Search

Proactive measurement of the delay in communication networks aims to detect congestion as early as possible and find links on which the traffic flow is obstructed. There is, however, a tradeoff between detection time and cost (e.g., bandwidth utilization). Adaptive measurement adjusts the inspection rate per each link, for effective monitoring with reduced costs. In this paper we present SDProber---a tool for proactive measurement of delays in SDN. SDProber uses probe packets that are routed by adding tailored rules to the vSwitches. It adjusts the forwarding rules to route probe packets more frequently to areas where congestion tends to occur. To increase efficiency, SDProber uses a novel approach of probing by a random walk. Adaptation is achieved by changing the probabilities that govern the random walk. Our experimental results show that SDProber provides control over the probe rates per each link and that it reduces measurement costs in comparison to baseline methods that send probe packets via shortest paths.

Poor visibility into the network hampers progress in a number of important research areas, from network troubleshooting to Internet topology and performance mapping. This persistent, well-known problem has served as motivation for numerous proposals to build or extend existing Internet measurement platforms by recruiting larger, more diverse vantage points. Capturing the edge of the network, however, remains an elusive goal. We argue that at its root the problem is one of incentives. Today's measurement platforms build on the assumption that the goals of experimenters and those hosting the platform are the same. As much of the Internet growth occurs in residential broadband networks, this assumption no longer holds. We present a measurement experimentation platform that reaches the network edge by explicitly aligning the objectives of the experimenters with those of the users hosting the platform. Dasu—our current prototype—is designed to support both network measurement experimentation and broadband characterization. Dasu has been publicly available since July 2010 and has been installed by over 100 $\,$ 000 users with a heterogeneous set of connections spreading across 2431 autonomous systems (ASs) and 166 countries. We discuss some of the challenges we faced building and using a platform for the Internet's edge, describe its design and implementation, and illustrate the unique perspective its current deployment brings to Internet measurement.

Browsing privacy solutions face an uphill battle to deployment. Many operate counter to the economic objectives of popular online services (e.g., by completely blocking ads) and do not provide enough incentive for users who may be subject to performance degradation for deploying them. In this study, we take a step towards realizing a system for online privacy that is mutually beneficial to users and online advertisers: an information market. This system not only maintains economic viability for online services, but also provides users with financial compensation to encourage them to participate. We prototype and evaluate an information market that provides privacy and revenue to users while preserving and sometimes improving their Web performance. We evaluate feasibility of the market via a one month field study with 63 users and find that users are indeed willing to sell their browsing information. We also use Web traces of millions of users to drive a simulation study to evaluate the system at scale. We find that the system can indeed be profitable to both users and online advertisers., Comment: 12 pages, 9 figures, 3 tables, 2 appendixes To appear in Performance18, December 5-7, 2018, Toulouse, France

This paper explores the potential of enabling SDN security and monitoring services by piggybacking on SDN reactive routing. As a case study, we implement and evaluate a piggybacking based intrusion prevention system called SDN-Defense. Our study of university WiFi traffic traces reveals that up to 73% of malicious flows can be detected by inspecting just the first three packets of a flow, and 90% of malicious flows from the first four packets. Using such empirical insights, we propose to forward the first K packets of each new flow to an augmented SDN controller for security inspection, where K is a dynamically configurable parameter. We characterize the cost-benefit trade-offs of SDN-Defense using real wireless traces and discuss potential scalability issues. Finally, we discuss other applications which can be enhanced by using our proposed piggybacking approach.

Online social network (OSN) based applications often rely on user interactions to propagate information or to recruit more users, producing a sequence of user actions called adoption process or cascades. This paper presents the first attempt to quantitatively study the adoption process or cascade of such OSN-based applications by analyzing detailed user activity data from a popular Facebook gifting application. In particular, due to the challenge of monitoring user interactions over all possible channels on OSN platforms, we focus on characterizing the adoption process that relies only on user-based invitation (which is applicable to most gifting applications). We characterize the adoptions by tracking the invitations sent by the existing users to their friends through the Facebook gifting application and the events when their friends install the application for the first time. We found that a small number of big cascades carry the adoption of most of the application users. Contrary to common beliefs, we did not observe special influential nodes that are responsible for the viral adoption of the application.

Social media provide many opportunities to connect people, but the kinds of personally identifiable information that people share through social media is understudied. This paper presents findings from a content analysis in which we coded the amount and kinds of personally identifiable information of public Twitter messages. Overwhelmingly, public Twitter messages do not include identifiable information such as phone numbers, email, and home addresses. Using Goffman's [(1963). Behaviors in public places: Notes on the social organization of gatherings. New York, NY: Free Press] concepts of public order and civil inattention, we also coded for whether people articulate the kinds of information that are communicated with others in public space, including locational, temporal, and activity-related information. Our findings suggest that people do share similar kinds of personal information on Twitter that they do in others kinds of physical public spaces, suggesting that people may also be mapping old practice...

