DNS权威名字服务器性能与安全性的研究

与根域名服务器等顶级域相比,本地的权威名字服务器更易于发生设备故障和遭受恶意攻击。阐述了权威名字服务器的现状并实现了一个新型DNS测量工具DNSAuth来自动获取权威名字服务器的信息。实验着重分析了权威名字服务器的分布、地理位置及其对性能和安全性的影响,按照五个有代表性的属性,对中国Top100网站的权威名字服务器进行了量化评估,实验结果表明只有32%的权威名字服务器具有较好的性能和安全性。     

Improving Java performance and energy dissipation through efficient code caching

Traditional Java code generation and instruction fetch path is not efficient, as Java binary code is typically written into the data cache first, and then is loaded into the instruction cache through the shared L2 cache or memory, which takes both time and energy. In this paper, we study three hardware-based code caching strategies, which attempt to write and read the dynamically generated Java code faster and more energy-efficiently. Our experimental results indicate that with proper architectural support, writing code directly into the instruction cache can improve the performance for a variety of Java applications by 9.6% on average, with up to 42.9%. Also, the average energy dissipation of these Java programs can be reduced by 6% with efficient code caching.     

Modeling in-network caching and bandwidth sharing performance in information-centric networking

Information-centric networking (ICN) proposes a content-centric paradigm which has some attractive advantages, such as network load reduction, low dissemination latency, and energy efficiency. In this paper, based on the analytical model of ICN with receiver-driven transport protocol employing least-recently used (LRU) replacement policy, we derive expressions to compute the average content delivery time of the requests' arrival sequence of a single cache, and then we extend the expressions to a cascade of caches’ scenario. From the expressions, we know the quantitative relationship among the delivery time, cache size and bandwidth. Our results, analyzing the trade-offs between performance and resources in ICN, can be used as a guide to design ICN and to evaluation its performance.     

QoS routing computation with path caching: a framework and network performance

We present a framework for QoS routing computation with path caching. The framework has three phases to allow different levels of information to be processed at different timescales to effectively meet QoS requirement of a newly arrived flow. Path caching is introduced in the first phase to allow selection and filtering in subsequent phases. We describe several routing schemes that can fit into this framework. Through simulation results, we show where and how the benefit of path caching can be exploited depending on the number of paths cached, and when to invoke other controls. Our results show that QoS routing by itself cannot improve the network and/or service performance unless controls such as trunk reservation and source-based admission control are also activated. The invocation of these functions can also allow maximum benefit from the path caching framework.     

面向DNS日志的MapReduce性能优化技术研究

DNS日志是互联网中重要的访问日志,数量巨大且承载着大量信息,需要借助大数据技术进行处理和分析.现网DNS日志数据量大,且数据倾斜现象严重,对MapReduce的性能有较为严重的影响.基于上述问题,采用小文件合并方法优化分片,缓解Map端的数据倾斜问题,并实现动态设置分片大小,提高MapReduce作业执行效率.该方法有效均衡了Map任务的负载,从而提高了数据倾斜情况下的MapReduce作业的执行效率和资源利用率.实验表明,使用该方法可以有效缩短MapReduce作业的执行时间.     

High performance,low complexity cooperative caching for wireless sensor networks

During the last decade, Wireless Sensor Networks have emerged and matured at such point that they currently support several applications such as environment control, intelligent buildings, target tracking in battlefields. The vast majority of these applications require an optimization to the communication among the sensors so as to serve data in short latency and with minimal energy consumption. Cooperative data caching has been proposed as an effective and efficient technique to achieve these goals concurrently. The essence of these protocols is the selection of the sensor nodes which will take special roles in running the caching and request forwarding decisions. This article introduces two new metrics to aid in the selection of such nodes. Based on these metrics, we propose two new cooperative caching protocols, PCICC and scaPCICC, which are compared against the state-of-the-art competing protocol, namely NICoCa. The proposed solutions are evaluated extensively in an advanced simulation environment and the results confirm that the proposed caching mechanisms prevail over its competitor. The evaluation attests also that the best policy is always scaPCICC, achieving the shortest latency and the least number of transmitted messages.     

