Search

IP geolocation is essential for the territorial analysis of sensitive network entities, location-based services (LBS) and network fraud detection. It has important theoretical significance and application value. Measurement-based IP geolocation is a hot research topic. However, the existing IP geolocation algorithms cannot effectively utilize the distance characteristics of the delay, and the nodes’ connection relation, resulting in high geolocation error. It is challenging to obtain the mapping between delay, nodes’ connection relation, and geographical location. Based on the idea of network representation learning, we propose a representation learning model for IP nodes (IP2vec for short) and apply it to street-level IP geolocation. IP2vec model vectorizes nodes according to the connection relation and delay between nodes so that the IP vectors can reflect the distance and topological proximity between IP nodes. The steps of the street-level IP geolocation algorithm based on IP2vec model are as follows: Firstly, we measure landmarks and target IP to obtain delay and path information to construct the network topology. Secondly, we use the IP2vec model to obtain the IP vectors from the network topology. Thirdly, we train a neural network to fit the mapping relation between vectors and locations of landmarks. Finally, the vector of target IP is fed into the neural network to obtain the geographical location of target IP. The algorithm can accurately infer geographical locations of target IPs based on delay and topological proximity embedded in the IP vectors. The cross-validation experimental results on 10023 target IPs in New York, Beijing, Hong Kong, and Zhengzhou demonstrate that the proposed algorithm can achieve street-level geolocation. Compared with the existing algorithms such as Hop-Hot, IP-geolocater and SLG, the mean geolocation error of the proposed algorithm is reduced by 33%, 39%, and 51%, respectively. [ABSTRACT FROM AUTHOR]

Network reduction and clustering are important techniques for analyzing large-scale network. This study proposed an analytic framework that considers degree distribution, clustering coefficient distribution, K-core, KS-statistic, and normalized adjusted ratio sampling (NARS) to measure and compare the social network dataset before and after reduction. The proposed NARS is to ensure that the comparison metric can obtain a fair share of nodes based on cluster size. To evaluate the framework, 20 datasets of undirected networks were examined. Results show that the proposed framework can provide multiple aspects of measurements to evaluate the reduced network and original network. The study also found that random walk, one of network reduction method, and its improved version, induced subgraph random walk methods, seems to perform equivalently if considering multiple metrics although random walk has faster computational time. [ABSTRACT FROM AUTHOR]

Nowadays, with the continuous increase in internet traffic, the demand for real-time and high-speed traffic analysis has grown significantly. However, existing traffic analysis technologies are either limited by specific applications or data, unable to expand for widespread implementation, or in offline mode are unable to keep up with dynamic adjustments required in certain network management scenarios. A promising approach is to utilize sketch technology to enhance real-time traffic analysis. Unfortunately, existing technologies suffer from defects, such as overly coarse-grained statistics that cannot perform precise application-level traffic analysis, and irreversibility, which cannot support real-time queries in a friendly way. To achieve real-time fine-grained application traffic analysis in general scenarios, we propose AppSketch, a real-time network traffic measurement tool. AppSketch adopts a one-pass approach to classify and label the application information of each packet in the network flows. It then hashes the flow, identified with the application tag, into a carefully designed multiple-key sketch, for gathering application-specific statistics. We conducted extensive experiments using a real-world network traffic dataset collected on a university campus. The results showed that AppSketch achieved high accuracy while requiring less update time than other alternatives. Moreover, AppSketch occupies limited memory (⁠|$ {\leq }$| 64KB), making it suitable for online network devices. [ABSTRACT FROM AUTHOR]