This paper seeks to historicize Twitter within a longer historical framework of diaries to better understand Twitter and broader communication practices and patterns. Based on a review of historical literature regarding 18th and 19th century diaries, we created a content analysis coding scheme to analyze a random sample of publicly available Twitter messages according to themes in the diaries. Findings suggest commentary and accounting styles are the most popular narrative styles on Twitter. Despite important differences between the historical diaries and Twitter, this analysis reveals long-standing social needs to account, reflect, communicate, and share with others using media of the times.

One definition of privacy is the selective revelation of information about oneself. With billions of people using social media, it's increasingly difficult for users to control what they're disclosing and to whom. Current privacy protection measures block leakages via privacy settings that are syntactic in nature, but existing solutions don't attempt to cover all the entities who might end up receiving the data, ensure the need for or use of the data collected, determine the duration of data retention, or reveal if the data is merged with external information to reveal the user's full identity. The title of the article is from linguist Noam Chomsky, who used it to distinguish between syntax and semantics. Virtually all privacy solutions thus far handle issues relating only to the first hop of the personal data flow from a user. The gap can only be filled by examining the semantics behind the multihop flow of user data over time. This article surveys the state of the art and presents some potential directions in moving from a syntactic approach to a more holistic semantics-based approach.

Modern websites use multiple authentication cookies to allow visitors to the site different levels of access. The complexity of modern web applications can make it difficult for a web application programmer to ensure that the use of authentication cookies does not introduce vulnerabilities. Even when a programmer has access to all of the source code, this analysis can be challenging; the problem becomes even more vexing when web programmers cobble together off-the-shelf libraries to implement authentication. We have assembled a checklist for modern web programmers to verify that the cookie based authentication mechanism is securely implemented. Then, we developed a tool, Newton, to help a web application programmer to identify authentication cookies for specific parts of the website and to verify that they are securely implemented according to the checklist. We used Newton to analyze 149 sites, including the Alexa top-200 and many other popular sites across a range of categories including search, shopping, and finance. We found that 113 of them---including high-profile sites such as Yahoo, Amazon, and Fidelity---were vulnerable to hijacking attacks. Many websites have already acknowledged and fixed the vulnerabilities that we found using Newton and reported to them.

This is a brief journey across the Internet privacy landscape. After trying to convince you about the importance of the problem I will try to present questions of interest and how you might be able to apply your expertise to them.

The recent rise in popularity of social networks, such as Facebook and MySpace, has created large quantities of data about interactions within these networks. Such data contains many private details about individuals so anonymization is required prior to attempts to make the data more widely available for scientific research. Prior work has considered simple graph data to be anonymized by removing all non-graph information and adding or deleting some edges. Since social network data is richer in details about the users and their interactions, loss of details due to anonymization limits the possibility for analysis. We present a new set of techniques for anonymizing social network data based on grouping the entities into classes, and masking the mapping between entities and the nodes that represent them in the anonymized graph. Our techniques allow queries over the rich data to be evaluated with high accuracy while guaranteeing resilience to certain types of attack. To prevent inference of interactions, we rely on a critical "safety condition" when forming these classes. We demonstrate utility via empirical data from social networking settings. We give examples of complex queries that may be posed and show that they can be answered over the anonymized data efficiently and accurately.

We focus in this paper on Internet flows, consider their contributions to the overall traffic per time unit or bin, and perform a multi-scale and multi-protocol analysis to explore the persistency properties of those flows that contribute the most (also known as "heavy hitters" or "elephants"). Knowing the persistency features (or a lack thereof) of the heavy hitters and understanding their underlying causes is crucial when developing traffic engineering tools that focus primarily on optimizing system performance for elephant flows.The main difficulty when studying the persistency properties of flows is that the available measurements are either too fine-grained to perform large-scale studies (i.e., packet-level traces) or too coarse-grained to extract the detailed information necessary for the purpose at hand (i.e., Netflow traces, SNMP). We deal with this problem by assuming that flows have constant throughput through their lifetime. We then check the validity of this assumption by comparing our Netflow-derived findings against those obtained from directly studying the corresponding detailed packet-level traces. By considering different time aggregations (e.g., bin sizes between 1--10 minutes) and flow abstractions (e.g., raw IP flows, pre-fix flows), varying the definition of what constitutes an "elephant", and slicing by different protocols and applications, we present a methodology for studying persistency aspects exhibited by Internet flows. For example, we find that raw IP flows that are elephant flows for at least once (i.e., one bin or time unit) in their lifetimes tend to show a remarkable persistence to be elephants for much of their lifetimes, but certain aggregate flows exhibit more intricate persistency properties.

