Search

In future mobile networks, new technologies will be needed to enable a mobile host to move across heterogeneous wireless access networks without disruption of the connection. In the past, many researchers have studied handover in such IP networks. In almost all cases, special network devices are needed to maintain the host's mobility. Moreover, a host cannot move across heterogeneous wireless access networks without degradation of the goodput for real-time communication, although a mobile host with multiple network interfaces can connect to multiple wireless access networks. For these reasons, we consider that a mobile host needs to manage seamless handover on an end-to-end basis. In this paper, we propose a multi-path transmission algorithm for end-to-end seamless handover. The main purpose of this algorithm is to improve the goodput during handover by sending the same packets along multiple paths, minimizing unnecessary consumption of network resources. We evaluate our algorithm through simulations and show that a mobile host gains a better goodput.

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The Bloom Filter (BF), a space-and-time-efficient hashcoding method, is used as one of the fundamental modules in several network processing algorithms and applications such as route lookups, cache hits, packet classification, per-flow state management or network monitoring. BF is a simple space-efficient randomized data structure used to represent a data set in order to support membership queries. However, BF generates false positives, and cannot count the number of distinct elements. A counting Bloom Filter (CBF) can count the number of distinct elements, but CBF needs more space than BF. We propose an alternative data structure of CBF, and we called this structure an Adaptive Bloom Filter (ABF). Although ABF uses the same-sized bit-vector used in BF, the number of hash functions employed by ABF is dynamically changed to record the number of appearances of a each key element. Considering the hash collisions, the multiplicity of a each key element on ABF can be estimated from the number of hash functions used to decode the membership of the each key element. Although ABF can realize the same functionality as CBF, ABF requires the same memory size as BF. We describe the construction of ABF and IABF (Improved ABF), and provide a mathematical analysis and simulation using Zipfs distribution. Finally, we show that ABF can be used for an unpredictable data set such as real network traffic.

Building an experimental network within a testbed has been a tiresome process for experimenters, due to the complexity of the physical resource assignment and the configuration overhead. Also, the process could not be expedited across testbeds, because the syntax of a configuration file varies depending on specific hardware and software. Re-configuration of an experimental topology for each testbed wastes time, an experimenter could not carry out his/her experiments during the limited lease time of a testbed at worst. In this paper, we propose the AnyBed: the experimental network-building system. The conceptual idea of AnyBed is “If experimental network topologies can be portable across any kinds of testbed, then, it would expedite building an experimental network on a testbed while manipulating experiments by each testbed support tool”. To achieve this concept, AnyBed divide an experimental network configuration into the logical and physical network topologies. Mapping these two topologies, AnyBed can build intended logical network topology on any PC clusters. We have evaluated the AnyBed implementation using two distinct clusters. The evaluation result shows a BGP topology with 150 nodes can be constructed on a large scale testbed in less than 113 seconds.

Polling I/O mechanisms on the Unix platform such as select() and poll() cause high processing overhead when they are used in a heavily-loaded network server with many concurrent open sockets. Large waste of processing power incurs not only service degradation but also various troubles such as high electronic power consumption and worsened MTBF of server hosts. It is thus a serious issue especially in large-scale service providers such as an Internet data center (iDC) where a great number of heavily-loaded network servers are operated. As a solution of this problem, we propose a technique of fine-grained control on the invocation intervals of the polling I/O function. The uniqueness of this study is the utilization of POSIX real-time scheduling to enable the fine-grained execution control. Although earlier solutions such as an explicit event delivery mechanism also addressed the problem, they require major modification in the OS kernel and transition from the traditional polling I/O model to the new explicit event-notification model. On the other hand, our technique can be implemented with low cost because it just inserts a few small blocks of codes into the server program and does not require any modification in the OS kernel.

