Search

Resistance spot welding is widely adopted in manufacturing and is characterized by high reliability and simple automation in the production line. The detection of defective welds is a difficult task that requires either destructive or expensive and slow non-destructive testing (e.g., ultrasound). The robots performing the welding automatically collect contextual and process-specific data. In this paper, we test whether these data can be used to predict defective welds. To do so, we use a dataset collected in a real industrial plant that describes welding-related data labeled with ultrasonic quality checks. We use these data to develop several pipelines based on shallow and deep learning machine learning algorithms and test the performance of these pipelines in predicting defective welds. Our results show that, despite the development of different pipelines and complex models, the machine-learning-based defect detection algorithms achieve limited performance. Using a qualitative analysis of model predictions, we show that correct predictions are often a consequence of inherent biases and intrinsic limitations in the data. We therefore conclude that the automatically collected data have limitations that hamper fault detection in a running production plant. [ABSTRACT FROM AUTHOR]

Sound-squatting is a squatting technique that exploits similarities in word pronunciation to trick users into accessing malicious resources. It is an understudied threat that has gained traction with the popularity of smart speakers and audio-only content, such as podcasts. The picture gets even more complex when multiple languages are involved. We here introduce X-squatter, a multi- and cross-language AI-based system that relies on a Transformer Neural Network for generating high-quality sound-squatting candidates. We illustrate the use of X-squatter by searching for domain name squatting abuse across hundreds of millions of issued TLS certificates, alongside other squatting types. Key findings unveil that approximately 15% of generated sound-squatting candidates have associated TLS certificates, well above the prevalence of other squatting types (7%). Furthermore, we employ X-squatter to assess the potential for abuse in PyPI packages, revealing the existence of hundreds of candidates within a 3-year package history. Notably, our results suggest that the current platform checks cannot handle sound-squatting attacks, calling for better countermeasures. We believe X-squatter uncovers the usage of multilingual sound-squatting phenomena on the Internet and it is a crucial asset for proactive protection against the threat. [ABSTRACT FROM AUTHOR]

Recently, Google proposed the Topics API framework as a privacy-friendly alternative for behavioural advertising as a possible solution to balance user's privacy and advertisement effectiveness. Using the Topics API, the browser builds a user profile based on navigation history, which advertisers can access. The Topics API aim at becoming the new standard for behavioural advertising, thus it is necessary to fully understand its operation and find possible limitations. In this article, we evaluate the robustness of the Topics API to a re-identification attack. To build a user profile, we suppose an attacker accumulates over time the topics a user exposes to different websites. The attacker later re-identifies the same user matching the profiles of their audience. We leverage real traffic traces and realistic population models, and we present increasingly powerful attack threats. We find that the Topics API mitigates but cannot prevent re-identification from taking place, as there is a sizeable chance that a user's profile remains unique within a website's audience and the attacker successfully matches it with the profile of the same user on a second website. Depending on environmental factors, the probability of correct re-identification can reach 50%, considering a pool of 1,000 users. We offer the code and data we use in this work to stimulate further studies and the tuning of the Topic API parameters.1 [ABSTRACT FROM AUTHOR]

Darknets are probes listening to traffic reaching IP addresses that host no services. Traffic reaching a darknet results from the actions of internet scanners, botnets, and possibly misconfigured hosts. Such peculiar nature of the darknet traffic makes darknets a valuable instrument to discover malicious online activities, e.g., identifying coordinated actions performed by bots or scanners. However, the massive amount of packets and sources that darknets observe makes it hard to extract meaningful insights, calling for scalable tools to automatically identify and group sources that share similar behaviour. We here present i-DarkVec, a methodology to learn meaningful representations of Darknet traffic. i-DarkVec leverages Natural Language Processing techniques (e.g., Word2Vec) to capture the co-occurrence patterns that emerge when scanners or bots launch coordinated actions. As in NLP problems, the embeddings learned with i-DarkVec enable several new machine learning tasks on the darknet traffic, such as identifying clusters of senders engaged in similar activities. We extensively test i-DarkVec and explore its design space in a case study using real darknets.We showthat with a proper definition of services, the learned embeddings can be used to (i) solve the classification problem to associate unknown sources' IP addresses to the correct classes of coordinated actors and (ii) automatically identify clusters of previously unknown sources performing similar attacks and scans, easing the security analyst's job. i-DarkVec leverages a novel incremental embedding learning approach that is scalable and robust to traffic changes, making it applicable to dynamic and large-scale scenarios. [ABSTRACT FROM AUTHOR]

