Search

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2007.07.005 Byline: Luciano Paschoal Gaspary (a), Marinho P. Barcellos (b), Andre Detsch (b), Rodolfo S. Antunes (b) Keywords: Peer-to-peer; Security; Middleware Abstract: The widespread adoption of P2P applications in environments beyond ordinary file sharing demands the fulfillment of several security requirements. Important steps have been taken towards security in P2P systems, with relevant mechanisms being proposed in the past to address specific vulnerabilities. However, existing approaches lack flexibility, since they do not (include enough mechanisms to) tackle a wide range of requirements in an integrated fashion. In addition, they oblige the user/application to manipulate a complex programming interface, as well as going through a cumbersome configuration process. To address these issues, we present P2PSL (P2P Security Layer), a software architecture that allows gradual and flexible integration of security functionality into P2P applications. To show concept and technical feasibility, we have implemented P2PSL, assessed the overhead it induces, and estimated the feasibility of incorporating the layer into two categories of real world P2P applications. Author Affiliation: (a) Universidade Federal do Rio Grande do Sul (UFRGS), Av. Bento Goncalves, 9500, Bloco IV, 91.501-970 Porto Alegre, Brazil (b) PIPCA/UNISINOS, Postgraduate Program on Applied Computing, Av. Unisinos, 950, 93.022-000 Sao Leopoldo, Brazil Article History: Received 14 December 2006; Revised 7 June 2007; Accepted 19 July 2007 Article Note: (miscellaneous) Responsible Editor: N. Bartolini

Distributed Denial-of-Service (DDoS) attacks have been steadily escalating in frequency, scale, and disruptiveness—with outbreaks reaching multiple terabits per second and compromising the availability of highly-resilient networked systems. Existing defenses require frequent interaction between forwarding and control planes, making it difficult to reach a satisfactory trade-off between accuracy (higher is better), resource usage, and defense response delay (lower is better). Recently, high-performance programmable data planes have made it possible to develop a new generation of mechanisms to analyze and manage traffic at line rate. In this article, we explore P4 language constructs and primitives to design Euclid, a fully in-network fine-grained, low-footprint, and low-delay traffic analysis mechanism for DDoS attack detection and mitigation. Euclid utilizes information-theoretic and statistical analysis to detect attacks and classify packets as either legitimate or malicious, thus enabling the enforcement of policies (e.g., discarding, inspection, or throttling) to prevent attack traffic from disrupting the operation of its victims. We experimentally evaluate our proposed mechanism using packet traces from CAIDA. The results indicate that Euclid can detect attacks with high accuracy (98.2%) and low delay (≈250 ms), and correctly identify most of the attack packets (>96%) without affecting more than 1% of the legitimate traffic. Furthermore, our approach operates under a small resource usage footprint (tens of kilobytes of static random-access memory per 1 Gbps link and a few hundred ternary content-addressable memory entries), thus enabling its deployability on high-throughput, high-volume scenarios. [ABSTRACT FROM AUTHOR]

To cope with themassive bandwidth demands of Virtual Reality (VR) video streaming, both the scientific community and the industry have been proposing optimization techniques such as viewport-aware streaming and tile-based adaptive bitrate heuristics. As most of the VR video traffic is expected to be delivered through mobile networks, a major problem arises: both the network performance and VR video optimization techniques have the potential to influence the video playout performance and the Quality of Experience (QoE). However, the interplay between them is neither trivial nor has it been properly investigated. To bridge this gap, in this article, we introduce VR-EXP, an open-source platform for carrying out VR video streaming performance evaluation. Furthermore, we consolidate a set of relevant VR video streaming techniques and evaluate them under variable network conditions, contributing to an in-depth understanding of what to expect when different combinations are employed. To the best of our knowledge, this is the first work to propose a systematic approach, accompanied by a software toolkit, which allows one to compare different optimization techniques under the same circumstances. Extensive evaluations carried out using realistic datasets demonstrate that VR-EXP is instrumental in providing valuable insights regarding the interplay between network performance and VR video streaming optimization techniques. [ABSTRACT FROM AUTHOR]