IP geolocation technology based on network measurement can provide IP geographic location capability without user assistance. In the case that the IP target device or intermediate route device does not respond to the detection message, the existing geolocation methods have reduced the accuracy of city-level geolocation, not to mention that the target cannot be located within the city. To solve this problem, a geolocation method for unreachable IP (called GUI) is proposed. GUI first extracts the target city metropolitan area network (MAN) topology, obtains the path to the IP target and compares it with the MAN topology to achieve the city-level geolocation of the target, and then looks for landmarks in the database that belong to the same /24 subnet and the same city-level location with the target. If the above landmarks exist, GUI uses the coordinate set corresponding to the landmarks to solve the minimum covering circle, so as to judge the location of the target. If the above landmarks do not exist, GUI searches for the intersection nodes from the target detection path and MAN topology, enumerates the connected landmarks, calculates the minimum covering circle according to the coordinates and uses it for the target's urban internal geolocation. The experimental results of 15 cities in China and the USA show that GUI can effectively geolocate IP targets. The city-level geolocation success rate of reachable IP can reach 99.41%, that of unreachable IP can reach 89.37% and the minimum median error of urban internal unreachable IP geolocation can reach 4.99km. All indicators are significantly better than the existing typical geolocation methods, such as PoP-Based Geolocation, Street-Level Geolocation, Ranking Nodes Based Geolocation, and the existing typical IP geographic location databases such as IPIP and MaxMind. [ABSTRACT FROM AUTHOR]

Finding top-k elephant flows in high-speed networks is one of the most fundamental network measurement tasks. It is more challenging than per-flow size estimation since the IDs and sizes of top-k flows must be tracked simultaneously. Most existing studies only record the IDs of a small number of elephant flows to fit their estimators in the extremely limited high-speed on-chip memory. However, these solutions need too many memory accesses when a packet arrives to track the elephant flows with high accuracy, which limits their practicability. Therefore, this paper proposes Jigsaw-Sketch, a new algorithm to find the top-k elephant flows with much fewer memory accesses while achieving high memory efficiency and accuracy. In this design, we propose a novel two-stage jigsaw storage scheme, which can capture the candidate top-k flows from massive network steams efficiently, and further find the top-k elephant flows with high memory efficiency and only a few memory accesses for each packet. Extensive experimental results based on real network traces show that Jigsaw-Sketch improves the packet processing throughput by at least 86%, while achieving smaller memory footprints and higher accuracy compared to the SOTA. [ABSTRACT FROM AUTHOR]

Efficient real-time top-k flows measurement plays a pivotal role in enhancing both network performance and security, including tasks such as timely traffic scheduling, optimizing network latency and identifying potential security threats. However, traditional methods for detecting top-k flows suffer from decreased accuracy and high memory overhead. Furthermore, many existing methods overlook finer-grained measurements, such as the detection within the latest short time intervals. With the increasing expansion scale and link speed of the network, an accurate real-time top-k flows identified method is required. This paper proposes wSketch, a novel sketch-based method for real-time top-k flows detection. The innovations of wSketch are that it combines with the sliding window model and circular queue model, and introduces a novel probabilistic update solution. The probabilistic update mechanism gives the larger flow a greater chance of retention, the sliding window model focuses on the latest flow in the last $\mathbb {W}$ time units, and the circular queue reduces memory consumption. Therefore, wSketch provides insights into the current network situation and does well in anticipating future trends. The experimental results showcase wSketch’s superior performance, achieving over 96% accuracy with a small memory size of 20KB.

The target location can be determined through IP geolocation, serving as a vital foundation for location-based services.Researchers have proposed various IP geolocation algorithms with different implementation principles to cater to different network scenarios.However, maintaining an ideal geolocation effect proves challenging for these algorithms in diverse network scenarios.Three typical implementation principles for IP geolocation based on network measurement were introduced.The advantages and disadvantages of these methods in various network scenarios were analyzed, and an adaptive IP geolocation framework specifically tailored to target network scenarios was proposed.The geolocation framework was functioned as follows: initially, a preliminary city-level location estimation was obtained by comparing the target’s location with the landmark database.Then, detection sources were deployed in a distributed manner, and information such as delay, topology and same subnet landmarks for the target city was gathered to determine the network scenario.Finally, an appropriate geolocation method was employed to accurately estimate the target’s location according to the identified network scenario.Through simulation geolocation experiments in 11 cities of China, the multi-level performance of various IP geolocation methods supported by landmark data of different quantities and distributions was evaluated.The results indicate that the proposed framework achieves a city-level geolocation success rate of 96.16% and a median error of 4.13 km for street-level geolocation.Moreover, the framework demonstrates stable geolocation performance across different conditions, including varying same subnet landmark numbers and target accessibility.These experimental findings validate the effectiveness of the proposed framework and offer novel insights for IP geolocation research.