Privacy on the Internet has become a priority, and several efforts have been devoted to limit the leakage of personal information. Domain names, both in the TLS Client Hello and DNS traffic, are among the last pieces of information still visible to an observer in the network. The Encrypted Client Hello extension for TLS, DNS over HTTPS or over QUIC protocols aim to further increase network confidentiality by encrypting the domain names of the visited servers. In this article, we check whether an attacker able to passively observe the traffic of users could still recover the domain name of websites they visit even if names are encrypted. By relying on large-scale network traces, we show that simplistic features and off-the-shelf machine learning models are sufficient to achieve surprisingly high precision and recall when recovering encrypted domain names. We consider three attack scenarios, i.e., recovering the per-flow name, rebuilding the set of visited websites by a user, and checking which users visit a given target website. We next evaluate the efficacy of padding-based mitigation, finding that all three attacks are still effective, despite resources wasted with padding. We conclude that current proposals for domain encryption may produce a false sense of privacy, and more robust techniques should be envisioned to offer protection to end users. [ABSTRACT FROM AUTHOR]

“Roam like Home” is the initiative of the European Commission (EC) to end the levy of extra charges when roaming within the European region. As a result, people can use data services more freely across Europe. However, the implications of roaming solutions on network performance have not been carefully examined yet. This paper provides an in-depth characterization of the implications of international data roaming within Europe. We build a unique roaming measurement platform using 16 different mobile networks deployed in six countries across Europe. Using this platform, we measure different aspects of international roaming in 4G networks in Europe, including mobile network configuration, performance characteristics, and quality of experience. We find that operators adopt a common approach to implement roaming called Home-routed roaming (HR). This results in additional latency penalties of 60 ms or more, depending on geographical distance. This leads to worse browsing performance, with an increase in the metrics related to Quality of Experience (QoE) of users (Page Load time and Speed Index) in the order of 15-20 percent. We further analyze in isolation the impact of latency on QoE metrics and find that the penalty imposed by HR leads to a degradation on QoE metrics up to 150 percent in case of intercontinental roaming. [ABSTRACT FROM AUTHOR]

Collective user behavior in social media applications often drives several important online and offline phenomena linked to the spread of opinions and information. Several studies have focused on the analysis of such phenomena using networks to model user interactions, represented by edges. However, only a fraction of edges contribute to the actual investigation. Even worse, the often large number of non-relevant edges may obfuscate the salient interactions, blurring the underlying structures and user communities that capture the collective behavior patterns driving the target phenomenon. To solve this issue, researchers have proposed several network backbone extraction techniques to obtain a reduced and representative version of the network that better explains the phenomenon of interest. Each technique has its specific assumptions and procedure to extract the backbone. However, the literature lacks a clear methodology to highlight such assumptions, discuss how they affect the choice of a method and offer validation strategies in scenarios where no ground truth exists. In this work, we fill this gap by proposing a principled methodology for comparing and selecting the most appropriate backbone extraction method given a phenomenon of interest. We characterize ten state-of-the-art techniques in terms of their assumptions, requirements, and other aspects that one must consider to apply them in practice. We present four steps to apply, evaluate and select the best method(s) to a given target phenomenon. We validate our approach using two case studies with different requirements: online discussions on Instagram and coordinated behavior in WhatsApp groups. We show that each method can produce very different backbones, underlying that the choice of an adequate method is of utmost importance to reveal valuable knowledge about the particular phenomenon under investigation. [ABSTRACT FROM AUTHOR]

To protect user privacy, legislators have regulated the use of tracking technologies, mandating the acquisition of users' consent before collecting data. As a result, websites started showing more and more consent management modules--i.e., Consent Banners--the visitors have to interact with to access the website content. Since these banners change the content the browser loads, they challenge web measurement collection, primarily to monitor the extent of tracking technologies, but also to measure web performance. If not correctly handled, Consent Banners prevent crawlers from observing the actual content of the websites. In this paper, we present a comprehensive measurement campaign focusing on popular websites in Europe and the US, visiting both landing and internal pages from different countries around the world. We engineer Priv-Accept, a Web crawler able to accept the Consent Banners, as most users would do in practice. It lets us compare how webpages change before and after accepting such policies, if present. Our results show that all measurements performed ignoring the Consent Banners offer a biased and partial view of the Web. After accepting the privacy policies, web tracking is far more pervasive, and webpages are larger and slower to load. [ABSTRACT FROM AUTHOR]

