Cross-Layer Peer-to-Peer Track Identification and Optimization Based on Active Networking

P2P applications appear to emerge as ultimate killer applications due to their ability to construct highly dynamic overlay topologies with rapidly-varying and unpredictable traffic dynamics, which can constitute a serious challenge even for significantly over-provisioned IP networks. As a result, ISPs are facing new, severe network management problems that are not guaranteed to be addressed by statically deployed network engineering mechanisms. As a first step to a more complete solution to these problems, this paper proposes a P2P measurement, identification and optimisation architecture, designed to cope with the dynamicity and unpredictability of existing, well-known and future, unknown P2P systems. The purpose of this architecture is to provide to the ISPs an effective and scalable approach to control and optimise the traffic produced by P2P applications in their networks. This can be achieved through a combination of different application and network-level programmable techniques, leading to a crosslayer identification and optimisation process. These techniques can be applied using Active Networking platforms, which are able to quickly and easily deploy architectural components on demand. This flexibility of the optimisation architecture is essential to address the rapid development of new P2P protocols and the variation of known protocols

KISS: Stochastic Packet Inspection Classifier for UDP Traffic

This paper proposes KISS, a novel Internet classifica- tion engine. Motivated by the expected raise of UDP traffic, which stems from the momentum of Peer-to-Peer (P2P) streaming appli- cations, we propose a novel classification framework that leverages on statistical characterization of payload. Statistical signatures are derived by the means of a Chi-Square-like test, which extracts the protocol "format," but ignores the protocol "semantic" and "synchronization" rules. The signatures feed a decision process based either on the geometric distance among samples, or on Sup- port Vector Machines. KISS is very accurate, and its signatures are intrinsically robust to packet sampling, reordering, and flow asym- metry, so that it can be used on almost any network. KISS is tested in different scenarios, considering traditional client-server proto- cols, VoIP, and both traditional and new P2P Internet applications. Results are astonishing. The average True Positive percentage is 99.6%, with the worst case equal to 98.1,% while results are al- most perfect when dealing with new P2P streaming applications

Evidences Behind Skype Outage

Skype is one of the most successful VoIP application in the current Internet spectrum. One of the most peculiar characteristics of Skype is that it relies on a P2P infrastructure for the exchange of signaling information amongst active peers. During August 2007, an unexpected outage hit the Skype overlay, yielding to a service blackout that lasted for more than two days: this paper aims at throwing light to this event. Leveraging on the use of an accurate Skype classification engine, we carry on an experimental study of Skype signaling during the outage. In particular, we focus on the signaling traffic before, during and after the outage, in the attempt to quantify interesting properties of the event. While it is very difficult to gather clear insights concerning the root causes of the breakdown itself, the collected measurement allow nevertheless to quantify several interesting aspects of the outage: for instance, measurements show that the outage caused, on average, a 3-fold increase of signaling traffic and a 10-fold increase of number of contacted peers, topping to more than 11 million connections for the most active node in our network - which immediately gives the feeling of the extent of the phenomeno

Enhancing traffic sampling scope and efficiency

Traffic Sampling is a crucial step towards scalable network measurements, enclosing manifold challenges. The wide variety of foreseeable sampling scenarios demands for a modular view of sampling components and features, grounded on a consistent architecture. Articulating the measurement scope, the required information model and the adequate sampling strategy is a major design issue for achieving an encompassing and efficient sampling solution. This is the main focus of the present work, where a layered architecture, a taxonomy of existing sampling techniques distinguishing their inner characteristics and a flexible framework able to combine these characteristics are introduced. In addition, a new multiadaptive technique proposal, based on linear prediction, allows to reduce the measurement overhead significantly, while assuring that traffic samples reflect the statistical behavior of the global traffic under analysis.Fundação para a Ciência e a Tecnologia (FCT

On the impact of packet sampling on Skype traffic classification

Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. P. M. Santiago del Río, D. Corral, J. L. García-Dorado, and J. Aracil, "On the Impact of Packet Sampling on Skype Traffic Classification", in IFIP/IEEE International Symposium on Integrated Network Management (IM 2013), 2013, p. 800 - 803Nowadays, traffic classification technology addresses the exciting challenge of dealing with ever-increasing network speeds, which implies more computational load especially when on-line classification is required, but avoiding to reduce classification accuracy. However, while the research community has proposed mechanisms to reduce load, such as packet sampling, the impact of these mechanisms on traffic classification has been only marginally studied. This paper addresses such study focusing on Skype application given its tremendous popularity and continuous expansion. Skype, unfortunately, is based on a proprietary design, and typically uses encryption mechanisms, making the study of statistical traffic characteristics and the use of Machine Learning techniques the only possible solution. Consequently, we have studied Skypeness, an open-source system that allows detecting Skype at multi-10Gb/s rates applying such statistical principles. We have assessed its performance applying different packet sampling rates and policies concluding that classification accuracy is significantly degraded when packet sampling is applied. Nevertheless, we propose a simple modification in Skypeness that lessens such degradation. This consists in scaling the measured packet interarrivals used to classify according to the sampling rate, which has resulted in a significant gain