Characterizing the flow of Internet traffic is important in a wide range of contexts, from network engineering and application design to understanding the network impact of consumer demand and business relationships. Despite the growing interest, the nearly impossible task of collecting large-scale, Internet-wide traffic data has severely constrained the focus of traffic-related studies. In this paper, we introduce a novel approach to characterize inter-domain traffic by reusing large, publicly available traceroute datasets. Our approach builds on a simple insight -- the popularity of a route on the Internet can serve as an informative proxy for the volume of traffic it carries. It applies structural analysis to a dual-representation of the AS-level connectivity graph derived from available traceroute datasets. Drawing analogies with city grids and traffic, it adapts data transformations and metrics of route popularity from urban planning to serve as proxies for traffic volume. We call this approach Network Syntax, highlighting the connection to urban planning Space Syntax. We apply Network Syntax in the context of a global ISP and a large Internet eXchange Point and use ground-truth data to demonstrate the strong correlation ($r^2$ values of up to 0.9) between inter-domain traffic volume and the different proxy metrics. Working with these two network entities, we show the potential of Network Syntax for identifying critical links and inferring missing traffic matrix measurements.

Advertising is ubiquitous on the Web; numerous ad networks serve billions of ads daily via keyword or search term auctions. Recently, online social networks (OSNs) such as Facebook have created site-specific ad services that differ from traditional ad networks by letting advertisers bid on users rather than keywords. With Facebook's annual ad revenue exceeding $4 billion, OSN-based ad services are emerging to be a significant fraction of the online ad market. In contrast to other online ad markets (e.g., Google's ad market), there has been little academic study of OSN ad services, and OSNs have released very little data about their advertising markets; as a result, researchers currently lack the tools to measure and understand these markets.In this paper, our goal is to bring visibility to OSN ad markets, focusing on Facebook. We demonstrate that the (undocumented) feature that suggests bids to advertisers is most likely calculated via sampling recent winning bids. We then show how this feature can be used to explore the relative value of different user demographics and the overall stability of the advertising market. Through the exploration of suggested bid data for different demographics, we find dramatic differences in prices paid across different user interests and locations. Finally, we show that the ad market shows long-term variability, suggesting that OSN ad services have yet to mature.

Not all of the over one billion users of online social networks (OSNs) are equally valuable to the OSNs. The current business model of monetizing advertisements targeted to users does not appear to be based on any visible grouping of the users. The primary metrics remain CPM (cost per mille---i.e., thousand impressions) and CPC (cost per click) of ads that are shown to users. However, there is significant diversity in the actions of users---some users upload interesting content triggering additional views and comments leading to further cascades of action. Beyond direct impressions, a user's action can generate indirect impressions by actions induced on friends and other users. Identifying the valuable user segments requires examination of profile data, friendships, and most importantly, their activity. Here we explore an alternate approach for measuring the value of users in OSNs by proposing a framework from the viewpoint of a popular OSN. Using a real dataset on the social network and activities of users, we show that a small subset of actions are likely to be key indicators of a user's value. Additionally, by examining the current targeting demographics available in Facebook, we are able to explore the relative (monetary) value that different users represent to the OSN.

Web performance impacts the popularity of a particular Web site or service as well as the load on the network, but there have been no publicly available end-to-end measurements that have focused on a large number of popular Web servers examining the components of delay or the effectiveness of the recent changes to the HTTP protocol. In this paper we report on an extensive study carried out from many client sites geographically distributed around the world to a collection of over 700 servers to which a majority of Web traffic is directed. Our results show that the HTTP/1.1 protocol, particularly with pipelining, is indeed an improvement over existing practice, but that servers serving a small number of objects or closing a persistent connection without explicit notification can reduce or eliminate any performance improvement. Similarly, use of caching and multi-server content distribution can also improve performance if done effectively.

Traffic, usage, and performance measurements are crucial to the design, operation and control of Internet protocol networks. This article describes a prototype infrastructure for the measurement, storage, and correlation of network data of different types and origins from AT&T's commercial IP network. We focus first on some novel aspects of the measurement infrastructure, then describe analyses that illustrate the power of joining different measured data sets for network planning and design.

We present a piggyback server invalidation (PSI) mechanism for maintaining stronger cache coherency in Web proxy caches while reducing overall costs. The basic idea is for servers to piggyback on a reply to a proxy client, the list of resources that have changed since the last access by the client. The proxy client invalidates cached entries on the list and can extend the lifetime of entries not on the list. This continues our prior work on piggyback cache validation (PCV) where we focused on piggybacking validation requests from the proxy cache to the server. Trace-driven simulation of PSI on two large, independent proxy log data sets, augmented with data from several server logs, shows PSI provides close to strong cache coherency while reducing the request traffic compared to existing cache coherency techniques. The best overall performance is obtained when the PSI and PCV techniques are combined. Compared to the best TTL-based policy, this hybrid policy reduces the average cost (considering response latency, request messages and bandwidth) by 7–9%, reduces the staleness ratio by 82–86%, yielding a staleness ratio of 0.001. © 1998 Published by Elsevier Science B.V. All rights reserved.