Copyright of Chinese Journal of Network & Information Security is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

With the rapid growth of network bandwidth, traffic identification is currently an important challenge for network management and security. In recent years, packet sampling has been widely used in most network management systems. In this paper, in order to improve the accuracy of network traffic identification, sampled NetFlow data is applied to traffic identification, and the impact of packet sampling on the accuracy of the identification method is studied. This study includes feature selection, a metric correlation analysis for the application behavior, and a traffic identification algorithm. Theoretical analysis and experimental results show that the significance of behavior characteristics becomes lower in the packet sampling environment. Meanwhile, in this paper, the correlation analysis results in different trends according to different features. However, as long as the flow number meets the statistical requirement, the feature selection and the correlation degree will be independent of the sampling ratio. While in a high sampling ratio, where the effective information would be less, the identification accuracy is much lower than the unsampled packets. Finally, in order to improve the accuracy of the identification, we propose a Deep Belief Networks Application Identification (DBNAI) method, which can achieve better classification performance than other state-of-the-art methods.

Copyright of Journal of Fuzhou University is the property of Journal of Fuzhou University, Editorial Department and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Edge clouds have become a de-facto paradigm to deliver low and stable networks to delay-critical applications such as Web services and AR/VR. A unique form of edge clouds is those crowdsourced from third parties, e.g., idle PCs or workstations. Such crowdsourced edge platforms can better sink computations closer to users, reduce the purchase cost, and eliminates the carbon generated during manufacturing. Yet, they also face the challenge of out-of-control hardware, e.g., a server dropping in/out anytime. In this paper, we perform the first-of-its-kind measurement of Quality of Service (QoS) for a large-scale crowdsourced edge platform, which covers over 10,000 edge servers, 100,000 users and 10,000,000 user requests. The measurement takes a holistic QoS view: First, we look at how much hardware resources are provided by edge servers, how much time they are available for service deployment, how geographic distance affects network performance, and what are the major abnormal behaviors. Second, we analyze the factors affecting service stability and quantify the resource utilization pattern of containerized services hosted on those edge servers. Third, we investigate the spatial and temporal features of user requests handled by the platform. Many useful and somehow surprising findings are obtained through the above measurements. We also derive insightful implications that could help edge platforms and edge applications to better deliver their services to users. [ABSTRACT FROM AUTHOR]

Objective: To explore the role of parent-child attachment and personality traits on internet addiction with the network analysis method. Methods: A total of 1 437 middle school students from five middle schools in Fujian Province were investigated online with the Internet Addiction Scale, Inventory of Parent and Peer Attachment, and Chinese Big Five Personality Inventory brief version. EBICglasso model was used to analyze the relationship betweeni internet addiction, parent-child attachment and personality factors. Strength and bridging strength were used to discover key nodes of internet addiction and parent-child attachment networks. Results: Intemet addiction formed a stable network structure centered on the symptom of "irritability due to lack of Internet access" (strength = 1. 47). In the parent-child attachment network, the core node of father-child attachment was "confide in my father "(strength = 1.53), and the core node of mother-child attachment was "I think mother is very competent"(strength = 1.45). Parent-child attachment was connected to internet addiction through the dimension of parent-child alienation. Neuroticism (bridge strength =0.77) was an important bridge node connecting parent-child attachment and internet addiction. Conclusion: The main symptoms of middle school students 'internet addiction are withdrawal reaction and social function problems. Parent-child alienation and neuroticism are important ways for parent-child attachment to affect internet addiction in middle school students. [ABSTRACT FROM AUTHOR]