National research and education networks (NRENs), such as ESnet, G?ANT, and RNP, currently promote the employment of dynamic circuit networks (DCNs) to improve scientific communications beyond the capabilities of today's Internet. In spite of their alleged benefits to materialize user-initiated, ad hoc dedicated end-to-end circuits for high-demanding applications, DCNs also pose important challenges. Two examples are dealing with the end-user's lack of ability or willingness to understand low-level technicalities of virtual circuit establishment, and accommodating NRENs' local policies throughout the life-cycle of DCN. In this article, we seek to improve the usability of DCN services with a focus on the inexperienced end-user and the skilled network operator alike. We introduce MEICAN, a platform to manage the life-cycle of DCN from definition to provisioning of virtual circuits. We also present a case study of inter-domain circuit reservation with mixed manual and automated policy checking, and discuss lessons learned, relevant challenges, and open issues still to be overcome. [ABSTRACT FROM PUBLISHER]

The success of businesses in modern organizations heavily depends on the high availability of information technology (IT) infrastructures. To prevent business disruption, IT operators have worked hard to ensure that any changes to this infrastructure are properly and efficiently deployed. Change management—a discipline of the Information Technology Infrastructure Library (ITIL)—provides important guidance to help achieve this end. As IT infrastructures grow larger, however, ensuring that changes are harmless to business continuity becomes increasingly complex. In fact, previous research has shown that existing approaches for verifying changes suffer from severe scalability issues. This problem can become a serious threat to most organizations, as it can lead for example to customer dissatisfaction due to missed deadlines in service change deployment. To bridge this gap, we propose a partial-order reduction model checking paradigm and algorithm for efficiently detecting harmful change operations. Our model improves the complexity of verifying a set of concurrent change activities against safety constraints by reducing—without losing effectiveness—the verification scope. To prove concept and technical feasibility, we carried out an extensive performance evaluation of our algorithm considering a variety of change activities, safety constraints, and configuration scenarios. The results obtained from 32 benchmarks have shown that our algorithm significantly outperformed state-of-the-art, general purpose model checkers, improving the runtime complexity from polynomial/exponential to linear. In summary, the results evidenced that change verification finally became feasible and efficient for larger IT infrastructures. [ABSTRACT FROM PUBLISHER]

Despite being currently one of the main Internet applications, P2P file sharing has been hampered by content pollution attacks. To tackle this problem, we introduce a novel pollution control strategy that consists in adjusting the rate in which content is disseminated, according to content version reputation. The proposed strategy is modeled and evaluated using simplifying assumptions. Then, inspired by classic distributed designs, we propose a pollution control mechanism that implements such a strategy. The mechanism is evaluated in terms of the delays imposed on non-polluted version dissemination, the effectiveness of reducing dissemination when the version is polluted, and the negative impact that collusion attacks can impose on the reputation system upon which our mechanism is built. Simulation results looking at scenarios with several hundred peers indicate that the pollution control mechanism can effectively reduce pollution without substantially affecting the dissemination of non-polluted content. Copyright © 2010 John Wiley & Sons, Ltd. [ABSTRACT FROM AUTHOR]

In recent years, intrusion detection systems (IDSs) use has increased into detect security breaches in both systems and networks. However, widespread IDS usage has been hindered by several challenges, including: 1) time-consuming configuration and analysis; 2) integration difficulties with existing network management infrastructure; and 3) the inability to add new attack signatures in a well-understood, yet expressive high-level notation. This paper presents the ID-Trace Management Platform, an extension of the simple network management protocol infrastructure based on the Internet Engineering Task Force (IETF) script management information base (Script MIB) to support distributed stateful intrusion detection in enterprise networks. It provides mechanisms allowing a management station to delegate security-related tasks to mid-level managers (MLMs) that, in turn, interact with monitoring and action agents to execute these tasks. Protocol trace specification language specifications are used by the MLMs to program monitoring agents that sniff packets on the network comparing their signatures to those of known attack signatures. With the information gathered from the monitoring process, the MLMs may execute procedures via the action agents (Java, Tcl, or Perl scripts), enabling the automation of several security tasks (including reactive and proactive tasks). The platform also provides notification mechanisms (traps) so that MLMs can report the occurrence of major events to the management station. [ABSTRACT FROM AUTHOR]

The six articles in this special section focus on advancements in networking software. Networking and communications systems are currently undergoing a substantive transformation on several fronts, promising substantially lower cost, simplified operations, and dramatically faster innovation cycles as traditional barriers to the deployment of innovations are removed. Where in the past networking functions were predominantly implemented using purpose-built hardware, custom protocols, and firmware images, those networking functions are increasingly instantiated through software that is abstracted from hardware, freely programmable, and relying on algorithmic invocation of generic application programming interfaces (APIs). This transformation is best summarized as ?softwarization? of the network, which is, in turn, realized through advances in networking software. These articles exemplify this transformation, providing an excellent cross-section across these facets. [ABSTRACT FROM AUTHOR]