The task of protecting users' privacy is made more difficult by their attitudes towards information disclosure without full awareness and the economics of the tracking and advertising industry. Even after numerous press reports and widespread disclosure of leakages on the Web and on popular Online Social Networks, many users appear not be fully aware of the fact that their information may be collected, aggregated and linked with ambient information for a variety of purposes. Past attempts at alleviating this problem have addressed individual aspects of the user's data collection. In this paper we move towards a comprehensive and efficient client-side tool that maximizes users' awareness of the extent of their information leakage. We show that such a customizable tool can help users to make informed decisions on controlling their privacy footprint.

The large-scale collection and exploitation of personal information to drive targeted online advertisements has raised privacy concerns. As a step towards understanding these concerns, we study the relationship between how much information is collected and how valuable it is for advertising. We use HTTP traces consisting of millions of users to aid our study and also present the first comparative study between aggregators. We develop a simple model that captures the various parameters of today's advertising revenues, whose values are estimated via the traces. Our results show that per aggregator revenue is skewed (5% accounting for 90% of revenues), while the contribution of users to advertising revenue is much less skewed (20% accounting for 80% of revenue). Google is dominant in terms of revenue and reach (presence on 80% of publishers). We also show that if all 5% of the top users in terms of revenue were to install privacy protection, with no corresponding reaction from the publishers, then the revenue can drop by 30%.

Web search is an integral part of our daily lives. Recently, there has been a trend of personalization in Web search, where different users receive different results for the same search query. The increasing personalization is leading to concerns about Filter Bubble effects, where certain users are simply unable to access information that the search engines' algorithm decides is irrelevant. Despite these concerns, there has been little quantification of the extent of personalization in Web search today, or the user attributes that cause it. In light of this situation, we make three contributions. First, we develop a methodology for measuring personalization in Web search results. While conceptually simple, there are numerous details that our methodology must handle in order to accurately attribute differences in search results to personalization. Second, we apply our methodology to 200 users on Google Web Search; we find that, on average, 11.7% of results show differences due to personalization, but that this varies widely by search query and by result ranking. Third, we investigate the causes of personalization on Google Web Search. Surprisingly, we only find measurable personalization as a result of searching with a logged in account and the IP address of the searching user. Our results are a first step towards understanding the extent and effects of personalization on Web search engines today.

The process of designing vertically integrated applications is enhanced if the distinct architectures, or architecture styles, and relevant performance constraints and interactions can first be identified. Applications, although running in varied environments, also may require specific architecture services, non-operational features such as portability or fault-tolerance that might be common across several architectural styles. The application design process should be an iterative exercise of first understanding system requirements and then determining how they may be partitioned according to styles and services. An integral part of this process is to identify software components and subsystems that must be developed or can be reused from other systems. This paper describes a design-partitioning process applied to the new Signal Operations Platforms-Provisioning (SOP-P) operations system. The experiment shows that it is feasible to identify large design components confined within a few architecture styles that are common to network management and operations software.

Distributed networks of personal workstations are becoming the dominant computing environment for software development organizations. Many cooperative activities that are carried out in such environments are particularly well suited for automated support. Taking the point of view that such activities are modeled most naturally as the occurrence of events requiring actions to be performed, we developed a system called Yeast (Yet another Event Action Specification Tool). Yeast is a client server system in which distributed clients register event action specifications with a centralized server, which performs event detection and specification management. Each specification submitted by a client defines a pattern of events that is of interest to the client's application plus an action that is to be executed in response to an occurrence of the event pattern; the server triggers the action of a specification once it has detected an occurrence of the associated event pattern. Yeast provides a global space of events that is visible to and shared by all users. In particular, events generated by one user can trigger specifications registered by another user. Higher level applications are built as collections of Yeast specifications. We use Yeast on a daily basis for a variety of applications, from deadline notification to software process automation. The paper presents an in depth description of Yeast and an example application of Yeast, in which Yeast specifications are used to automate a software distribution process involving several interdependent software tools. >

We employ user activity data from three highly popular gifting applications on Facebook to study the evolution of user activity on applications through the most commonly-used growth mechanism, namely Application Requests. We find user activity graphs differ from friendship graphs in large part due to the inherent directionality of user activity, and node transience. Our results show that, unlike degree distributions in friendship graphs, activity graphs exhibit strong asymmetry in in- and out-degree distributions, and that out-degrees are not accurately described by currently known parametric distributions. As such, user activity graphs cannot be simulated through existing intent- and feature-driven algorithms that can model friendship graphs. We present a novel probabilistic growth model for user activity on the gifting genre of social applications. Our model decouples in- and out-degrees based on their distinct nature exhibited by our empirical data. We use the insight that regardless of increasing, declining or stable user activity, gifting application user activity exhibits the same graph structure. Our model produces synthetic graphs that consist of disconnected components with low clustering of nodes, and exhibit degree structures very similar to our real activity data. We discuss the benefits and shortfalls of our model and its applicability to other types of OSN-based applications, such as social games. To the best of our knowledge this study is the first to explore and model user activity growth processes on OSN-based applications.