The Triangle Metric: Fast Link Quality Estimation for Mobile Wireless Sensor Networks (Invited Paper)

ReSensesuppleCONE

An Overview on Application of Machine Learning Techniques in Optical Networks

Today's telecommunication networks have become sources of enormous amounts of widely heterogeneous data. This information can be retrieved from network traffic traces, network alarms, signal quality indicators, users' behavioral data, etc. Advanced mathematical tools are required to extract meaningful information from these data and take decisions pertaining to the proper functioning of the networks from the network-generated data. Among these mathematical tools, Machine Learning (ML) is regarded as one of the most promising methodological approaches to perform network-data analysis and enable automated network self-configuration and fault management. The adoption of ML techniques in the field of optical communication networks is motivated by the unprecedented growth of network complexity faced by optical networks in the last few years. Such complexity increase is due to the introduction of a huge number of adjustable and interdependent system parameters (e.g., routing configurations, modulation format, symbol rate, coding schemes, etc.) that are enabled by the usage of coherent transmission/reception technologies, advanced digital signal processing and compensation of nonlinear effects in optical fiber propagation. In this paper we provide an overview of the application of ML to optical communications and networking. We classify and survey relevant literature dealing with the topic, and we also provide an introductory tutorial on ML for researchers and practitioners interested in this field. Although a good number of research papers have recently appeared, the application of ML to optical networks is still in its infancy: to stimulate further work in this area, we conclude the paper proposing new possible research directions

Characterization of ISP Traffic: Trends, User Habits, and Access Technology Impact

In the recent years, the research community has increased its focus on network monitoring which is seen as a key tool to understand the Internet and the Internet users. Several studies have presented a deep characterization of a particular application, or a particular network, considering the point of view of either the ISP, or the Internet user. In this paper, we take a different perspective. We focus on three European countries where we have been collecting traffic for more than a year and a half through 5 vantage points with different access technologies. This humongous amount of information allows us not only to provide precise, multiple, and quantitative measurements of "What the user do with the Internet" in each country but also to identify common/uncommon patterns and habits across different countries and nations. Considering different time scales, we start presenting the trend of application popularity; then we focus our attention to a one-month long period, and further drill into a typical daily characterization of users activity. Results depict an evolving scenario due to the consolidation of new services as Video Streaming and File Hosting and to the adoption of new P2P technologies. Despite the heterogeneity of the users, some common tendencies emerge that can be leveraged by the ISPs to improve their servic

Sampling techniques applied to anomalous events detection

Dissertação de mestrado integrado em Engenharia InformáticaNowadays, one of the major worries about a network is security. Since the network has become the big platform it is, the number of attacks or attempts to steal information or just harm someone or something is getting bigger to handle or harder to find. Sampling techniques help to solve these problems as they are used to reduce the scope of the analysis, as well as the resources needed to perform it. By using sample techniques to search and find the attacks in the network traffic it will become easier to detect attacks and keep the network secure. As will be seen in the following sections, joining sampling and security is not an easy task to do. Questions such as, what are the best techniques to be used, what are the best methods to be implemented, are inevitable when using sampling. However, sampling can bring more advantages than disadvantages. Besides that, depending on the chosen measurement method, sampling technique or algorithm performed to analyse the samples, the results can change a lot according to the target for the technique. To achieve results for evaluation, a Network-based Intrusion Detection System (NIDS) will be used to identify anomalous events present in the samples.Hoje em dia, uma das maiores preocupações com uma rede é a segurança. Como a rede se tornou a grande plataforma que é, o número de ataques ou tentativas de roubar informações ou apenas prejudicar alguém ou algo está cada vez maior ou mais difícil de encontrar. As téc nicas de amostragem ajudam a resolver esses problemas visto que são utilizadas para reduzir o escopo da análise assim como os recursos necessários para realizar a mesma. Usando técnicas de amostra para procurar e localizar os ataques no tráfego da rede, facilita prevenir ataques e manter a rede segura. Como será constatado nas próximas secções, juntar amostragem e segurança não é uma tarefa fácil. Questões como, quais são as melhores técnicas a serem utilizadas, quais os melhores métodos a serem implementados, são inevitáveis aquando da utilização de amostragem. Contudo, amostragem pode trazer mais vantagens do que desvan tagens. Além disso, dependendo do método de medição escolhido, técnica de amostragem ou algoritmo usado para analisar as amostras, os resultados podem variar muito consoante o alvo da técnica. Para alcançar resultados para avaliação vai ser utilizado um Network-based Intrusion Detection System (NIDS) de forma a identificar os eventos anómalos presentes nas amostragens