自治域生态系统的对等连接行为分析

传统网络行为分析忽视了自治域的经济特性对网络结构产生的影响。从成本收益的角度分析了不同类型自治域的对等连接行为。通过PeeringDB提供的样本数据，首先统计域间流量分布情况，给出不同类型自治域的对等连接偏好。结果表明，传输服务提供商和接入服务提供商的域间流量与对等连接策略之间存在较强的关联，而内容服务提供商的域间流量与对等连接策略的关联性较弱，主要采取开放式对等连接。根据服务提供商在信息流传输中的作用，分析了经济环境下自治域采取对等连接策略的主要原因，提出自治域是由网络结构、域间流量和成本收益相互影响的生态系统。     

A game–theoretic analysis of the implications of overlay network traffic on ISP peering

Inter-ISP traffic flow determines the settlement between ISPs and affects the perceived performance of ISP services. In today’s Internet, the inter-ISP traffic flow patterns are controlled not only by ISPs’ policy-based routing configuration and traffic engineering, but also by application layer routing. The goal of this paper is to study the economic implications of this shift in Internet traffic control assuming rational ISPs and subscribers. For this purpose, we build a general traffic model that predicts traffic patterns based on subscriber distribution and abstract traffic controls such as caching functions and performance sensitivity functions. We also build a game–theoretic model of subscribers picking ISPs, and ISPs making provisioning and peering decisions. In particular, we apply this to a local market where two ISPs compete for market share of subscribers under two traffic patterns: “Web” and “P2P overlay”, that typifies the transition the current Internet is going through. Our methodology can be used to quantitatively demonstrate that (1) while economy of scale is the predominant property of the competitive ISP market, P2P traffic may introduce unfair distribution of peering benefit (i.e. free-riding); (2) the large ISP can restore more fairness by reducing its private capacity (bandwidth throttling), which has the drawback of hurting business growth; and (3) ISPs can reduce the level of peering (e.g. by reducing peering bandwidth) to restore more fairness, but this has the side-effect of also reducing the ISPs’ collective bargaining power towards subscribers.     

A geographic directed preferential internet topology model

The goal of this work is to model the peering arrangements between Autonomous Systems (ASes). Most existing models of the AS-graph assume an undirected graph. However, peering arrangements are mostly asymmetric customer–provider arrangements, which are better modeled as directed edges. Furthermore, it is well known that the AS-graph, and in particular its clustering structure, is influenced by geography.We introduce a new model that describes the AS-graph as a directed graph, with an edge going from the customer to the provider, but also models symmetric peer-to-peer arrangements, and takes geography into account. We are able to mathematically analyze its power-law exponent and number of leaves. Beyond the analysis, we have implemented our model as a synthetic network generator we call GdTang. Experimentation with GdTang shows that the networks it produces are more realistic than those generated by other network generators, in terms of its power-law exponent, fractions of customer–provider and symmetric peering arrangements, and the size of its dense core. We believe that our model is the first to manifest realistic regional dense cores that have a clear geographic flavor. Our synthetic networks also exhibit path inflation effects that are similar to those observed in the real AS graph.     

A VoIP Traffic Identification Scheme Based on Host and Flow Behavior Analysis

With the development of network and multimedia coding techniques, more and more Voice over Internet Protocol (VoIP) applications have emerged. The traffic identification on VoIP applications becomes an important issue in network management and traffic analysis. In this paper, a new traffic identification scheme, which combines traffic flow statistic analysis with host behavior estimation, is proposed to identify the VoIP traffic at the transport layer of the Internet. The host IP addresses and the port numbers are examined as the host behavior to distinguish the VoIP traffic from traditional traffic flows. The packet size has been modeled by a function of entropy while the inter-packet time has been modeled by the self-adaptive estimation. The experiment results show that our scheme could obtain a stable performance. At the same time, the proposed scheme could maintain its validity when existing VoIP applications are updated or the new ones admitted. Both accuracy and flexibility can be improved.     