Monetizing personal information is a key economic driver of online industry. End-users are becoming more concerned about their privacy, as evidenced by increased media attention. This paper proposes a mechanism called 'transactional' privacy that can be applied to personal information of users. Users decide what personal information about themselves is released and put on sale while receiving compensation for it. Aggregators purchase access to exploit this information when serving ads to a user. Truthfulness and efficiency, attained through an unlimited supply auction, ensure that the interests of all parties in this transaction are aligned. We demonstrate the effectiveness of transactional privacy for web-browsing using a large mobile trace from a major European capital. We integrate transactional privacy in a privacy-preserving system that curbs leakage of information. These mechanisms combine to form a market of personal information that can be managed by a trusted third party.

The sharing of personal data has emerged as a popular activity over online social networking sites like Facebook. As a result, the issue of online social network privacy has received significant attention in both the research literature and the mainstream media. Our overarching goal is to improve defaults and provide better tools for managing privacy, but we are limited by the fact that the full extent of the privacy problem remains unknown; there is little quantification of the incidence of incorrect privacy settings or the difficulty users face when managing their privacy.In this paper, we focus on measuring the disparity between the desired and actual privacy settings, quantifying the magnitude of the problem of managing privacy. We deploy a survey, implemented as a Facebook application, to 200 Facebook users recruited via Amazon Mechanical Turk. We find that 36% of content remains shared with the default privacy settings. We also find that, overall, privacy settings match users' expectations only 37% of the time, and when incorrect, almost always expose content to more users than expected. Finally, we explore how our results have potential to assist users in selecting appropriate privacy settings by examining the user-created friend lists. We find that these have significant correlation with the social network, suggesting that information from the social network may be helpful in implementing new tools for managing privacy.

An understanding of Internet topology is central to answer various questions ranging from network resilience to peer selection or data center location. While much of prior work has examined AS-level connectivity, meaningful and relevant results from such an abstract view of Internet topology have been limited. For one, semantically, AS relationships capture business relationships and not physical connectivity. Additionally, many organizations often use multiple ASes, either to implement different routing policies, or as legacies from mergers and acquisitions. In this paper, we move beyond the traditional AS graph view of the Internet to define the problem of AS-to-organization mapping. We describe our initial steps at automating the capture of the rich semantics inherent in the AS-level ecosystem where routing and connectivity intersect with organizations. We discuss preliminary methods that identify multi-AS organizations from WHOIS data and illustrate the challenges posed by the quality of the available data and the complexity of real-world organizational relationships.

Anonymization of social networks before they are published or shared has become an important research question. Recent work on anonymizing social networks has looked at privacy preserving techniques for publishing a single instance of the network. However, social networks evolve and a single instance is inadequate for analyzing the evolution of the social network or for performing any longitudinal data analysis. We study the problem of repeatedly publishing social network data as the network evolves, while preserving privacy of users. Publishing multiple instances of the same network independently has privacy risks, since stitching the information together may allow an adversary to identify users in the networks.We propose methods to anonymize a dynamic network such that the privacy of users is preserved when new nodes and edges are added to the published network. These methods make use of link prediction algorithms to model the evolution of the social network. Using this predicted graph to perform group-based anonymization, the loss in privacy caused by new edges can be reduced. We evaluate the privacy loss on publishing multiple social network instances using our methods.

Online Social Networks (OSNs) have already attracted more than half a billion users. However, our understanding of which OSN features attract and keep the attention of these users is poor. Studies thus far have relied on surveys or interviews of OSN users or focused on static properties, e. g., the friendship graph, gathered via sampled crawls. In this paper, we study how users actually interact with OSNs by extracting clickstreams from passively monitored network traffic. Our characterization of user interactions within the OSN for four different OSNs (Facebook, LinkedIn, Hi5, and StudiVZ) focuses on feature popularity, session characteristics, and the dynamics within OSN sessions. We find, for example, that users commonly spend more than half an hour interacting with the OSNs while the byte contributions per OSN session are relatively small.

International audience; Internet exchange points (IXPs) are an important ingredient of the Internet AS-level ecosystem - a logical fabric of the Internet made up of about 30,000 ASes and their mutual business relationships whose primary purpose is to control and manage the flow of traffic. Despite the IXPs' critical role in this fabric, little is known about them in terms of their peering matrices (i.e., who peers with whom at which IXP) and corresponding traffic matrices (i.e., how much traffic do the different ASes that peer at an IXP exchange with one another). In this paper, we report on an Internet-wide traceroute study that was specifically designed to shed light on the unknown IXP-specific peering matrices and involves targeted traceroutes from publicly available and geographically dispersed vantage points. Based on our method, we were able to discover and validate the existence of about 44K IXP-specific peering links - nearly 18K more links than were previously known. In the process, we also classified all known IXPs depending on the type of information required to detect them. Moreover, in view of the currently used inferred AS-level maps of the Internet that are known to miss a significant portion of the actual AS relationships of the peer-to-peer type, our study provides a new method for augmenting these maps with IXP-related peering links in a systematic and informed manner.