With the exhaustion of the IPv4 addresses, the promotion and deployment of IPv6 has been accelerating.Dual-stack technology allows devices to enable both IPv4 and IPv6 protocols, which means that users are facing more security risks.Although the existing work can realize the identification and measurement of some dual-stack servers, the following problems still exist.Dual-stack host identification requires deep protocol identification of host services, but this method consumes too much scanning resources.Besides, network service providers may provide consistent services on distributed hosts, making it difficult to guarantee the accuracy of dual-stack host identification through service fingerprints.To solve these problems, the LAN service discovery protocol was used to bind host services to IP addresses, and a dual-stack host discovery method based on SSDP and DNS-SD protocols was proposed.In IPv4 network environment, the target host was induced to actively send a request to the constructed IPv6 server through SSDP protocol, and then the IPv6 address was extracted from the server’s log.Or the service list of the target host and its corresponding AAAA record was enumerated through the DNS-SD protocol and the IPv6 address of the target host was obtained, in order to realize the discovery of the dual stack address pairs.With this method, IPv6 addresses was obtained directly from the IPv4 host, which ensured the accuracy of the discovered dual-stack host.At the same time, only request packets for specific protocols were needed during the discovery process, which greatly saved scanning resources.Based on this method, the SSDP hosts and DNS-SD hosts accidentally exposed to the global IPv4 network were measured.A total number of 158k unique IPv6 addresses were collected, of which 55k were dual-stack host address pairs with globally reachable IPv6 addresses.Unlike existing work that focused on dual-stack servers, this method mainly targeted end-users and client devices, and built a unique set of active IPv6 devices and dual-stack host address pairs that have not been explored so far.Through the analysis of the obtained IPv6 address addressing type, it shows that IPv6 address is mainly generated in a random manner, which greatly reduces the possibility of IPv6 hosts being discovered by scanning.In particular, by measuring the ports and services of dual-stack hosts, we found that the security policy differences of dual-stack hosts on different protocol stacks.Especially, IPv6 protocol stack exposes more high-risk services, expanding the attack surface of hosts.The research results also show that the infeasibility of IPv6 address space traversal scanning mitigates the security risks of IPv6, but incorrect network configuration greatly increases the possibility of these high-risk IPv6 hosts being discovered and users should revisit IPv6 security strategy on dual-stack hosts.

Social network data are often constructed by incorporating reports from multiple individuals. However, it is not obvious how to reconcile discordant responses from individuals. There may be particular risks with multiply reported data if people's responses reflect normative expectations—such as an expectation of balanced, reciprocal relationships. Here, we propose a probabilistic model that incorporates ties reported by multiple individuals to estimate the unobserved network structure. In addition to estimating a parameter for each reporter that is related to their tendency of over- or under-reporting relationships, the model explicitly incorporates a term for 'mutuality', the tendency to report ties in both directions involving the same alter. Our model's algorithmic implementation is based on variational inference, which makes it efficient and scalable to large systems. We apply our model to data from a Nicaraguan community collected with a roster-based design and 75 Indian villages collected with a name-generator design. We observe strong evidence of 'mutuality' in both datasets, and find that this value varies by relationship type. Consequently, our model estimates networks with reciprocity values that are substantially different than those resulting from standard deterministic aggregation approaches, demonstrating the need to consider such issues when gathering, constructing, and analysing survey-based network data. [ABSTRACT FROM AUTHOR]

Copyright of Chinese Journal of Intelligent Science & Technology is the property of Beijing Xintong Media Co., Ltd. and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

