Applications of GridProbe technology for traffic monitoring on high-capacity backbone networks, data-link layer simulation approach

This paper covers the on-going research on MASTSproject. The project objectives are to set-up and exploit a trafficmonitoring system for the UKLIGHT international high capacityexperimental network. The proposed system will record data flowand topological information at a range of time scales (fromfractions of a second to years). It will make this informationavailable to the community as a web service and managementinterfaces. In this paper the focus is on development of simulationplatforms that enable testing the analysis algorithms and Webservices output

Topological characteristics of IP networks

Topological analysis of the Internet is needed for developments on network planning, optimal routing algorithms, failure detection measures, and understanding business models. Accurate measurement, inference and modelling techniques are fundamental to Internet topology research. A requirement towards achieving such goals is the measurements of network topologies at different levels of granularity. In this work, I start by studying techniques for inferring, modelling, and generating Internet topologies at both the router and administrative levels. I also compare the mathematical models that are used to characterise various topologies and the generation tools based on them. Many topological models have been proposed to generate Internet Autonomous System(AS) topologies. I use an extensive set of measures and innovative methodologies to compare AS topology generation models with several observed AS topologies. This analysis shows that the existing AS topology generation models fail to capture important characteristics, such as the complexity of the local interconnection structure between ASes. Furthermore, I use routing data from multiple vantage points to show that using additional measurement points significantly affect our observations about local structural properties, such as clustering and node centrality. Degree-based properties, however, are not notably affected by additional measurements locations. The shortcomings of AS topology generation models stems from an underestimation of the complexity of the connectivity in the Internet and biases of measurement techniques. An increasing number of synthetic topology generators are available, each claiming to produce representative Internet topologies. Every generator has its own parameters, allowing the user to generate topologies with different characteristics. However, there exist no clear guidelines on tuning the value of these parameters in order to obtain a topology with specific characteristics. I propose a method which allows optimal parameters of a model to be estimated for a given target topology. The optimisation is performed using the weighted spectral distribution metric, which simultaneously takes into account many the properties of a graph. In order to understand the dynamics of the Internet, I study the evolution of the AS topology over a period of seven years. To understand the structural changes in the topology, I use the weighted spectral distribution as this metric reveals differences in the hierarchical structure of two graphs. The results indicate that the Internet is changing from a strongly customer-provider oriented, disassortative network, to a soft-hierarchical, peering-oriented, assortative network. This change is indicative of evolving business relationships amongst organisations

Towards Informative Statistical Flow Inversion

This is the accepted version of 'Towards Informative Statistical Flow Inversion', archived originally at arXiv:0705.1939v1 [cs.NI] 14 May 2007.A problem which has recently attracted research attention is that of estimating the distribution of flow sizes in internet traffic. On high traffic links it is sometimes impossible to record every packet. Researchers have approached the problem of estimating flow lengths from sampled packet data in two separate ways. Firstly, different sampling methodologies can be tried to more accurately measure the desired system parameters. One such method is the sample-and-hold method where, if a packet is sampled, all subsequent packets in that flow are sampled. Secondly, statistical methods can be used to ``invert'' the sampled data and produce an estimate of flow lengths from a sample. In this paper we propose, implement and test two variants on the sample-and-hold method. In addition we show how the sample-and-hold method can be inverted to get an estimation of the genuine distribution of flow sizes. Experiments are carried out on real network traces to compare standard packet sampling with three variants of sample-and-hold. The methods are compared for their ability to reconstruct the genuine distribution of flow sizes in the traffic

Modelling large motion events in fMRI studies of patients with epilepsy

EEG-correlated fMRI can provide localisation information on the generators of epileptiform discharges in patients with focal epilepsy. To increase the technique's clinical potential, it is important to consider ways of optimising the yield of each experiment while minimizing the risk of false-positive activation. Head motion can lead to severe image degradation and result in false-positive activation and is usually worse in patients than in healthy subjects. We performed general linear model fMRI data analysis on simultaneous EEG–fMRI data acquired in 34 cases with focal epilepsy. Signal changes associated with large inter-scan motion events (head jerks) were modelled using modified design matrices that include ‘scan nulling’ regressors. We evaluated the efficacy of this approach by mapping the proportion of the brain for which F-tests across the additional regressors were significant. In 95% of cases, there was a significant effect of motion in 50% of the brain or greater; for the scan nulling effect, the proportion was 36%; this effect was predominantly in the neocortex. We conclude that careful consideration of the motion-related effects in fMRI studies of patients with epilepsy is essential and that the proposed approach can be effective