For the last few years we have been studying the diffusion of private information for users as they visit various Web sites triggering data gathering aggregation by third parties. This paper reports on our longitudinal study consisting of multiple snapshots of our examination of such diffusion over four years. We examine the various technical ways by which third-party aggregators acquire data and the depth of user-related information acquired. We study techniques for protecting privacy diffusion as well as limitations of such techniques. We introduce the concept of secondary privacy damage. Our results show increasing aggregation of user-related data by a steadily decreasing number of entities. A handful of companies are able to track users' movement across almost all of the popular Web sites. Virtually all the protection techniques have significant limitations highlighting the seriousness of the problem and the need for alternate solutions.

Rule-based packet classification is a powerful method for identifying traffic anomalies, with network security as a key application area. While popular systems like Snort are used in many network locations, comprehensive deployment across Tier-1 service provider networks is costly due to the need for high-speed monitors at many network ingress points. Since ISPs already collect flow statistics ubiquitously, can we use it for detecting the same anomalies as the packet based rules in spite of aggregation and absence of payload information? We exploit correlations between packet and flow level information via a machine learning (ML) approach to associate packet level alarms with a feature vector derived from flow records on the same traffic. We describe a system architecture for network-wide flow- alarming and describe the steps required to establish a proof- of-concept. We evaluate prediction accuracy of candidate ML algorithms on actual packet traces. The duration of prediction effectiveness is an issue for ML approaches and more so in resource intensive network applications. Initial results show little impairment of performance over periods of one or two weeks.

Online Social Networks(OSN) command a user base of about half a billion users on the Internet. Although the traffic contribution in bytes by OSNs is significantly less than earlier applications responsible for dramatic increase on the Internet (such as peer-to-peer networks), OSNs have already had a profound impact on the Internet. The organic growth in the sheer volume of users, the range and diversity of application run using OSNs as a distribution platform, and the wide range of new technologies underpinning their growth, all portend an enduring effect as well. While there are similarities to earlier phenomena, there are numerous differences due to some properties unique to OSNs. This paper enumerates interesting properties, the methodologies used to study them, and the challenges faced by researchers in measuring ONSs. A few results from resent studies my colleagues and I have been involved in are also presented.

Online social networks (OSNs) with half a billion users have dramatically raised concerns on privacy leakage. Users, often willingly, share personal identifying information about themselves, but do not have a clear idea of who accesses their private information or what portion of it really needs to be accessed. In this study we examine popular OSNs from a viewpoint of characterizing potential privacy leakage. Our study identifies what bits of information are currently being shared, how widely, and what users can do to prevent such sharing. We also examine the role of third-party sites that track OSN users and compare with privacy leakage on popular traditional Web sites. Our long term goal is to identify the narrow set of private information that users really need to share to accomplish specific interactions on OSNs.

Web 2.0 is a buzzword introduced in 2003-04 which is commonly used to encompass various novel phenomena on the World Wide Web. Although largely a marketing term, some of the key attributes associated with Web 2.0 include the growth of social networks, bi-directional communication, various 'glue' technologies, and significant diversity in content types. We are not aware of a technical comparison between Web 1.0 and 2.0. While most of Web 2.0 runs on the same substrate as 1.0, there are some key differences. We capture those differences and their implications for technical work in this paper. Our goal is to identify the primary differences leading to the properties of interest in 2.0 to be characterized. We identify novel challenges due to the different structures of Web 2.0 sites, richer methods of user interaction, new technologies, and fundamentally different philosophy. Although a significant amount of past work can be reapplied, some critical thinking is needed for the networking community to analyze the challenges of this new and rapidly evolving environment.

There is a large and increasing amount of unwanted traffic on the Internet today, including phishing, spam, and distributed denial-of-service attacks. One way to deal with this problem is to filter unwanted traffic at the routers based on source IP addresses. Because of the limited number of available filters in the routers today, aggregation is used in practice: a single filter describes and blocks an entire range of IP addresses. This results in blocking of all (unwanted and wanted) traffic generated from hosts with IP addresses in that range. In this paper, we develop a family of algorithms that, given a blacklist containing the source IP addresses of unwanted traffic and a constraint on the number of filters, construct a set of filtering rules that optimize the tradeoff between the unwanted and legitimate traffic that is blocked. We show that our algorithms are optimal and also computationally efficient. Furthermore, we demonstrate that they are particularly beneficial when applied to realistic distributions of sources of unwanted traffic, which are known to exhibit spatial and temporal clustering.