Adaptive Search Radius – Using hop count to reduce P2P traffic

Peer-to-Peer (P2P) file sharing accounts for a very significant part of the Internet’s traffic, affecting the performance of other applications and translating into significant peering costs for ISPs. It has been noticed that, just like WWW traffic, P2P file sharing traffic shows locality properties, which are not exploited by current P2P file sharing protocols.We propose a peer selection algorithm, Adaptive Search Radius (ASR), where peers exploit locality by only downloading from those other peers which are nearest (in network hops). ASR ensures swarm robustness by dynamically adapting the distance according to file part availability. ASR aims at reducing the Internet’s P2P file sharing traffic, while decreasing the download times perceived by users, providing them with an incentive to adopt this algorithm. We believe ASR to be the first locality-aware P2P file sharing system that does not require assistance from ISPs or third parties nor modification to the server infrastructure.We support our proposal with extensive simulation studies, using the eDonkey/eMule protocol on SSFNet. These show a 19 to 29% decrease in download time and a 27 to 70% reduction in the traffic carried by tier-1 ISPs. ASR is also compared (favourably) with Biased Neighbour Selection (BNS), and traffic shaping. We conclude that ASR and BNS are complementary solutions which provide the highest performance when combined. We evaluated the impact of P2P file sharing traffic on HTTP traffic, showing the benefits on HTTP performance of reducing P2P traffic.A plan for introducing ASR into eMule clients is also discussed. This will allow a progressive migration to ASR enabled versions of eMule client software.ASR was also successfully used to download from live Internet swarms, providing significant traffic savings while finishing downloads faster.     

Interaction of ISPs: Distributed Resource Allocation and Revenue Maximization

The Internet is a hierarchical architecture comprising heterogeneous entities of privately owned infrastructures, where higher level Internet service providers (ISPs) supply connectivity to the local ISPs and charge the local ISPs for the transit services. One of the challenging problems facing service providers today is how the profitability can be increased while maintaining good service qualities as the network scales up. In this work, we seek to understand the fundamental issues on the "interplay" (or interaction) between ISPs at different tiers. Although the local ISPs (which we term peers) can communicate with each other by purchasing the connectivity from transit ISPs, there stands an opportunity for them to set up private peering relationships. Under this competitive framework, we explore the issues on 1) the impact of peering relationship; 2) resource distribution; 3) revenue maximization; and 4) condition for network upgrade. First, a generalized model is presented to characterize the behaviors of peers and the transit ISP, in which their economic interests are reflected. We study how a peer can distributively determine its optimal peering strategy. Furthermore, we show how a transit ISP is able to utilize the available information to infer its optimal pricing strategy, under which a revenue maximization is achieved. Two distributed algorithms are proposed to help ISPs to provide a fair and efficient bandwidth allocation to peers, avoiding a resource monopolization of the market. Last, we investigate the above issues in a "many-peers region," that is, when we scale up the network. We provide insightful evidence to show that the ISPs can still gain profits as they upgrade the network infrastructures. Extensive simulations are carried out to support our theoretical claims.     

Dynamic admission control in hybrid QoS networks with WiFi access

Recent developments in the IEEE 802.11 standardizations[1] have been successful to offer high-speed data services. Hence, traffic classes (e.g. VoIP or video-conference) with different QoS requirements will be provided in future wireless LANs (WLAN). Sinc…     

Characterization of community based-P2P systems and implications for traffic localization