Due to millions of loosely coupled devices, the smart-home security is gaining the attention of industry professionals, attackers, and academic researchers. The smart home is a typical home where many sensors, actuators, and IoT devices are used to automate home users’ daily activities. Although a smart home provides comfort, safety, and satisfaction to users, it opens up multiple challenging security issues when automating and offering intelligent services. Recent studies have investigated not only blockchain but SDN and NFV to address these challenges. We present a comprehensive survey on blockchain, SDN, and NFV for smart-home security. The paper also proposes a new architecture of the smart-home security. First, we describe the features of the smart home and its current security issues. Next, we outline the characteristics of blockchain, SDN, and NFV, including their contribution to improving the smart-home security. While SDN enhances the management and access control of the home network by providing a programmable controller to home nodes, NFV implements the functions of network appliances (e.g., network monitoring, firewall) as virtual machines and ensures the high availability of the network. Blockchain reinforces IoT data's privacy, integrity, and security and improves the trust in transactions among untrusted IoT devices. Finally, we discuss open issues and challenges in the field and propose recommendations towards high-level security for the smart home.

With the emergence of new applications that have very low latency (i.e. augmented reality, virtual reality, tactile Internet, etc.), it is very important to propose new solutions to meet these requirements. In addition, with the amount of data generated by these applications in edge computing systems, where resources are limited, the question of automated resource allocation is an important issue for the management of these services. Besides, Edge Computing (EC) systems such as Home Edge Computing (HEC) is one of the architectures which makes it possible to meet these expectations thanks to the proximity of its servers to end-users. HEC is a new architecture of edge computing with three levels of server organization (HEC-MEC-Cloud), that allows us to reduce the communication delay. Unfortunately, these HEC servers that are close to the devices are very limited in terms of resources. In addition, with the amount of data generated by users on these home servers and the current resource management system in this HEC architecture, compliance with the requirements, such as the ultra-low latency (between 1 to 10 ms) and the throughput, for these applications become very difficult especially in certain situations where the network is overload by the traffic from users. In this paper, we propose a dynamically automated resource allocation method in the HEC-SDN architecture. This resource allocation proposal allows the HEC architecture to be integrated with Software Defined Networking (SDN) technology to centralize management and control. In addition, we propose a load balancing technique called Dynamic Load Balancing Algorithm for HEC-SDN systems (D-LBAH) which has a positive effect on reducing latency on the communication between end devices. Thus, the simulation results show that D-LBAH effectively reduces latency to 88.91 %, and improves throughput to 28.48% on the HEC-SDN architecture.

The proliferation of the Internet of Things (IoT) applications and devices make human life more comfortable by employing automation in daily operations. These applications are typically deployed in the cloud to offer diverse and healthy services to the users. Due to the inherent demand for low response time, applications need to be secure and closer to the users. However, there is a lack of solutions for assessing and protecting IoT applications against Very Short Intermittent Distributed Denial of Service (VSI-DDoS) attacks. Such attacks send intermittent bursts (in tens of milliseconds) of legitimate HTTP requests to the target services for degrading providers Quality of Service (QoS). Because of the stealthy nature of VSI-DDoS, it is challenging to pinpoint the root-cause when the system resource usage remains at a moderate level. We propose a 1D-CNN-based deep learning method for detecting VSI-DDoS attacks in IoT applications to ensure secure services towards users. The experimental evaluation on both testbed and benchmark datasets proves that our method achieves better detection accuracy, 0.07%–33.15%, than baseline approaches.

Science Information Network (SINET) is a Japanese academic backbone network for more than 800 research institutions and universities. In this paper, we present a multi-GPU-driven pipeline for handling huge session data of SINET. Our pipeline consists of ELK stack, multi-GPU server, and Splunk. A multi-GPU server is responsible for two procedures: discrimination and histogramming. Discrimination is dividing session data into ingoing/outgoing with subnet mask calculation and network address matching. Histogramming is grouping ingoing/outgoing session data into bins with map-reduce. In our architecture, we use GPU for the acceleration of ingress/egress discrimination of session data. Also, we use a tiling design pattern for building a two-stage map-reduce of CPU and GPU. Our multi-GPU-driven pipeline has succeeded in processing huge workloads of about 1.2 to 1.6 billion session streams (500GB-650GB) within 24 hours., Comment: This is an Accepted Manuscript of an article published by Taylor & Francis Group in the International Journal of Parallel, Emergent & Distributed Systems on 24/06/2021 av lable online: http://www.tandfonline.com/ DOI: 10.1080/17445760.2021.1941009