Unexpected surges in request traffic (e.g., flash crowds) can exercise server-side resources such as access bandwidth, CPU, and disks in unanticipated ways. Administrators today do not have the requisite tools to fully understand the effect that flash crowds can have on server-side resources. As a result, most Web-servers today rely on significant over-provisioning, strict admission control, or alternatively use potentially expensive solutions like CDNs to provide high availability under load. A more fine-grained understanding of the performance of servers under emulated but controlled flash crowd like conditions can guide administrators to make more efficient provisioning and resource management decisions.We present the initial design of Mini-Flash Crowds (MFC) -- a light-weight wide-area profiling service that reveals resource bottlenecks in a Web-server infrastructure, including access bandwidth, processing resources, and back-end data management. The MFC approach is based on a set of controlled measurements in which an increasing number of distributed clients make synchronized requests to exercise specific resources of a remote server. Using a number of wide-area experiments and controlled lab tests, we show that our approach can faithfully track the impact of request loads on different server resources. Our approach is non-intrusive and thus we can use it to actively probe numerous live Web servers. We present the results from a preliminary measurement study of resource provisioning on public Web servers.

Various bits of information about users accessing Web sites. some of which are private, have been gathered since the inception of the Web. Increasingly the gathering, aggregation, and processing has been outsourced to third parties. The goal of this work is to examine the effectiveness of specific techniques to limit this diffusion of private information to third parties. We also examine the impact of these privacy protection techniques on the usability and quality of the Web pages returned. Using objective measures for privacy protection and page quality we examine their tradeoffs for different privacy protection techniques applied to a collection of popular Web sites as well as a focused set of sites with significant privacy concerns. We study privacy protection both at a browser and at a proxy.

As a follow up to characterizing traffic deemed as unwanted by Web clients such as advertisements, we examine how information related to individual users is aggregated as a result of browsing seemingly unrelated Web sites. We examine the privacy diffusion on the Internet, hidden transactions, and the potential for a few sites to be able to construct a profile of individual users. We define and generate a privacy footprint allowing us to assess and compare the diffusion of privacy information across a wide variety of sites. We examine the effectiveness of existing and new techniques to reduce this diffusion. Our results show that the size of the privacy footprint is a legitimate cause for concern across the sets of sites that we study.

Web pages include extraneous material that may be viewed as undesirable by a user. Increasingly many Web sites also require users to register to access either all or portions of the site. Such tension between content owners and users has resulted in a "cat and mouse" game between content provided and how users access it.We carried out a measurement-based study to understand the nature of extraneous content and its impact on performance as perceived by users. We characterize how this content is distributed and the effectiveness of blocking mechanisms to stop it as well as countermeasures taken by content owners to negate such mechanisms. We also examine sites that require some form of registration to control access and the attempts made to circumvent it.Results from our study show that extraneous content exists on a majority of popular pages and that a 25-30% reduction in downloaded objects and bytes with corresponding latency reduction can be attained by blocking such content. The top ten advertisement delivering companies delivered 40% of all URLs matched as ads in our study. Both the server name and the remainder of the URL are important in matching a URL as an ad. A majority of popular sites require some form of registration and for such sites users can obtain an account from a shared public database. We discuss future measures and countermeasures on the part of each side.

Web performance measurements and availability tests have been carried out using a variety of infrastructures over the last several years. Disruptions in the Internet can lead to Web sites being unavailable or increase user-perceived latency. The unavailability could be due to DNS, failures in segments of the physical network cutting off thousands of users, or attacks. Prompt reactions to network-wide events can be facilitated by local or remote measurement and monitoring. Better yet, a distributed set of intercommunicating measurement and monitoring entities that react to events dynamically could go a long way to handle disruptions.We have designed and built ATMEN, a triggered measurement infrastructure to communicate and coordinate across various administrative entities. ATMEN nodes can trigger new measurements, query ongoing passive measurements or historical measurements stored on remote nodes, and coordinate the responses to make local decisions. ATMEN reduces wasted measurements by judiciously reusing measurements along three axes: spatial, temporal, and application.We describe the use of ATMEN for key Web applications such as performance based ranking of popular Web sites and availability of DNS servers on which most Web transactions are dependent. The evaluation of ATMEN is done using multiple network monitoring entities called Gigascopes installed across the USA, measurement data of a popular network application involving millions of users distributed across the Internet, and scores of clients to aid in gathering measurement information upon demand. Our results show that such a system can be built in a scalable fashion.

Streaming change detection schemes are of great interest in the context of data warehouses, data cleaning systems, network traffic anomaly detection and other measurement scenarios. The goal of change detection systems is to determine whether fundamental characteristics of a data stream have changed, either temporally (with respect to prior data) or spatially (with respect to other streams). We present an application of an information-theoretic change detection scheme to determining stationarity in Internet measurements. Our experiments indicate that this generic scheme, despite being oblivious to the nature of the data, matches a more domain specific approach for this problem, and requires no domain knowledge to work effectively.