In network management, network measuring is crucial. Accurate network measurements can increase network utilization, network management, and the ability to find network problems promptly. With extensive technological advancements, the difficulty for network measurement is not just the growth in users and traffic but also the increasingly difficult technical problems brought on by the network's design becoming more complicated. In recent years, network feature measurement issues have been extensively solved by the use of ML approaches, which are ideally suited to thorough data analysis and the investigation of complicated network behavior. However, there is yet no favored learning model that can best address the network measurement issue. The problems that ML applications in the field of network measurement must overcome are discussed in this study, along with an analysis of the current characteristics of ML algorithms in network measurement. Finally, network measurement techniques that have been used as ML techniques are examined, and potential advancements in the field are explored and examined. [ABSTRACT FROM AUTHOR]

With the exhaustion of the IPv4 addresses, the promotion and deployment of IPv6 has been accelerating. Dual-stack technology allows devices to enable both IPv4 and IPv6 protocols, which means that users are facing more security risks. Although the existing work can realize the identification and measurement of some dual-stack servers, the following problems still exist. Dual-stack host identification requires deep protocol identification of host services, but this method consumes too much scanning resources. Besides, network service providers may provide consistent services on distributed hosts, making it difficult to guarantee the accuracy of dual-stack host identification through service fingerprints. To solve these problems, the LAN service discovery protocol was used to bind host services to IP addresses, and a dual-stack host discovery method based on SSDP and DNS-SD protocols was proposed. In IPv4 network environment, the target host was induced to actively send a request to the constructed IPv6 server through SSDP protocol, and then the IPv6 address was extracted from the server's log. Or the service list of the target host and its corresponding AAAA record was enumerated through the DNS-SD protocol and the IPv6 address of the target host was obtained, in order to realize the discovery of the dual stack address pairs. With this method, IPv6 addresses was obtained directly from the IPv4 host, which ensured the accuracy of the discovered dual-stack host. At the same time, only request packets for specific protocols were needed during the discovery process, which greatly saved scanning resources. Based on this method, the SSDP hosts and DNS-SD hosts accidentally exposed to the global IPv4 network were measured. A total number of 158k unique IPv6 addresses were collected, of which 55k were dual-stack host address pairs with globally reachable IPv6 addresses. Unlike existing work that focused on dual-stack servers, this method mainly targeted end-users and client devices, and built a unique set of active IPv6 devices and dual-stack host address pairs that have not been explored so far. Through the analysis of the obtained IPv6 address addressing type, it shows that IPv6 address is mainly generated in a random manner, which greatly reduces the possibility of IPv6 hosts being discovered by scanning. In particular, by measuring the ports and services of dual-stack hosts, we found that the security policy differences of dual-stack hosts on different protocol stacks. Especially, IPv6 protocol stack exposes more high-risk services, expanding the attack surface of hosts. The research results also show that the infeasibility of IPv6 address space traversal scanning mitigates the security risks of IPv6, but incorrect network configuration greatly increases the possibility of these high-risk IPv6 hosts being discovered and users should revisit IPv6 security strategy on dual-stack hosts. [ABSTRACT FROM AUTHOR]

Public blockchains, like Ethereum, rely on an underlying peer-to-peer (P2P) network to disseminate transactions and blocks between nodes. With the rise of blockchain applications and cryptocurrencies values, they have become critical infrastructures which still lack comprehensive studies. In this paper, we propose to investigate the reliability of the Ethereum P2P network. We developed our own dependable crawler to collect information about the peers composing the network. Our data analysis regarding the geographical distribution of peers and the churn rate shows good network properties while the network can exhibit a sudden and major increase in size and peers are highly concentrated on a few ASes. In a second time, we investigate suspicious patterns that can denote a Sybil attack. We find that many nodes hold numerous identities in the network and could become a threat. To mitigate future Sybil attacks, we propose an architecture to detect suspicious nodes and revoke them. It is based on a monitoring system, a smart contract to propagate the information and an external revocation tool to help clients remove their connections to suspicious peers. Our experiment on Ethereum’s Test network proved that our solution is effective. [ABSTRACT FROM AUTHOR]

