

Monotonicity in Markov chains is the starting point for quantitative abstraction of complex probabilistic systems leading to (upper or lower) bounds for probabilities and mean values relevant to their analysis. While numerous case studies exist in the literature, there is no generic model for which monotonicity is directly derived from its structure. Here we propose such a model and formalize it as a subclass of Stochastic Symmetric (Petri) Nets (SSNs) called Stochastic Monotonic SNs (SMSNs). On this subclass the monotonicity is proven by coupling arguments that can be applied on an abstract description of the state (symbolic marking). Our class includes both process synchronizations and resource sharings and can be extended to model open or cyclic closed systems. Automatic methods for transforming a non monotonic system into a monotonic one matching the MSN pattern, or for transforming a monotonic system with large state space into one with reduced state space are presented. We illustrate the interest of the proposed method by expressing standard monotonic models and modelling a flexible manufacturing system case study

Mobile Ad Hoc Networks

Guiding readers through the basics of these rapidly emerging networks to more advanced concepts and future expectations, Mobile Ad hoc Networks: Current Status and Future Trends identifies and examines the most pressing research issues in Mobile Ad hoc Networks (MANETs). Containing the contributions of leading researchers, industry professionals, and academics, this forward-looking reference provides an authoritative perspective of the state of the art in MANETs. The book includes surveys of recent publications that investigate key areas of interest such as limited resources and the mobility of mobile nodes. It considers routing, multicast, energy, security, channel assignment, and ensuring quality of service. Also suitable as a text for graduate students, the book is organized into three sections: Fundamentals of MANET Modeling and Simulation—Describes how MANETs operate and perform through simulations and models Communication Protocols of MANETs—Presents cutting-edge research on key issues, including MAC layer issues and routing in high mobility Future Networks Inspired By MANETs—Tackles open research issues and emerging trends Illustrating the role MANETs are likely to play in future networks, this book supplies the foundation and insight you will need to make your own contributions to the field. It includes coverage of routing protocols, modeling and simulations tools, intelligent optimization techniques to multicriteria routing, security issues in FHAMIPv6, connecting moving smart objects to the Internet, underwater sensor networks, wireless mesh network architecture and protocols, adaptive routing provision using Bayesian inference, and adaptive flow control in transport layer using genetic algorithms

Contributions to the routing of traffic flows in multi-hop IEEE 802.11 wireless networks