For the last few years, large Web content providers interested in improving their scalability and availability have increasingly turned to three techniques: mirroring, content distribution, and ISP multihoming. The Domain Name System (DNS) has gained a prominent role in the way each of these techniques directs client requests to achieve the goals of scalability and availability. The DNS is thought to offer the transparent and agile control necessary to react quickly to ISP link failures or phenomenon such as flash crowds.In this paper, we investigate this assumption with the objective of quantifying the degree of responsiveness that can be expected from DNS. We use a combination of Web and DNS access measurements from several busy Web sites, as well as a large content distribution network, to characterize the behavior of end-systems and local DNS servers in terms of their adherence to DNS-based controls. Our results suggest that DNS is at best a coarse-grained mechanism, and poorly suited for applications, such as route control, which require quick response to link failures or performance degradations. We then propose several proactive techniques that, when deployed in cooperation between large content providers and important clients, have the potential to improve the responsiveness of DNS-based control.

Honeypots have been traditionally used to advertise dark address space and gather information about originators of traffic to such addresses. With simple thresholding mechanisms this technique has shown itself to be fairly effective in identifying suspicious IP addresses. Honeypots are however unsuitable to locate the precise entry point of unwanted traffic. Tracing back to the origination of such traffic is hard due to the delay and difficulty of maintaining state along the path of such traffic. We propose a novel mobile honeypot mechanism that allows unwanted traffic to be detected significantly closer to the origin. The mobility in our scheme stems from additional information that is made available to the upstream ASes as well as the changes in the set of dark address space advertised. Sharing information with a network of friendly ASes has the potential to identify and significantly lower unwanted traffic on such links.

Significant research on the Web is performed using logs collected from proxies and servers. Virtually all of these logs are from sites running the 1.0 version (or earlier) of HTTP. After four years a draft-standard specification of HTTP/1.1 has emerged. However, many proxies and servers still use HTTP/1.0, and most so-called HTTP/1.1 servers do not employ all of the key features available in the protocol. It is not feasible to evaluate the impact of HTTP/1.1 traffic using HTTP/1.0 logs. Thus, there is a need to examine ways of postulating HTTP/1.1 traffic from HTTP/1.0 traffic. This paper presents the En Passant architecture and a tool based on the architecture to convert HTTP/1.0 logs and traffic into plausible HTTP/1.1 traffic based on various parameters representing changes between the two versions of the protocol. The tool takes both the high-level information in HTTP/1.0 server logs and low-level information found in packet traces as input and generates a possible HTTP/1.1 log. We present the set of parameters and the actual feature changes between the protocol that impact the traffic by using a live packet trace as example.

We present the architecture and implementation of READY an event notification service that provides efficient, decoupled, asynchronous event notifications. READY supports consumer specifications that match over both single and compound event patterns, communication sessions that manage quality of service (QoS) for event delivery, grouping constructs for sessions and specifications, event zones and boundary routers that bound the scope of event distribution and control the mapping of events across zones.

With a key component of latency on the Web being connection set up between clients and Web servers, several ways to avoid connections have been explored. While the work in recent years on Content Distribution Networks (CDNs) have moved some content 'closer' to users at the cost of increasing DNS traffic, they have not fully exploited the available unused potential of existing protocols. We explore ways by which a variety of Web responses can be piggybacked on DNS messages. While we evaluated our idea in the Web context, the approach is generic and not restricted to Web responses. We propose an architecture for HTTP piggybacking in DNS messages and carry out a detailed performance analysis based on a trace-driven simulation study. Our architecture requires minimal extensions to existing protocols, utilizing only the allowed optional fields for these extensions. It is fully compatible and can coexist with the current Web.

In 1990 a project was established at AT&T to build applications that manage telephone systems. Since then the project has successfully completed over 20 applications comprising about 500,000 lines of source code. These systems are used daily by hundreds of managers and operators to monitor and provision the AT&T long distance telephone network. The project's success can be attributed directly to an early commitment in making software reuse a major component of its software development process. A critical factor was the establishment of a feedback loop between consumers and producers of reusable software to foster continual improvement and extension of reusable code repositories. Progresses in the feedback loop are measured by five different reuse measures. While no one measure is "best" as each provides a different perspective on reuse, two derived from the consumer/producer model have proven particularly useful: use of reusable library components and reuse growth factor. The latter developed in the study, helped uncover a new opportunity for reuse that was not obvious from other measures.

Presents READY, a multi-threaded implementation of the CORBA Notification Service. The main contribution of our work is the design and development of scalable solutions for the implementation of the CORBA Notification Service. In particular, we present the overall architecture of READY, discuss the key design challenges and choices we made with respect to filter evaluation and event dispatching, and present the current implementation status. Finally, we present preliminary experimental results from our current implementation.