In this paper, we present one of the first and most extensive characterizations of closed community-based P2P systems. Such systems are organic groups of peer-to-peer (P2P) clients, which can be joined only by users belonging to a certain network (e.g., connected to a given Internet Service Provider (ISP)). A number of factors motivate the growth of these communities, such as quality of content, anonymity of transfers, and the potential for better performance that enhances user experience. Our study is conducted in two contrasting environments—a campus network and a national ISP—located in different continents. In both cases, large-scale closed communities have been found to be the predominant P2P systems in use. We shed light both on the factors motivating the growth of such communities, and present results characterizing the extensiveness of their usage, the performance achievable by the systems, and the implications of such communities for network providers. While our findings are interesting in their own right, they also offer important lessons for ongoing research that seeks to localize traffic within ISP boundaries. In particular, our results suggest that (i) in ISPs with heterogeneous access technologies, the performance benefits to users on localizing P2P traffic is largely dependent on the degree of seed-like behavior of peers behind high-bandwidth access technologies; and (ii) while localization can reduce the traffic on Internet peering links, it has the potential to cause a significant increase in traffic on internal links of providers, potentially requiring upgrades of network links.     

IDSIC: an intrusion detection system with identification capability

Security is an important but challenging issue in current network environments. With the growth of Internet, application systems in enterprises may suffer from new security threats caused by external intruders. This situation results in the introduction of security auditors (SAs) who perform some test methods with hacking tools the same as or similar to those used by hackers. However, current intrusion detection systems (IDSs) do not consider the role of security auditors despite its importance. This causes IDSs to generate many annoying alarms. In this paper, we are motivated to extend a current IDS functionality with Identification Capability, called IDSIC, based on the auditing viewpoint to separate auditing traffic from malicious attacks. The IDSIC architecture includes two components: fingerprint adder and fingerprint checker, which can provide a separability of security auditors and hackers. With this architecture, we show that IDSICs can lower the consequential costs in the current IDSs. Therefore, such IDSICs can ensure a more stable system performance during the security examination process.     

Internet 流量模型分析与评述

Internet流量模型对网络性能管理、QoS、准入控制等都有很重要的意义和作用.首先总结了现阶段已发现的主要网络流量的特性及相关度量参数,概要地介绍网络流量建模的意义和分类,然后按照"传统-自相似-流量建模的新发展"这3个阶段阐述网络流量建模的发展历程与最新的研究成果,最后针对目前网络流量建模中存在的难点问题,展望了该领域未来的研究发展方向.     

Detecting Network Attacks in the Internet via Statistical Network Traffic Normality Prediction

The information technology advances that provide new capabilities to the network users and providers, also provide powerful new tools for network intruders that intend to launch attacks on critical information resources. In this paper we present a novel network attack diagnostic methodology, based on the characterization of the dynamic statistical properties of normal network traffic. The ability to detect network anomalies and attacks as unacceptable when significant deviations from the expected behavior occurs. Specifically, to provide an accurate identification of the normal network traffic behavior, we first develop an anomaly-tolerant nonstationary traffic prediction technique that is capable of removing both single pulse and continuous anomalies. Furthermore, we introduce and design dynamic thresholds, where we define adaptive anomaly violation conditions as a combined function of both magnitude and duration of the traffic deviations. Finally numerical results are presented that demonstrate the operational effectiveness and efficiency of the proposed approach under the presence of different attacks, such as mail-bombing attacks and UDP flooding attacks.     

一种无线Ad Hoc网络的区分服务体系结构

提供服务质量保证是目前无线ad hoc网络的研究热点.本文对将区分服务应用于无线ad hoc网络进行了阐述,提出了一种应用于无线ad hoc网络的区分服务体系结构,最后进行了仿真验证.仿真结果证明,在无线ad hoc网络中区分服务可以在资源不够用的情况下,降低对低优先级的业务流的服务,保证对高优先级的业务流的服务,从而使得高优先级的业务流获得较大的吞吐量和较低的延迟.     