Despite widespread LTE deployment, coverage does not necessarily translate to usable service. Even in well-provisioned urban networks, unusually high usage (such as during a public event or after a natural disaster) can lead to congestion that makes the LTE service difficult, if not impossible, to use, even if the user is solidly within the coverage area. A typical approach to detect and quantify congestion on LTE networks is to secure the cooperation of the network provider for access to internal metrics. An alternative approach is to deploy multiple mobile devices with active subscriptions to each network operator. Both approaches are resource and time intensive. In this work, we propose a novel method to estimate congestion from overloaded LTE networks using only passive measurements, and without requiring provider cooperation. We analyze packet-level traces for four commercial LTE service providers, from several locations during both typical levels of usage and during public events that yield large, dense crowds. This study presents the first look at congestion detection through overload estimation by examining unencrypted broadcast messages. We show that an upsurge in broadcast reject and cell barring messages, leading to overload, can accurately detect an increase in network congestion. [ABSTRACT FROM AUTHOR]

Due to the complexity of the network structure and the high growth of the transmission speed, the measurement and management of the network are facing serious challenges. The traditional bottom-up network telemetry methods are no longer applicable to complex network scenarios. To bridge this gap, we propose IntStream, a flexible, expressive and scalable network telemetry framework to allow network operators to measure and analyze network through passive stream processing and active probing. However, there are three key challenges to building an intent-based telemetry system: (1) The diversity of network data sources. (2) The complexity of the measurement tasks. (3) The low overhead requirements of the telemetry system. IntStream introduces a lightweight component to extract and parse data from various data sources and divides the data stream processing into local and global stages. IntStream provides a set of rich expressive primitives to support operators to write telemetry tasks based on intent. By performing part of the telemetry task on the local stage, the transmission overhead of intermediate data can be effectively reduced. The evaluation results conducted on a large campus network show that IntStream can support a wide range of telemetry tasks while reducing the intermediate data transmission overhead by 99.31% on average. [ABSTRACT FROM AUTHOR]

Summary: In smart cities, a large number of vehicles are connected into an intelligent transportation system and share information via the vehicular communication network (VCN). Accurate, fine‐grained, and comprehensive traffic measurements are very crucial for the controller's decision making in software‐defined networking (SDN) in VCN. Fine‐grained traffic measurements can accurately portray network behaviors for VCN. However, this will increase a large amount of measurement overhead. Therefore, how to effectively obtain accurate and fine‐grained traffic is a huge challenge for VCN. To the end, this paper proposes a novel accurate and SDN‐based fine‐grained traffic measurement approach to obtain comprehensive traffic in VCN. Firstly, based on SDN architecture, we exploit the pull‐based sampling mechanism to quickly obtain coarse‐grained traffic measurement values. Secondly, based on the matrix completion theory, we use both interpolation and optimization methods to obtain fine‐grained traffic measurements. Thirdly, the optimization model and detailed algorithm are proposed to attain accurate traffic. Finally, we conduct a larger number of simulations to validate the measurement approach proposed in this paper. Simulation results show that our approach exhibits better performance and is promising. [ABSTRACT FROM AUTHOR]

Being able to monitor each packet path is critical for effective measurement and management of networks. However, such detailed monitoring can be very expensive especially for large-scale networks. To address such problem, inspired by thermodynamics, which uses the statistical characteristics of a large number of molecules’ motion but not each molecule’s trajectory for analysis, we propose the new concept of network temperature together with the notions of network-specific heat and network temperature gradient. Our approach does not only provide a statistical view of the current network state consisting of all the active packet paths at each time instant, but can be used to represent transitions among network states. Our network temperature-based methods have a broad applicability, such as to DDoS detection, dynamic node importance ranking, network stability and robustness evaluation, reliable packets routing, provenance compression assessment, and so on. Numerical and/or the experimental results show that our methods are effective. [ABSTRACT FROM AUTHOR]