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2008.10.013 Byline: Dario Rossi (a), Marco Mellia (b), Michela Meo (b) Keywords: Internet traffic measurements; Skype Abstract: Skype is without a doubt today's VoIP application of choice. Its amazing success has drawn the attention of both telecom operators and the research community. There is a great interest in characterizing Skype's traffic, understanding its internal mechanisms, and learning about its users' behavior. One of the most interesting characteristics of Skype is that it relies on a P2P infrastructure for the exchange of signaling information that is distributed between peers. Leveraging the use of an accurate Skype classification engine that we recently designed, we now report the results of our experimental study of Skype signaling based on extensive passive measurements collected from our campus LAN. We avoid the need to reverse-engineer the Skype protocol, and we instead adopt a black-box approach. We focus on signaling traffic in order to infer certain interesting properties regarding overlay maintenance and, possibly, the overlay structure as well. Our results show that, even though the signaling bandwidth used by normal peers is exiguous, it may nonetheless account for a significant portion of the total traffic generated by a single Skype client. Skype performs peer discovery and refresh by using a large number of single packet probes. This may be as effective for the purpose of overlay maintenance as it is costly, at least from the viewpoint of layer-4 network devices. At the same time, single-packet probes account for only a minor fraction of all signaling traffic: therefore, we wish to explore more deeply the traffic that is exchanged among the more stable peers, in an attempt to learn how the peer selection mechanism actually operates. Measurements were collected during April and August 2007. In particular, during the second month of sampling, the Skype network suffered a worldwide service outage. We compare the results collected during the two time periods, and we demonstrate the striking impacts on the signaling network as a result of the outage. Author Affiliation: (a) TELECOM ParisTech, INFRES, 37/39 Rue Dareau, 75014 Paris, France (b) Politecnico di Torino, DELEN, Corso Duca degli Abruzzi 24, 10129 Torino, Italy

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2005.09.005 Byline: Emilio C.G. Wille (a), Marco Mellia (b), Emilio Leonardi (b), Marco Ajmone Marsan (b) Keywords: Packet-switching networks design and planning; TCP/IP; Queueing theory; Mathematical programming/optimization; Heuristic methods Abstract: The new generation of packet-switching networks is expected to support a wide range of communication-intensive real-time multimedia applications. A key issue in the area is how to devise reasonable packet-switching network design methodologies that allow the choice of the most adequate set of network resources for the delivery of a given mix of services with the desired level of end-to-end Quality of Service (e2e QoS) and, at the same time, consider the traffic dynamics of today's packet-switching networks. In this paper, we focus on problems that arise when dealing with this subject, namely Buffer Assignment (BA), Capacity Assignment (CA), Flow and Capacity Assignment (FCA), Topology, Flow and Capacity Assignment (TCFA) problems. Our proposed approach maps the end-user's performance constraints into transport-layer performance constraints first, and then into network-layer performance constraints. This mapping is then considered together with a refined TCP/IP traffic modeling technique, that is both simple and capable of producing accurate performance estimates, for general-topology packet-switching design networks subject to realistic traffic patterns. Subproblems are derived from a general design problem and a collection of heuristic algorithms are introduced for compute approximate solutions. We illustrate examples of network planning/dimensioning considering Virtual Private Networks (VPNs). Author Affiliation: (a) Federal Technology Education Center of Parana, Department of Electronics, Av. Sete de Setembro 3165, Curitiba (PR), Brazil (b) Politecnico di Torino, Corso Duca degli Abruzzi, 24-10129 Torino, Italy Article Note: (footnote) [star] This work was supported by the Italian Ministry for Education, University and Research under the FIRB project TANGO, and by a CAPES Foundation scholarship from the Ministry of Education of Brazil.

To link to full-text access for this article, visit this link: http://dx.doi.org/10.1016/j.comnet.2004.12.006 Byline: Claudio Casetti, Marco Mellia Keywords: DiffServ; TCP; Packet marking; Fairness Abstract: A problem common to packet markers used in DiffServ architectures is the provision of Quality of Service to TCP flows: specifically, short-lived TCP flows suffer from packet losses at small congestion windows, which inevitably leads to lengthy retransmission timeouts. It would therefore be sensible to mark packets of short-lived flows so as to offer them a greater level of protection. In this work, we propose a class of Fair Markers that, without the penalty of per-flow management, achieves the same performance enhancement of a per-flow marker, but with a much simpler design and limited implementation complexity. Extensive simulations with realistic traffic scenarios and simple analytical models allow us to compare our proposal with existing ones. We also underline the importance of providing a minimum protection to both data and acknowledgment segments of traffic crossing congested domains. Author Affiliation: Dipartimento di Elettronica, Politecnico di Torino, Torino, Italy Article History: Received 29 July 2004; Revised 29 July 2004; Accepted 6 December 2004 Article Note: (footnote) [star] This work was supported by the European network of excellence Euro-NGI.