Clustering botnet communication traffic based on n-gram feature selection

Recognized as one the most serious security threats on current Internet infrastructure, botnets can not only be implemented by existing well known applications, e.g. IRC, HTTP, or Peer-to-Peer, but also can be constructed by unknown or creative applications, which makes the botnet detection a challenging problem. Previous attempts for detecting botnets are mostly to examine traffic content for bot command on selected network links or by setting up honeypots. Traffic content, however, can be encrypted with the evolution of botnet, and as a result leading to a fail of content based detection approaches. In this paper, we address this issue and propose a new approach for detecting and clustering botnet traffic on large-scale network application communities, in which we first classify the network traffic into different applications by using traffic payload signatures, and then a novel decision tree model is used to classify those traffic to be unknown by the payload content (e.g. encrypted traffic) into known application communities where network traffic is clustered based on n-gram features selected and extracted from the content of network flows in order to differentiate the malicious botnet traffic created by bots from normal traffic generated by human beings on each specific application. We evaluate our approach with seven different traffic trace collected on three different network links and results show the proposed approach successfully detects two IRC botnet traffic traces with a high detection rate and an acceptable low false alarm rate.     

Towards capturing representative AS-level Internet topologies

Recent studies on AS-level Internet connectivity have attracted considerable attention. These studies have exclusively relied on BGP data from the Oregon route-views [University of Oregon Route Views Project, http://www.routeviews.org] to derive some unexpected and intriguing results. The Oregon route-views data sets reflect AS peering relationships, as reported by BGP, seen from a handful of vantage points in the global Internet. The possibility that these data sets may provide only a very sketchy picture of the complete inter-AS connectivity of the Internet has received little scrutiny. By augmenting the Oregon route-views data with BGP summary information from a large number of Internet Looking Glass sites and with routing policy information from Internet Routing Registry (IRR) databases, we find that (1) a significant number of existing AS peering relationships remain hidden from most BGP routing tables, (2) the AS peering relationships with tier-1 ASs are in general more easily observed than those with non-tier-1 ASs, and (3) there are at least about 40% more AS peering relationships in the Internet than commonly-used BGP-derived AS maps reveal (but only about 4% more ASs). These findings point out the need for continuously questioning the applicability and completeness of data sets at hand when establishing the generality of any particular Internet-specific observation and for assessing its (in)sensitivity to deficiencies in the measurements.     

Performance evaluation of peering-agreements among autonomous systems subject to peer-to-peer traffic

The interconnection of thousands of Autonomous Systems (ASs) makes up the Internet. Each AS shares trade agreements with its neighbors that regulate the costs associated with traffic exchanged on the physical links. These agreements are local, i.e., are settled only between directly connected ASs, but have a global impact by influencing the paths allowed for the routing of network packets and the costs associated with these routes. Indeed, the costs and earnings of interconnected ASs is a function of many factors, such as size of the ASs, existing agreements, routing policy, traffic pattern and AS-level topology. In this paper we present an approach that takes these factors into account to assess peering and transit agreements. Here we focus on traffic generated from P2P activities, but the approach is general enough to be applied to different traffic classes. The P2P model we present is based on the use of the generating function, it allows to perform an analytical study of the traffic associated to file-sharing. The proposed P2P model is able to consider a large number of peers sharing several resources, spread along different ASs connected through a series of links. We validate the results of our P2P model against one of the most widely used P2P simulators, i.e. PeerSim. Using both the AS-level and P2P models we evaluate how the inter-AS P2P traffic influences the AS network cost and earning.     

Management,control, and design of integrated networks with real-time dynamic routing

Integrated real-time dynamic routing (IRR) networks provide dynamic routing features for multiple classes-of-service on an integrated transport network. In this paper it is shown that IRR networks allow reduced network management costs since with real-time dynamic routing a number of network operations are simplified or eliminated. These simplifications include eliminating the storage of voluminous routing tables in the network switches, eliminating the calculation of routing tables in network design, simplifying the routing administration operations which require downloading new routing information to the network, and eliminating the automatic rerouting function in on-line traffic management. A new bandwidth allocation technique is described here which is based on the optimal solution of a network bandwidth allocation model for IRR networks. The model achieves significant improvement in both the average network blocking and node pair blocking distribution when the network is in a congested state such as under peak-day loads. In a paper to appear in the next Journal issue we further describe a new algorithm for the transport design of IRR networks which achieves near-optimal capacity engineering. These optimization techniques attain significant capital cost reductions and network performance improvements by properly modeling the more efficient operation of IRR networks.     