A novel caching scheme for improving Internet-based mobile ad hoc networks performance

Internet-based mobile ad hoc network (Imanet) is an emerging technique that combines a wired network (e.g. Internet) and a mobile ad hoc network (Manet) for developing a ubiquitous communication infrastructure. To fulfill users’ demand to access various kinds of information, however, an Imanet has several limitations such as limited accessibility to the wired Internet, insufficient wireless bandwidth, and longer message latency. In this paper, we address the issues involved in information search and access in Imanets. An aggregate caching mechanism and a broadcast-based Simple Search (SS) algorithm are proposed for improving the information accessibility and reducing average communication latency in Imanets. As a part of the aggregate cache, a cache admission control policy and a cache replacement policy, called Time and Distance Sensitive (TDS) replacement, are developed to reduce the cache miss ratio and improve the information accessibility. We evaluate the impact of caching, cache management, and the number of access points that are connected to the Internet, through extensive simulation. The simulation results indicate that the proposed aggregate caching mechanism can significantly improve an Imanet performance in terms of throughput and average number of hops to access data items.     

动态域名解析系统的开发实践

在当今的互联网时代ADSL应用十分的广泛,但ADSL动态地址池分配IP方式的不确定性则给域名解析带来很大的麻烦.从一个简单C/S系统的角度,分析动态DNS系统的开发思路,并尝试采用客户端/服务器的架构,对完整的动态DNS的开发进行了探讨实践.     

Community oriented in‐network caching and edge caching for over‐the‐top services in adaptive network conditions to improve performance

Over‐the‐top (OTT) services such as Netflix, Amazon Prime, and YouTube generate the most dominant form of traffic on the Internet today. There is increasingly high demand for resource intensive 3D contents, interactive media, 360 media, and user‐generated contents. As the amount of contents keep increasing in multiple folds, it is important to cache contents intelligently. Caching algorithm needs to exploit in‐network caching, community‐based pre‐caching, and a combined approach. Hence, we survey CDN‐based edge caching infrastructures including OpenConnect (Netflix) and Google Edge, followed by CCN based in‐network caching. We implement and compare four different approaches for caching contents including (1) in‐network caching, (2) edge caching, (3) community‐based in‐network caching, and (4) community‐based edge caching. We run our algorithms on adaptive network conditions with different topologies, cache size, content popularity, and request arrivals in and compared the delay for all these four approaches. We verify our model by calculating important performance parameters including hop count, redundancy, and hop count variances. Hopcount is an important performance parameter as it influences the processing, queuing, and transmission delays. We focus on determining if an in‐network caching approach is any better than edge caching. We reach several conclusions. First, in most of the scenarios, community‐based in‐network caching performs the best. Second, if the cache size is lesser than 30% of the total content size then community‐based edge caching is better for less popular contents. Finally, our statistical analysis also reveals that a community‐based edge caching mechanism is least affected by varying cache sizes and dynamic user behavior, which makes it a better choice for providing Service Level Agreement.     

基于策略的DNS及其配置

DNS(domain name system,域名系统)主要用来提供域名与IP地址相互映射的网络服务。以某大学城双出口网络中DNS为应用实例,介绍了一种基于BIND9技术的策略DNS配置方法。对于同一域名的查询请求,DNS可根据其客户端源IP地址不同,返回不同的解析结果。     

Design issues and performance analysis for DSR routing with reclaim‐based caching in MANETs

Mobile ad hoc networks (MANETs) have been positioned as one of the most important emerging wireless communication scenarios. Temporally formed by a collection of wireless mobile hosts, a MANET does not require the aid of any centralized administration. From this stems a suite of challenges in achieving an efficient MANET routing and content delivery in order to make the best use of precious resources and reduce the routing overhead at each MANET host. One of the reported approaches for solving the issue is the use of caching, which is expected to minimize the routing overhead by taking advantage of the limited memory at each mobile host. This paper introduces a novel scheme for addressing the above issue, called Reclaim‐Based Caching (RBC) policy, which dynamically utilizes a cache replacement mechanism of reclaiming stale routes to efficiently verify and validate a recoverable caching mechanism in Dynamic Source Routing. The main design purposes of RBC are to reduce the routing control overhead, lower the end‐to‐end routing delay, enhance the packet delivery ratio, and obtain a higher throughput for improving routing performance and accelerating the Route Discovery process due to low temporary link failure and high cache utilization. Hence, we can gather all feasible and historical route information into the cache library to be reclaimed as a threshold of efficient routing control. Consequently, the proposed RBC of this paper can be used in the universal wireless network environment to achieve better routing performance and to provide a more flexible real‐time application. Copyright © 2009 John Wiley & Sons, Ltd.     