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The modern automobile is a complex piece of technology that uses the Controller Area Network (CAN) bus system as a central system for managing the communication between the electronic control units (ECUs). Despite its central importance, the CAN bus system does not support authentication and authorization mechanisms, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways including Denial of Service (DoS), Fuzzing and Spoofing attacks. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We generate our own dataset by first extracting attack-free data from our experimental car and by injecting attacks into the latter and collecting the dataset. We use the dataset for testing and training our model. With our selected hyper-parameter values, our results demonstrate that our classifier is efficient in detecting the CAN bus network attacks, we achieved an overall detection accuracy of 99.995%. We also compare the proposed LSTM method with the Survival Analysis for automobile IDS dataset which is developed by the Hacking and Countermeasure Research Lab, Korea. Our proposed LSTM model achieves a higher detection rate than the Survival Analysis method., identifier:2169-3536

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

The modern automobile is a complex piece of technology that uses the Controller Area Network (CAN) bus system as a central system for managing the communication between the electronic control units (ECUs). Despite its central importance, the CAN bus system does not support authentication and authorization mechanisms, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways including Denial of Service (DoS), Fuzzing and Spoofing attacks. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We generate our own dataset by first extracting attack-free data from our experimental car and by injecting attacks into the latter and collecting the dataset. We use the dataset for testing and training our model. With our selected hyper-parameter values, our results demonstrate that our classifier is efficient in detecting the CAN bus network attacks, we achieved an overall detection accuracy of 99.995%. We also compare the proposed LSTM method with the Survival Analysis for automobile IDS dataset which is developed by the Hacking and Countermeasure Research Lab, Korea. Our proposed LSTM model achieves a higher detection rate than the Survival Analysis method.

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios., journal article

The modern automobile is a complex piece of technology that uses the Controller Area Network (CAN) bus system as a central system for managing the communication between the electronic control units (ECUs). Despite its central importance, the CAN bus system does not support authentication and authorization mechanisms, i.e., CAN messages are broadcast without basic security features. As a result, it is easy for attackers to launch attacks at the CAN bus network system. Attackers can compromise the CAN bus system in several ways including Denial of Service (DoS), Fuzzing and Spoofing attacks. It is imperative to devise methodologies to protect modern cars against the aforementioned attacks. In this paper, we propose a Long Short-Term Memory (LSTM)-based Intrusion Detection System (IDS) to detect and mitigate the CAN bus network attacks. We generate our own dataset by first extracting attack-free data from our experimental car and by injecting attacks into the latter and collecting the dataset. We use the dataset for testing and training our model. With our selected hyper-parameter values, our results demonstrate that our classifier is efficient in detecting the CAN bus network attacks, we achieved an overall detection accuracy of 99.995%. We also compare the proposed LSTM method with the Survival Analysis for automobile IDS dataset which is developed by the Hacking and Countermeasure Research Lab, Korea. Our proposed LSTM model achieves a higher detection rate than the Survival Analysis method., journal article

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

A Virtual Private Network (VPN) helps to mitigate security and privacy risks of data transmitting on unsecured network such as public Wi-Fi. However, despite awareness of public Wi-Fi risks becoming increasingly common, the use of VPN when using public Wi-Fi is low. To increase adoption, understanding factors driving user decision to adopt a VPN app is an important first step. This study is the first to achieve this objective using discrete choice experiments (DCEs) to elicit individual preferences of specific attributes of a VPN app. The experiments were run in the United Kingdom (UK) and Japan (JP). We first interviewed participants (15 UK, 17 JP) to identify common attributes of a VPN app which they considered important. The results were used to design and run a DCE in each country. Participants (149 UK, 94 JP) were shown a series of two hypothetical VPN apps, varying in features, and were asked to choose one which they preferred. Customer review rating, followed by price of a VPN app, significantly affected the decision to choose which VPN app to download and install. A change from a rating of 3 to 4-5 stars increased the probability of choosing an app by 33% in the UK and 14% in Japan. Unsurprisingly, price was a deterrent. Recommendations by friends, source of product reviews, and the presence of in-app ads also played a role but to a lesser extent. To actually use a VPN app, participants considered Internet speed, connection stability, battery level on mobile devices, and the presence of in-app ads as key drivers. Participants in the UK and in Japan prioritized these attributes differently, suggesting possible influences from cultural differences., Comment: First published in the 22nd International Conference on Information and Communications Security (ICICS 2020), Copenhagen, Denmark