基于负荷-容量模型的网络相继故障研究

网络相继故障是网络脆弱性研究中的热点问题.采用负荷-容量模型对复杂网络的相继故障进行建模分析.首先分析了网络流量负荷的突发模式对相继故障的影响.实证研究发现,网络实体间的通信活跃性具有自组织临界性.在网络安全地应急响应时,应该更关注那些原本不活跃的结点间流量的变化;其次,引入成本因子对经济、技术条件制约下的网络资源受限生成过程及网络容量-负荷关系建模,以揭示网络结点的容量-负荷之间存在着怎样的制约关系;最后提出了一种基于容量相互补偿的搜索式分配算法,以获得有限资源下最优的网络鲁棒性容量分配策略.实验证明,算法能够找到比线性分配或偏好负荷的偏好依附分配策略更好的结果.     

A P4P-integrated data-driven P2P system for the live multimedia streaming service

The Proactive network Provider Participation for the P2P (P4P) architecture deploys central servers, which perceives network status and provides peering suggestions to P2P systems in order to achieve better network resource utilization while supporting best possible application performance. However, P4P alone may not be able to make appropriate peering suggestions for live multimedia streaming since it does not include mechanisms to reflect some of the parameters that are important to the QoS of live multimedia streaming such as upload bandwidth and stability of a peer as a stream deliverer. Furthermore, peer synchronization and parent replacement in the middle of a session, which are critical issues to the QoS of live multimedia streaming, are also left as the matters to be dealt with by the P2P systems alone. Most of the existing data-driven P2P systems leverage periodic information exchanges among neighboring peers in order to cope with these problems, which may incur long delay and high control overhead. In this paper, we proposed P4P-integrated data-driven P2P system for live multimedia streaming service. The proposed system includes not only the peering suggestion mechanism appropriate for live multimedia streaming but also the peer synchronization and parent replacement mechanisms, which exploit the centralized P4P framework and do not require periodic control information exchanges. We implemented the system in NS-2 simulator and compared its performance to the P4P and existing data-driven P2P systems. The results from experiments show that the proposed system enhances QoS compared to the existing data-driven P2P systems while maintaining the same level of network efficiency of the original P4P.     

A general framework for modeling shared autonomous vehicles with dynamic network-loading and dynamic ride-sharing application

Shared autonomous vehicles (SAVs) could provide low-cost service to travelers and possibly replace the need for personal vehicles. Previous studies found that each SAV could service multiple travelers, but many used unrealistic congestion models, networks, and/or travel demands. The purpose of this paper is to provide a method for future research to use realistic flow models to obtain more accurate predictions about SAV benefits. This paper presents an event-based framework for implementing SAV behavior in existing traffic simulation models. We demonstrate this framework in a cell transmission model-based dynamic network loading simulator. We also study a heuristic approach for dynamic ride-sharing. We compared personal vehicles and SAV scenarios on the downtown Austin city network. Without dynamic ride-sharing, the additional empty repositioning trips made by SAVs increased congestion and travel times. However, dynamic ride-sharing resulted in travel times comparable to those of personal vehicles because ride-sharing reduced vehicular demand. Overall, the results show that using realistic traffic flow models greatly affects the predictions of how SAVs will affect traffic congestion and travel patterns. Future work should use a framework such as the one in this paper to integrate SAVs with established traffic flow simulators.     

一个网络管理软件中基于自适应的流量预测

传统的基于流量的网络报警系统往往根据系统配置的固定阈值来判断当前网络流量是否正常,通过运用统计学和预测学对网络流量预测方法进行研究。提出了一种能根据网络实际流量状态自己调整阈值的新型网络报警机制,能有效地发现网络流量异常,从而为评估和优化网络性能提供有力的依据。