Search

Despite their increasing popularity, blockchains still suffer from severe scalability limitations. Recently, Ethereum proposed a novel approach to block validation based on Data Availability Sampling (DAS), that has the potential to improve its transaction per second rate by more than two orders of magnitude. DAS should also significantly reduce per-transaction validation costs. At the same time, DAS introduces new communication patterns in the Ethereum Peer-to-Peer (P2P) network. These drastically increase the amount of exchanged data and impose stringent latency objectives. In this paper, we review the new requirements for P2P networking associated with DAS, discuss open challenges, and identify new research directions.

The increasing number of attacks against automation systems such as SCADA and their network infrastructure have demonstrated that there is a need to secure those systems. Unfortunately, directly applying existing ICT security mechanisms to automation systems is hard due to constraints of the latter, such as availability requirements or limitations of the hardware. Thus, the solution privileged by researchers is the use of network-based intrusion detection systems (N-IDS). One of the issue that many researchers encounter is how to validate and evaluate their N-IDS. Having access to a real and large automation systems for experimentation is almost impossible as companies are not inclined to give access to their systems due to obvious concerns. The few public traffic datasets that could be used for off-line experiments are either synthetic or collected at small testbeds. In this paper, we will describe and characterize a public traffic dataset collected at the HVAC management system of a university campus. Although the dataset contains only packet headers, we believe that it can help researchers, in particular designers of flow-based IDS, to validate their solutions under more realistic conditions. The traces can be found on https://github.com/gkabasele/HVAC_Traces.

The Internet of Things leads to the inter-connectivity of a wide range of devices. This heterogeneity of hardware and software poses significant challenges to security. Constrained IoT devices often do not have enough resources to carry the overhead of an intrusion protection system or complex security protocols. A typical initial step in network security is a network scan in order to find vulnerable nodes. In the context of IoT, the initiator of the scan can be particularly interested in finding constrained devices, assuming that they are easier targets. In IoT networks hosting devices of various types, performing a scan with a high discovery rate can be a challenging task, since low-power networks such as IEEE 802.15.4 are easily overloaded. In this paper, we propose an approach to increase the efficiency of network scans by combining them with active network measurements. The measurements allow the scanner to differentiate IoT nodes by the used network technology. We show that the knowledge gained from this differentiation can be used to control the scan strategy in order to reduce probe losses.

The increasing number of network attacks causes growing problems for network operators and users. Not only do these attacks pose direct security threats to our infrastructure, but they may also lead to service degradation, due to the massive traffic volume variations that are possible during such attacks. The recent spread of Gbps network technology made the problem of detecting these attacks harder, since existing packet-based monitoring and intrusion detection systems do not scale well to Gigabit speeds. Therefore the attention of the scientific community is shifting towards the possible use of aggregated traffic metrics. The goal of this paper is to investigate how malicious traffic can be characterized on the basis of such aggregated metrics, in particular by using flow, packet and byte frequency variations over time. The contribution of this paper is that it shows, based on a number of real case studies on high-speed networks, that all three metrics may be necessary for proper time series anomaly characterization.

Swarm robotic systems rely heavily on dynamic interactions to provide interoperability between the different autonomous robots. In current systems, interactions between robots are programmed into the applications controlling them. Incorporating service discovery into these applications allows the robots to dynamically discover other devices. However, since most of these mechanisms use syntax-based matching, the robots cannot reason about the offered functionality. Moreover, as contextual information is often not included in the matching process, it is impossible for robots to select the most suitable device under the current context. This paper aims to tackle these issues by proposing a framework for semantic service discovery in a dynamically changing environment. A semantic layer was added to an existing discovery protocol, offering a semantic interface. Using this framework, services can be searched based on what they offer, with services best suiting the current context yielding the highest matching scores.

Since its inception in the 60's, the Internet has evolved from a nationwide network interconnecting a handful of nodes, to a worldwide system interconnecting billion of devices. While the network has dramatically expanded in size, it has also grown in term of adoption. In the age of the Internet of Things, everything and everyone is heavily connected to the interconnected network. This growth came with a cost for service providers: the user's expectation in terms of reliability and performances. To achieve reliability and performance, network operators and engineers designed redundant systems and tried to balance the load across the network's different paths. While adding redundant paths into the network was already a challenge, a greater one awaited: efficiently using them. This thesis is a contribution to improve different solutions and leverage the path diversity, especially in datacenters and enterprise networks. First, we improve Multipath TCP to make it compatible with current load-balancers, solving a problem that has been hindering its deployment. Furthermore, we show that the same approach enables anycast Multipath TCP services, a major benefit given the difficulty of deploying anycast TCP services. We implement these modifications in the Linux kernel and demonstrate its benefits with several micro-benchmarks. We also enable network functions that operate on the bytestream rather than on a per-packet basis by extending the implementation of IPv6 Segment Routing. This enables network architects to design end-to-end services as a series of in-network functions. The measurements realized with our implementation in the Linux kernel indicate that our architecture is well suited to support middle-boxes that process bytestreams. Finally, this thesis leverages eBPF and IPv6 Segment routing to allow transport protocols to benefit from the path diversity in datacenters and enterprise networks. We implement this architecture and shows that eBPF can be used to dynamically change the path used by a TCP ow with IPv6 Segment routing. This enables improvements to transport protocols by allowing their internal state (Round-Trip-Time, loss rate, ...) to influence the path used in the network. To allow these ideas to have an impact, the contributions of this thesis have been implemented and evaluated. The code is open source and the suggested modifications to the protocols have been standardized by the IETF. These contributions open new perspectives to efficiently use the multi-path networks of the 21th century. (FSA - Sciences de l'ingénieur) -- UCL, 2019

Since its inception in the early 70’s, the Internet has expanded to interconnect billions of computers. The last decade has seen the rise of multi-connected devices, such as smartphones that can attach to both Wi-Fi and cellular networks. Endhosts can leverage this availability of multiple network paths in two major ways. First, they can aggregate the bandwidth of the available networks. Second, they can support seamless network handover when one of the network paths fails. Applications rely on transport protocols to carry data between endhosts. These applications can have various requirements. While simple bulk transfers want to complete as fast as possible, interactive applications (such as voice-activated ones) have strict latency constraints, especially under mobile conditions. Furthermore, the device user might enforce additional constraints, such as limiting the cellular usage on smartphone for both monetary and energy purposes. This thesis explores how multipath transport protocols can adapt to their serving use cases. First, we quantify the performance of the state-of-the-art Multipath TCP on smartphones by performing two measurement campaigns. Second, based on our previous findings, we tune Multipath TCP for the smartphone use case and evaluate it with real Android phones. Next, we focus on the emerging QUIC protocol, design two versions for its Multipath extensions and evaluate their benefits in various scenarios. Finally, we reconsider the architecture of transport protocols such as their operations can be finely customized on a per-connection basis thanks to the dynamic injection of plugins. (FSA - Sciences de l'ingénieur) -- UCL, 2020