Fast IPv4 scanning significantly improves network measurement and security research. Nevertheless, it is infeasible to perform brute-force scanning of the IPv6 address space. Alternatively, one can find active IPv6 addresses through scanning the candidate addresses generated by state-of-the-art algorithms. However, the probing efficiency of such algorithms is often very low. In this paper, our objective is to improve the probing efficiency of IPv6 addresses. We first perform a longitudinal active measurement study and build a high-quality dataset, hitlist, including more than 1.95B IPv6 addresses distributed in 58.2K BGP prefixes and collected over 17 months period. Different from the previous works, we probe the announced BGP prefixes using a pattern-based algorithm. This results in a dataset without uneven address distribution and low active rates. Further, we propose an efficient address generation algorithm, DET, which builds a density space tree to learn high-density address regions of the seed addresses with linear time complexity and improves the active addresses’ probing efficiency. We then compare our algorithm DET against state-of-the-art algorithms on the public hitlist and our hitlist by scanning 50M addresses. Our analysis shows that DET increases the de-aliased active address ratio and active address (including aliased addresses) ratio by 10%, and 14%, respectively. Furthermore, we develop a fingerprint-based method to detect aliased prefixes. The proposed method for the first time directly verifies whether the prefix is aliased or not. Our method finds that 10.64% of the public aliased prefixes are false positive. [ABSTRACT FROM AUTHOR]

Traditional tools like NetFlow face great challenges as both the speed and the complexity of the network traffic increase. To keep the pace up, we propose HashFlow for more efficient and accurate collection of flow records. HashFlow keeps large flows in its main flow table and uses an ancillary table to summarize the other flows when the main table is full. With our flow collision resolution and flow record promotion schemes, a flow in the ancillary table is promoted back to the main flow table with a guaranteed probability when it becomes large enough. These operations can be performed highly efficiently, so HashFlow can keep up with ultra-high traffic speed. We implement HashFlow in a Tofino switch, and using traces from different operational networks, we compare its performance against some state-of-the-art flow measurement algorithms. Our experiments show that, for various types of traffic analysis applications, HashFlow consistently demonstrates clearly better performance than its competitors. For example, the performance of HashFlow in flow size estimation, flow size distribution estimation and heavy hitter detection is up to 21, 60 and 35 percent better than those of the best competitors respectively, and these merits of HashFlow come with almost no degradation of throughput. [ABSTRACT FROM AUTHOR]

In network management, network measuring is crucial. Accurate network measurements can increase network utilization, network management, and the ability to find network problems promptly. With extensive technological advancements, the difficulty for network measurement is not just the growth in users and traffic but also the increasingly difficult technical problems brought on by the network’s design becoming more complicated. In recent years, network feature measurement issues have been extensively solved by the use of ML approaches, which are ideally suited to thorough data analysis and the investigation of complicated network behavior. However, there is yet no favored learning model that can best address the network measurement issue. The problems that ML applications in the field of network measurement must overcome are discussed in this study, along with an analysis of the current characteristics of ML algorithms in network measurement. Finally, network measurement techniques that have been used as ML techniques are examined, and potential advancements in the field are explored and examined.

Multipath routing, which provides multiple paths for ubiquitous communications, has been considered as promising routing mechanism to optimize network performance for Internet. However, it will incur adverse effects on the existing and emerging network measurement schemes, for example incomplete and inaccurate measurement results, to understand network characteristics, since many of them commonly do the work under single-path routing rather than multipath-routing. In order to eliminate this emerging issue on single-path-based network measurement in Internet, it requires to identify whether there is multipath routing between two reachable hosts in the network. Notice that no out-of-order delivery among a strip of packets along multiple paths seldom occurs, in this paper, an efficient multipath routing identification approach has been proposed to achieve this goal, by introducing a composite probe built on out-of-order delivery. We have elaborated our theoretical observation on the current probe composed of a strip of packets, and then presented our composite probe design in detail. Our proposed approach not only can efficiently identify the existing multipath routing, but also accurately recognize its type, referring to flow-based or packet-based routing. Corroborated by experiments and simulations, conducted on Planetlab and NS2, respectively, our approach outperforms other schemes in terms of effectiveness and accuracy. [ABSTRACT FROM AUTHOR]