The edge computing system attracts much more attention and is expected to satisfy ultra-low response time required by emerging IoT applications. Nevertheless, as there were problems on latency such as the emerging traffic requiring very sensitive delay, a new Edge Computing system architecture, namely Home Edge Computing (HEC) supporting these real-time applications has been proposed. HEC is a three-layer architecture made up of HEC servers, which are very close to users, Multi-access Edge Computing (MEC) servers and the central cloud. This paper proposes a solution to solve the problems of latency on HEC servers caused by their limited resources. The increase in the traffic rate creates a long queue on these servers, i.e., a raise in the processing time (delay) for requests. By leveraging, based on clustering and load balancing techniques, we propose a new technique called HEC-Clustering Balance. It allows us to distribute the requests hierarchically on the HEC clusters and another focus of the architecture to avoid congestion on a HEC server to reduce the latency. The results show that HEC-Clustering Balance is more efficient than baseline clustering and load balancing techniques. Thus, compared to the HEC architecture, we reduce the processing time on the HEC servers to 19% and 73% respectively on two experimental scenarios.

DDoS (Distributed Denial of Service) attacks pose a serious threat to the Internet as they use large numbers of zombie hosts to forward massive numbers of packets to the target host. Here, we present an adaptive boosting-based ensemble learning model for detecting low-and high-rate DDoS attacks by combining information divergence measures. Our model is trained against a baseline model that does not use labeled traffic data and draws on multiple baseline models developed in parallel to improve its accuracy. Incoming traffic is sampled time-periodically to characterize the normal behavior of input traffic. The model's performance is evaluated using the UmU testbed, MIT legitimate, and CAIDA DDoS datasets. We demonstrate that our model offers superior accuracy to established alternatives, reducing the incidence of false alarms and achieving an F1-score that is around 3% better than those of current state-of-the-art DDoS detection models.

Cloud datacenters are engineered to meet the requirements of generalised and specialised workloads including mission-critical applications that not only generate tremendous amounts of data traces but also opens opportunities for attackers. The increasing volume and rapid changing behaviour of metric streams (e.g., CPU, network, latency, memory) in the cloud datacenters create difficulties to ensure high availability, security, and performance to cloud service providers. Several anomaly detection techniques have been developed to combat system anomalies in cloud datacenters. By injecting a fraction of well-crafted malicious samples in cloud datacenter traces, attackers can subvert the learning process and results in unacceptable false alarms. These security issues cause threats to all categories of anomaly detection. Hence, it is crucial to assess these techniques against adversaries to improve scalability and robustness. We propose a linear regression-based optimisation framework with the ability to poison data in the training phase and demonstrate its effectiveness on cloud datacenter traces. Finally, we investigate the worst-case analysis of poisoning attacks on robust statistics-based anomaly detection techniques to quantify and assess the detection accuracy. We validate this framework using benchmark resource traces obtained from Yahoo's service cluster as well as traces collected from an experimental testbed with realistic service composition.

With rapid growth of network size and complexity, network defenders are facing more challenges in protecting networked computers and other devices from acute attacks. Traffic visualization is an essential element in an anomaly detection system for visual observations and detection of distributed DoS attacks. This paper presents an interactive visualization system called TVis, proposed to detect both low-rate and highrate DDoS attacks using Heron’s triangle-area mapping. TVis allows network defenders to identify and investigate anomalies in internal and external network traffic at both online and offline modes. We model the network traffic as an undirected graph and compute triangle-area map based on incidences at each vertex for each 5 seconds time window. The system triggers an alarm iff the system finds an area of the mapped triangle beyond the dynamic threshold. TVis performs well for both low-rate and high-rate DDoS detection in comparison to its competitors.

