ABSTRACT In this paper, we consider the optimal node assignment problem in wavelength division mu... more ABSTRACT In this paper, we consider the optimal node assignment problem in wavelength division multiplexing lightwave networks, which is to optimally assign network nodes to the locations in a regular virtual topology through wavelength assignments. Unlike previous work, which concentrated on a single virtual topology, we consider this problem as a class of problems by formulating it as a quadratic assignment problem. As a result, our objective is of a wider scope: identify the factors responsible for effective (or ineffective) node assignments. Optimal node assignments are considered effective if they could significantly improve the performance given by a random node assignment. The performance metric considered here is the average weighted hop distance. Based on a set of carefully designed experiments and analyses, we have concluded that variability in virtual topologies' hop-distance distributions, variability in network traffic distributions, and pattern matching between distance and traffic matrices are major factors in determining the effectiveness of optimal node assignments. In particular, optimal node assignments are most effective for linear virtual topologies and clustered traffic patterns.
In this paper we consider how to optimize a new generation of pulsing denial-of-service (PDoS) at... more In this paper we consider how to optimize a new generation of pulsing denial-of-service (PDoS) attacks from the attackers' points of views. The PDoS attacks are 'smarter' than the traditional attacks in several aspects. The most obvious one is that they require fewer attack packets to cause a similar damage. Another is that the PDoS attacks can be tuned to achieve different effects. This paper concentrates on the attack tuning part. In particular, we consider two conflicting goals involved in launching a PDoS attack: (1) maximizing the throughput degradation and (2) minimizing the risk of being detected. To address this problem, we first analyze the TCP throughput and quasi-global synchronization phenomenon caused by the PDoS attack. We then propose a family of objective functions to incorporate the two conflicting goals, and obtain the optimal attack settings. To validate the analytical results, we have carried out extensive experiments using both ns-2 simulation and a test-bed. The overall experimental results match well with the analytical results.
Firewall support for UDP traffic today is still insecure and inadequate. We propose in this paper... more Firewall support for UDP traffic today is still insecure and inadequate. We propose in this paper a transport layer proxy (TLP) to provide a secure UDP firewall traversal service on the transport layer (the TLP supports TCP as well). For each UDP association with endpoints separated by a TLP server, the TLP server performs user-level or host-level authentication, packet filtering, packet relaying, optional network address translation, session logging, timing-out of idle association, and other security-related functions. The core of the TLP is a two-step TLP binding procedure that makes a UDP association stateful between a TLP client and a TLP server. This binding procedure supports Active UDP Open, Passive UDP Open, and Source-Specific UDP Open, which a local program may perform on a UDP socket.
We propose a new tree switching protocol (TSP) to reduce multicast routing states required for a ... more We propose a new tree switching protocol (TSP) to reduce multicast routing states required for a forest of multicast trees. The protocol accomplishes this goal by selecting a base multicast tree and “switching” other multicast trees to the base tree. This results in more overlapping among the multicast trees and a net reduction in multicast state. A further reduction in the state is possible by applying state aggregation to the overlapped tree branches. Simulation results show that the tree switching operation alone could result in a very significant state reduction. The TSP is a distributed protocol running on top of any protocol independent multicast routing protocols. It is also loop-free and very efficient
In this paper, we propose Cloak—a new class of reliable timing channels—which is fundamentally di... more In this paper, we propose Cloak—a new class of reliable timing channels—which is fundamentally different from other timing channels in several aspects. First, Cloak encodes a message by a unique distribution of N packets over X TCP flows. The combinatorial nature of the encoding methods increases the channel capacity largely with (N,X). Second, Cloak offers ten different encoding and decoding methods, each of which has a unique tradeoff among several important considerations, such as channel capacity and the need for packet marking. Third, the packet transmissions modulated by Cloak could be carefully crafted to mimic the normal TCP flows in a typical TCP-based application session. Although Cloak’s basic idea is simple, we show in this paper how we tackle a number of challenging issues systematically. Our experiment results collected from PlanetLab nodes and a test bed suggest that Cloak is feasible under various network conditions and different round-trip delays.
Unlike outbound traffic, incoming traffic distribution to a multi-homed AS is influenced mainly b... more Unlike outbound traffic, incoming traffic distribution to a multi-homed AS is influenced mainly by the upstream ISPs' routing policies. Currently, only a handful of mechanisms is available for such an AS to engineer the traffic volume coming into these links. We concentrate on the problem of re-distributing the incoming traffic across the multiple links. We consider the approach of AS path prepending which artificially inflates the length of the AS path to the network reported in BGP (border gateway protocol) messages, with the hope of diverting some of the traffic from one incoming link to another. Although this approach has already been deployed by many ASes, it is often performed on a trial-and-error basis; there is also a lack of a detailed measurement study on the effectiveness of this approach. The paper attempts to fill these gaps. In particular, we have proposed a complete procedure based on the AS path prepending method to engineer incoming traffic according to some traffic control policy. The procedure includes passive measurements, active measurements, and traffic change prediction. We have deployed this approach to a noncommercial site and evaluated its effectiveness based on measurements collected over six months. Similar measurement cycles can be replicated in other multi-homed ASes by deploying the procedure and the associated software tools.