Limitations and benefits of cooperative proxy caching

Cooperating proxy caches are groups of HTTP proxy servers that organize to share cached objects. This paper develops analytical models for proxy cooperation which use speedup in user response time as the performance metric. Speedup expressions are derived for the cooperation upper bound, a proxy mesh, and a three-level proxy hierarchy. The equations compare fundamental design approaches by separating the proxy organization for object delivery from the mechanism for object discovery. Discovery mechanisms analyzed for the mesh and hierarchy models include ideal discovery, Internet cache protocol (ICP) query, and distributed metadata directories. Equations are evaluated using parameter estimates from experiments and from analysis of cache trace logs. Results indicate that proxy cooperation is marginally viable from the standpoint of average user response time, and that the miss penalty for the hierarchy renders it less viable than the mesh. Proxy cooperation can, however, reduce the variability in user response time and the number of long delays. A trace-driven simulation shows that caching constraints have little effect on cooperation performance due to request filtering by lower level caches.     

域名系统的部署及安全性分析与建议

针对传统DNS结构可能存在的问题,为应对分布式拒绝服务攻击行为,提出了基于AnyCast的DNS部署方式,以进一步提高DNS的可靠性和性能。从DNS服务技术层面和域名注册业务流程等环节对域名系统进行了安全性分析,并提出了一些安全性建议。     

NDS服务器的配置与优化

所讨论的就是在齐齐哈尔大学校园网和教育教学科研网接口带宽有限的前提下，怎样通过优化校园网络主DNS服务器的配置，实现域名解析后的超链接子操作在公网上进行，从而提高对学校WWW等服务器访问的速度。     

Minimizing information leakage in the DNS

The domain name system is the global lookup service for network resources. To protect DNS information, the DNS security extensions have been developed and deployed on branches of the DNS to provide authentication and integrity protection using digital signatures. However, signed DNS nodes were found to have an unfortunate side effect: an attacker can query them as reconnaissance before attacking hosts on a particular network. There are different ways a zone administrator can minimize information leakage and still take advantage of DNSSEC for integrity and source authentication. This article describes the risk and examines the protocol and operational options and looks at their advantages and drawbacks.     

Performance evaluation of DNS servers to build a benchmarking system of DNS64 implementations

DNS64 is an important IPv6 transition technology that facilitates the communication of an IPv6 only client with an IPv4 only server, which becomes a more and more common scenario. Several different DNS64 implementations exist, and their performance is a relevant decision factor for network operators. RFC 8219 has defined a benchmarking methodology for DNS64 servers, which requires the operation of an authoritative DNS server at 220% of the query rate used for DNS64 benchmarking. In this paper, we aim to build an authoritative DNS server that operates at 2.2 million qps (queries per second) rate, thus it facilitates DNS64 benchmarking up to 1,000,000 qps rate. To that end, we compare the performance of BIND, YADIFA, NSD, Knot DNS and FakeDNS (a special purpose software) to find the best suiting one of them. We fully disclose the details of our measurements including the configuration of the DNS implementations, the usage of our improved software tester called dns64perf?++, and the details of the hardware and software measurement environment in the NICT StarBED, Japan. We perform a series of measurements to examine, how the performance of the tested solutions scale up with the number of the active CPU cores from 1 to 32. Besides their performance, we also measure their memory consumption and zone load time. We present and discuss all the results. In addition to successfully building an authoritative DNS server with the required performance, we also make recommendations, which solutions suit to different special needs.

     

Proxy caching for media streaming over the Internet

Streaming media has contributed to a significant amount of today's Internet traffic. Like conventional Web objects (e.g., HTML pages and images), media objects can benefit from proxy caching; but their unique features such as huge size and high bandwidth demand imply that conventional proxy caching strategies have to be substantially revised. This article discusses the critical issues and challenges of cache management for proxy-assisted media streaming. We survey, classify, and compare the state-of-the-art solutions. We also investigate advanced issues of combining multicast with caching, cooperating among proxies, and leveraging proxy caching in overlay networks.     

DNS欺骗攻击的检测与防御

DNS在为Internet的正常运行提供可靠保障的同时也遭受来自网络的欺骗攻击威胁,DNS攻击具有隐秘性强、打击面大、攻击效果明显的特点。文章分析了DNS系统解析流程、DNS欺骗攻击原理和分类,并列出常见的欺骗攻击方式,提出不同检测方法,讨论了针对DNS欺骗攻击的防范策略,对提高DNS抗欺骗攻击能力具有明显效果。     

一种DNS DDoS攻击行为的分析及其应对措施

随着互联网业务的迅猛发展,网络安全问题也越来越突出。对一种针对DNS系统的危害巨大DDoS攻击行为进行了分析,并研究探讨有效的DDoS流量自动抑制系统设计、部署方案。