The IEEE 802.11 standard was not initially designed to provide multi-hop capabilities. Therefore, providing a proper traffic performance in Multi-Hop IEEE 802.11 Wireless Networks (MIWNs) becomes a significant challenge. The approach followed in this thesis has been focused on the routing layer in order to obtain applicable solutions not dependent on a specific hardware or driver. Nevertheless, as is the case of most of the research on this field, a cross-layer design has been adopted. Therefore, one of the first tasks of this work was devoted to the study of the phenomena which affect the performance of the flows in MIWNs. Different estimation methodologies and models are presented and analyzed. The first main contribution of this thesis is related to route creation procedures. First, FB-AODV is introduced, which creates routes and forwards packets according to the flows on the contrary to basic AODV which is destination-based. This enhancement permits to balance the load through the network and gives a finer granularity in the control and monitoring of the flows. Results showed that it clearly benefits the performance of the flows. Secondly, a novel routing metric called Weighted Contention and Interference routing Metric (WCIM) is presented. In all analyzed scenarios, WCIM outperformed the other analyzed state-of-the-art routing metrics due to a proper leveraging of the number of hops, the link quality and the suffered contention and interference. The second main contribution of this thesis is focused on route maintenance. Generally, route recovery procedures are devoted to the detection of link breaks due to mobility or fading. However, other phenomena like the arrival of new flows can degrade the performance of active flows. DEMON, which is designed as an enhancement of FB-AODV, allows the preemptive recovery of degraded routes by passively monitoring the performance of active flows. Results showed that DEMON obtains similar or better results than other published solutions in mobile scenarios, while it clearly outperforms the performance of default AODV under congestion Finally, the last chapter of this thesis deals with channel assignment in multi-radio solutions. The main challenge of this research area relies on the circular relationship between channel assignment and routing; channel assignment determines the routes that can be created, while the created routes decide the real channel diversity of the network and the level of interference between the links. Therefore, proposals which join routing and channel assignment are generally complex, centralized and based on traffic patterns, limiting their practical implementation. On the contrary, the mechanisms presented in this thesis are distributed and readily applicable. First, the Interference-based Dynamic Channel Assignment (IDCA) algorithm is introduced. IDCA is a distributed and dynamic channel assignment based on the interference caused by active flows which uses a common channel in order to assure connectivity. In general, IDCA leads to an interesting trade-off between connectivity preservation and channel diversity. Secondly, MR-DEMON is introduced as way of joining channel assignment and route maintenance. As DEMON, MR-DEMON monitors the performance of the active flows traversing the links, but, instead of alerting the source when noticing degradation, it permits reallocating the flows to less interfered channels. Joining route recovery instead of route creation simplifies its application, since traffic patterns are not needed and channel reassignments can be locally decided. The evaluation of MR-DEMON proved that it clearly benefits the performance of IDCA. Also, it improves DEMON functionality by decreasing the number of route recoveries from the source, leading to a lower overhead.El estándar IEEE 802.11 no fue diseñado inicialmente para soportar capacidades multi-salto. Debido a ello, proveer unas prestaciones adecuadas a los flujos de tráfico que atraviesan redes inalámbricas multi-salto IEEE 802.11 supone un reto significativo. La investigación desarrollada en esta tesis se ha centrado en la capa de encaminamiento con el objetivo de obtener soluciones aplicables y no dependientes de un hardware específico. Sin embargo, debido al gran impacto de fenómenos y parámetros relacionados con las capas físicas y de acceso al medio sobre las prestaciones de los tráficos de datos, se han adoptado soluciones de tipo cross-layer. Es por ello que las primeras tareas de la investigación, presentadas en los capítulos iniciales, se dedicaron al estudio y caracterización de estos fenómenos. La primera contribución principal de esta tesis se centra en mecanismos relacionados con la creación de las rutas. Primero, se introduce una mejora del protocolo AODV, que permite crear rutas y encaminar paquetes en base a los flujos de datos, en lugar de en base a los destinos como se da en el caso básico. Esto permite balacear la carga de la red y otorga un mayor control sobre los flujos activos y sus prestaciones, mejorando el rendimiento general de la red. Seguidamente, se presenta una métrica de encaminamiento sensible a la interferencia de la red y la calidad de los enlaces. Los resultados analizados, basados en la simulación de diferentes escenarios, demuestran que mejora significativamente las prestaciones de otras métricas del estado del arte. La segunda contribución está relacionada con el mantenimiento de las rutas activas. Generalmente, los mecanismos de mantenimiento se centran principalmente en la detección de enlaces rotos debido a la movilidad de los nodos o a la propagación inalámbrica. Sin embargo, otros fenómenos como la interferencia y congestión provocada por la llegada de nuevos flujos pueden degradar de forma significativa las prestaciones de los tráficos activos. En base a ello, se diseña un mecanismo de mantenimiento preventivo de rutas, que monitoriza las prestaciones de los flujos activos y permite su reencaminamiento en caso de detectar rutas degradadas. La evaluación de esta solución muestra una mejora significativa sobre el mantenimiento de rutas básico en escenarios congestionados, mientras que en escenarios con nodos móviles obtiene resultados similares o puntualmente mejores que otros mecanismos preventivos diseñados específicamente para casos con movilidad. Finalmente, el último capítulo de la tesis se centra en la asignación de canales en entornos multi-canal y multi-radio con el objetivo de minimizar la interferencia entre flujos activos. El reto principal en este campo es la dependencia circular que se da entre la asignación de canales y la creación de rutas: la asignación de canales determina los enlaces existentes la red y por ello las rutas que se podrán crear, pero son finalmente las rutas y los tráficos activos quienes determinan el nivel real de interferencia que se dará en la red. Es por ello que las soluciones que proponen unificar la asignación de canales y el encaminamiento de tráficos son generalmente complejas, centralizadas y basadas en patrones de tráfico, lo que limita su implementación en entornos reales. En cambio, en nuestro caso adoptamos una solución distribuida y con mayor aplicabilidad. Primero, se define un algoritmo de selección de canales dinámico basado en la interferencia de los flujos activos, que utiliza un canal común en todos los nodos para asegurar la conectividad de la red. A continuación, se introduce un mecanismo que unifica la asignación de canales con el mantenimiento preventivo de las rutas, permitiendo reasignar flujos degradados a otros canales disponibles en lugar de reencaminarlos completamente. Ambas soluciones demuestran ser beneficiosas en este tipo de entornos.Postprint (published version