ABSTRACT In this paper, we consider the optimal node assignment problem in wavelength division mu... more ABSTRACT In this paper, we consider the optimal node assignment problem in wavelength division multiplexing lightwave networks, which is to optimally assign network nodes to the locations in a regular virtual topology through wavelength assignments. Unlike previous work, which concentrated on a single virtual topology, we consider this problem as a class of problems by formulating it as a quadratic assignment problem. As a result, our objective is of a wider scope: identify the factors responsible for effective (or ineffective) node assignments. Optimal node assignments are considered effective if they could significantly improve the performance given by a random node assignment. The performance metric considered here is the average weighted hop distance. Based on a set of carefully designed experiments and analyses, we have concluded that variability in virtual topologies' hop-distance distributions, variability in network traffic distributions, and pattern matching between distance and traffic matrices are major factors in determining the effectiveness of optimal node assignments. In particular, optimal node assignments are most effective for linear virtual topologies and clustered traffic patterns.
In this paper we consider how to optimize a new generation of pulsing denial-of-service (PDoS) at... more In this paper we consider how to optimize a new generation of pulsing denial-of-service (PDoS) attacks from the attackers' points of views. The PDoS attacks are 'smarter' than the traditional attacks in several aspects. The most obvious one is that they require fewer attack packets to cause a similar damage. Another is that the PDoS attacks can be tuned to achieve different effects. This paper concentrates on the attack tuning part. In particular, we consider two conflicting goals involved in launching a PDoS attack: (1) maximizing the throughput degradation and (2) minimizing the risk of being detected. To address this problem, we first analyze the TCP throughput and quasi-global synchronization phenomenon caused by the PDoS attack. We then propose a family of objective functions to incorporate the two conflicting goals, and obtain the optimal attack settings. To validate the analytical results, we have carried out extensive experiments using both ns-2 simulation and a test-bed. The overall experimental results match well with the analytical results.
Firewall support for UDP traffic today is still insecure and inadequate. We propose in this paper... more Firewall support for UDP traffic today is still insecure and inadequate. We propose in this paper a transport layer proxy (TLP) to provide a secure UDP firewall traversal service on the transport layer (the TLP supports TCP as well). For each UDP association with endpoints separated by a TLP server, the TLP server performs user-level or host-level authentication, packet filtering, packet relaying, optional network address translation, session logging, timing-out of idle association, and other security-related functions. The core of the TLP is a two-step TLP binding procedure that makes a UDP association stateful between a TLP client and a TLP server. This binding procedure supports Active UDP Open, Passive UDP Open, and Source-Specific UDP Open, which a local program may perform on a UDP socket.
We propose a new tree switching protocol (TSP) to reduce multicast routing states required for a ... more We propose a new tree switching protocol (TSP) to reduce multicast routing states required for a forest of multicast trees. The protocol accomplishes this goal by selecting a base multicast tree and “switching” other multicast trees to the base tree. This results in more overlapping among the multicast trees and a net reduction in multicast state. A further reduction in the state is possible by applying state aggregation to the overlapped tree branches. Simulation results show that the tree switching operation alone could result in a very significant state reduction. The TSP is a distributed protocol running on top of any protocol independent multicast routing protocols. It is also loop-free and very efficient
In this paper, we propose Cloak—a new class of reliable timing channels—which is fundamentally di... more In this paper, we propose Cloak—a new class of reliable timing channels—which is fundamentally different from other timing channels in several aspects. First, Cloak encodes a message by a unique distribution of N packets over X TCP flows. The combinatorial nature of the encoding methods increases the channel capacity largely with (N,X). Second, Cloak offers ten different encoding and decoding methods, each of which has a unique tradeoff among several important considerations, such as channel capacity and the need for packet marking. Third, the packet transmissions modulated by Cloak could be carefully crafted to mimic the normal TCP flows in a typical TCP-based application session. Although Cloak’s basic idea is simple, we show in this paper how we tackle a number of challenging issues systematically. Our experiment results collected from PlanetLab nodes and a test bed suggest that Cloak is feasible under various network conditions and different round-trip delays.
Unlike outbound traffic, incoming traffic distribution to a multi-homed AS is influenced mainly b... more Unlike outbound traffic, incoming traffic distribution to a multi-homed AS is influenced mainly by the upstream ISPs' routing policies. Currently, only a handful of mechanisms is available for such an AS to engineer the traffic volume coming into these links. We concentrate on the problem of re-distributing the incoming traffic across the multiple links. We consider the approach of AS path prepending which artificially inflates the length of the AS path to the network reported in BGP (border gateway protocol) messages, with the hope of diverting some of the traffic from one incoming link to another. Although this approach has already been deployed by many ASes, it is often performed on a trial-and-error basis; there is also a lack of a detailed measurement study on the effectiveness of this approach. The paper attempts to fill these gaps. In particular, we have proposed a complete procedure based on the AS path prepending method to engineer incoming traffic according to some traffic control policy. The procedure includes passive measurements, active measurements, and traffic change prediction. We have deployed this approach to a noncommercial site and evaluated its effectiveness based on measurements collected over six months. Similar measurement cycles can be replicated in other multi-homed ASes by deploying the procedure and the associated software tools.
Uploads