Widespread deployment of the Internet enabled building of an emerging IT delivery model, i.e., cloud computing. Albeit cloud computing-based services have rapidly developed, their security aspects are still at the initial stage of development. In order to preserve cybersecurity in cloud computing, cybersecurity information that will be exchanged within it needs to be identified and discussed. For this purpose, we propose an ontological approach to cybersecurity in cloud computing. We build an ontology for cybersecurity operational information based on actual cybersecurity operations mainly focused on non-cloud computing. In order to discuss necessary cybersecurity information in cloud computing, we apply the ontology to cloud computing. Through the discussion, we identify essential changes in cloud computing such as data-asset decoupling and clarify the cybersecurity information required by the changes such as data provenance and resource dependency information., Comment: This is a preprint version of our paper presented in SIN'10, Sept. 7-11, 2010, Taganrog, Rostov Oblast, Russia, International Conference on Security of Information and Networks, 2010

application/pdf, Building an experimental network within a testbed has been a tiresome process for experimenters, due to the complexity of the physical resource assignment and the configuration overhead. Also, the process could not be expedited across testbeds, because the syntax of a configuration file varies depending on specific hardware and software. Re-configuration of an experimental topology for each testbed wastes time, an experimenter could not carry out his/her experiments during the limited lease time of a testbed at worst. In this paper, we propose the AnyBed: the experimental network-building system. The conceptual idea of AnyBed is “If experimental network topologies can be portable across any kinds of testbed, then, it would expedite building an experimental network on a testbed while manipulating experiments by each testbed support tool”. To achieve this concept, AnyBed divide an experimental network configuration into the logical and physical network topologies. Mapping these two topologies, AnyBed can build intended logical network topology on any PC clusters. We have evaluated the AnyBed implementation using two distinct clusters. The evaluation result shows a BGP topology with 150 nodes can be constructed on a large scale testbed in less than 113 seconds.

application/pdf, Switching a communication path from one Access Point (AP) to another in inter-domain WLANs is a critical challenge for delay-sensitive applications such as Voice over IP (VoIP) because communication quality during handover (HO) is more likely to be deteriorated. To maintain VoIP quality during HO, we need to solve many problems. In particular, in bi-directional communication such as VoIP, an AP becomes a bottleneck with the increase of VoIP calls. As a result, packets queued in the AP buffer may experience a large queuing delay or packet losses due to increase in queue length or buffer overflow, thereby causing the degradation of VoIP quality for the Mobile Nodes (MNs) side. To avoid this degradation, MNs need to appropriately and autonomously execute HO in response to the change in wireless network condition, i.e., the deterioration of wireless link quality and the congestion state at the AP. In this paper, we propose an HO decision strategy considering frame retries, AP queue length, and transmission rate at an MN for maintaining VoIP quality during HO. Through simulation experiments, we then show that our proposed method can maintain VoIP quality during HO by properly detecting the wireless network condition.

Building an experimental network within a testbed has been a tiresome process for experimenters, due to the complexity of the physical resource assignment and the configuration overhead. Also, the process could not be expedited across testbeds, because the syntax of a configuration file varies depending on specific hardware and software. Re-configuration of an experimental topology for each testbed wastes time, an experimenter could not carry out his/her experiments during the limited lease time of a testbed at worst. In this paper, we propose the AnyBed: the experimental network-building system. The conceptual idea of AnyBed is “If experimental network topologies can be portable across any kinds of testbed, then, it would expedite building an experimental network on a testbed while manipulating experiments by each testbed support tool”. To achieve this concept, AnyBed divide an experimental network configuration into the logical and physical network topologies. Mapping these two topologies, AnyBed can build intended logical network topology on any PC clusters. We have evaluated the AnyBed implementation using two distinct clusters. The evaluation result shows a BGP topology with 150 nodes can be constructed on a large scale testbed in less than 113 seconds., journal article