A Glance through the VPN Looking Glass: IPv6 Leakage and DNS Hijacking in Commercial VPN clients

Commercial Virtual Private Network (VPN) services have become a popular and convenient technology for users seeking privacy and anonymity. They have been applied to a wide range of use cases, with commercial providers often making bold claims regarding their ability to fulfil each of these needs, e.g., censorship circumvention, anonymity and protection from monitoring and tracking. However, as of yet, the claims made by these providers have not received a sufficiently detailed scrutiny. This paper thus investigates the claims of privacy and anonymity in commercial VPN services. We analyse 14 of the most popular ones, inspecting their internals and their infrastructures. Despite being a known issue, our experimental study reveals that the majority of VPN services suffer from IPv6 traffic leakage. The work is extended by developing more sophisticated DNS hijacking attacks that allow all traffic to be transparently captured.We conclude discussing a range of best practices and countermeasures that can address these vulnerabilitie

The spread of media content through blogs

Blogs are a popular way to share personal journals, discuss matters of public opinion, pursue collaborative conversations, and aggregate content on similar topics. Blogs can be also used to disseminate new content and novel ideas to communities of interest. In this paper, we present an analysis of the topological structure and the patterns of popular media content that is shared in blogs. By analyzing 8.7 million posts of 1.1 million blogs across 15 major blog hosting sites, we find that the network structure of blogs is “less social” compared to other online social networks: most links are unidirectional and the network is sparsely connected. The type of content that was popularly shared on blogs was surprisingly different from that from the mainstream media: user generated content, often in the form of videos or photos, was the most common type of content disseminated in blogs. The user-generated content showed interesting viral-spreading patterns within blogs. Topical content such as news and political commentary spreads quickly by the hour and then quickly disappears, while non-topical content such as music and entertainment propagates slowly over a much long period of time

Fetishizing Food in Digital Age: #foodporn Around the World

International AAAI Conference on Web and Social Media (ICWSM), 2016International AAAI Conference on Web and Social Media (ICWSM), 2016What food is so good as to be considered pornographic? Worldwide, the popular #foodporn hashtag has been used to share appetizing pictures of peoples' favorite culinary experiences. But social scientists ask whether #foodporn promotes an unhealthy relationship with food, as pornography would contribute to an unrealistic view of sexuality. In this study, we examine nearly 10 million Instagram posts by 1.7 million users worldwide. An overwhelming (and uniform across the nations) obsession with chocolate and cake shows the domination of sugary dessert over local cuisines. Yet, we find encouraging traits in the association of emotion and health-related topics with #foodporn, suggesting food can serve as motivation for a healthy lifestyle. Social approval also favors the healthy posts, with users posting with healthy hashtags having an average of 1,000 more followers than those with unhealthy ones. Finally, we perform a demographic analysis which shows nation-wide trends of behavior, such as a strong relationship (r=0.51) between the GDP per capita and the attention to healthiness of their favorite food. Our results expose a new facet of food "pornography", revealing potential avenues for utilizing this precarious notion for promoting healthy lifestyles

Rapid IoT device identification at the edge

Consumer Internet of Things (IoT) devices are increasingly common in everyday homes, from smart speakers to security cameras. Along with their benefits come potential privacy and security threats. To limit these threats we must implement solutions to filter IoT traffic at the edge. To this end the identification of the IoT device is the first natural step. In this paper we demonstrate a novel method of rapid IoT device identification that uses neural networks trained on device DNS traffic that can be captured from a DNS server on the local network. The method identifies devices by fitting a model to the first seconds of DNS second-level-domain traffic following their first connection. Since security and privacy threat detection often operate at a device specific level, rapid identification allows these strategies to be implemented immediately. Through a total of 51,000 rigorous automated experiments, we classify 30 consumer IoT devices from 27 different manufacturers with 82% and 93% accuracy for product type and device manufacturers respectively