Switching a communication path from one Access Point (AP) to another in inter-domain WLANs is a critical challenge for delay-sensitive applications such as Voice over IP (VoIP) because communication quality during handover (HO) is more likely to be deteriorated. To maintain VoIP quality during HO, we need to solve many problems. In particular, in bi-directional communication such as VoIP, an AP becomes a bottleneck with the increase of VoIP calls. As a result, packets queued in the AP buffer may experience a large queuing delay or packet losses due to increase in queue length or buffer overflow, thereby causing the degradation of VoIP quality for the Mobile Nodes (MNs) side. To avoid this degradation, MNs need to appropriately and autonomously execute HO in response to the change in wireless network condition, i.e., the deterioration of wireless link quality and the congestion state at the AP. In this paper, we propose an HO decision strategy considering frame retries, AP queue length, and transmission rate at an MN for maintaining VoIP quality during HO. Through simulation experiments, we then show that our proposed method can maintain VoIP quality during HO by properly detecting the wireless network condition., journal article

application/pdf, The Bloom Filter (BF), a space-and-time-efficient hashcoding method, is used as one of the fundamental modules in several network processing algorithms and applications such as route lookups, cache hits, packet classification, per-flow state management or network monitoring. BF is a simple space-efficient randomized data structure used to represent a data set in order to support membership queries. However, BF generates false positives, and cannot count the number of distinct elements. A counting Bloom Filter (CBF) can count the number of distinct elements, but CBF needs more space than BF. We propose an alternative data structure of CBF, and we called this structure an Adaptive Bloom Filter (ABF). Although ABF uses the same-sized bit-vector used in BF, the number of hash functions employed by ABF is dynamically changed to record the number of appearances of a each key element. Considering the hash collisions, the multiplicity of a each key element on ABF can be estimated from the number of hash functions used to decode the membership of the each key element. Although ABF can realize the same functionality as CBF, ABF requires the same memory size as BF. We describe the construction of ABF and IABF (Improved ABF), and provide a mathematical analysis and simulation using Zipfs distribution. Finally, we show that ABF can be used for an unpredictable data set such as real network traffic.

The Bloom Filter (BF), a space-and-time-efficient hashcoding method, is used as one of the fundamental modules in several network processing algorithms and applications such as route lookups, cache hits, packet classification, per-flow state management or network monitoring. BF is a simple space-efficient randomized data structure used to represent a data set in order to support membership queries. However, BF generates false positives, and cannot count the number of distinct elements. A counting Bloom Filter (CBF) can count the number of distinct elements, but CBF needs more space than BF. We propose an alternative data structure of CBF, and we called this structure an Adaptive Bloom Filter (ABF). Although ABF uses the same-sized bit-vector used in BF, the number of hash functions employed by ABF is dynamically changed to record the number of appearances of a each key element. Considering the hash collisions, the multiplicity of a each key element on ABF can be estimated from the number of hash functions used to decode the membership of the each key element. Although ABF can realize the same functionality as CBF, ABF requires the same memory size as BF. We describe the construction of ABF and IABF (Improved ABF), and provide a mathematical analysis and simulation using Zipfs distribution. Finally, we show that ABF can be used for an unpredictable data set such as real network traffic., journal article

application/pdf, Although IP Multicast offers efficient data delivery for large group communications, the most critical issue delaying widespread deployment of IP Multicast is the scalability of multicast forwarding state as the number of multicast groups increases. Sender-Initiated Multicast (SIM) was proposed as an alternative multicast forwarding scheme for small group communications with incremental deployment capability. The key feature of SIM is in its Preset mode with the automatic SIM tunneling function, which maintaining forwarding information states only on the branching routers. To demonstrate how SIM increases scalability with respect to the number of groups, in this paper we evaluate the proposed protocol both through simulations and real experiments. As from the network operator's point of view, the bandwidth consumption, memory requirements on state-and-signaling per session in routers, and the processing overhead are considered as evaluation parameters. Finally, we investigated the strategies for incremental deployment.

application/pdf, Polling I/O mechanisms on the Unix platform such as select() and poll() cause high processing overhead when they are used in a heavily-loaded network server with many concurrent open sockets. Large waste of processing power incurs not only service degradation but also various troubles such as high electronic power consumption and worsened MTBF of server hosts. It is thus a serious issue especially in large-scale service providers such as an Internet data center (iDC) where a great number of heavily-loaded network servers are operated. As a solution of this problem, we propose a technique of fine-grained control on the invocation intervals of the polling I/O function. The uniqueness of this study is the utilization of POSIX real-time scheduling to enable the fine-grained execution control. Although earlier solutions such as an explicit event delivery mechanism also addressed the problem, they require major modification in the OS kernel and transition from the traditional polling I/O model to the new explicit event-notification model. On the other hand, our technique can be implemented with low cost because it just inserts a few small blocks of codes into the server program and does not require any modification in the OS kernel.

Polling I/O mechanisms on the Unix platform such as select() and poll() cause high processing overhead when they are used in a heavily-loaded network server with many concurrent open sockets. Large waste of processing power incurs not only service degradation but also various troubles such as high electronic power consumption and worsened MTBF of server hosts. It is thus a serious issue especially in large-scale service providers such as an Internet data center (iDC) where a great number of heavily-loaded network servers are operated. As a solution of this problem, we propose a technique of fine-grained control on the invocation intervals of the polling I/O function. The uniqueness of this study is the utilization of POSIX real-time scheduling to enable the fine-grained execution control. Although earlier solutions such as an explicit event delivery mechanism also addressed the problem, they require major modification in the OS kernel and transition from the traditional polling I/O model to the new explicit event-notification model. On the other hand, our technique can be implemented with low cost because it just inserts a few small blocks of codes into the server program and does not require any modification in the OS kernel., journal article

Although IP Multicast offers efficient data delivery for large group communications, the most critical issue delaying widespread deployment of IP Multicast is the scalability of multicast forwarding state as the number of multicast groups increases. Sender-Initiated Multicast (SIM) was proposed as an alternative multicast forwarding scheme for small group communications with incremental deployment capability. The key feature of SIM is in its Preset mode with the automatic SIM tunneling function, which maintaining forwarding information states only on the branching routers. To demonstrate how SIM increases scalability with respect to the number of groups, in this paper we evaluate the proposed protocol both through simulations and real experiments. As from the network operator's point of view, the bandwidth consumption, memory requirements on state-and-signaling per session in routers, and the processing overhead are considered as evaluation parameters. Finally, we investigated the strategies for incremental deployment., journal article

application/pdf, In future mobile networks, new technologies will be needed to enable a mobile host to move across heterogeneous wireless access networks without disruption of the connection. In the past, many researchers have studied handover in such IP networks. In almost all cases, special network devices are needed to maintain the host's mobility. Moreover, a host cannot move across heterogeneous wireless access networks without degradation of the goodput for real-time communication, although a mobile host with multiple network interfaces can connect to multiple wireless access networks. For these reasons, we consider that a mobile host needs to manage seamless handover on an end-to-end basis. In this paper, we propose a multi-path transmission algorithm for end-to-end seamless handover. The main purpose of this algorithm is to improve the goodput during handover by sending the same packets along multiple paths, minimizing unnecessary consumption of network resources. We evaluate our algorithm through simulations and show that a mobile host gains a better goodput.

In future mobile networks, new technologies will be needed to enable a mobile host to move across heterogeneous wireless access networks without disruption of the connection. In the past, many researchers have studied handover in such IP networks. In almost all cases, special network devices are needed to maintain the host's mobility. Moreover, a host cannot move across heterogeneous wireless access networks without degradation of the goodput for real-time communication, although a mobile host with multiple network interfaces can connect to multiple wireless access networks. For these reasons, we consider that a mobile host needs to manage seamless handover on an end-to-end basis. In this paper, we propose a multi-path transmission algorithm for end-to-end seamless handover. The main purpose of this algorithm is to improve the goodput during handover by sending the same packets along multiple paths, minimizing unnecessary consumption of network resources. We evaluate our algorithm through simulations and show that a mobile host gains a better goodput., journal article