Search

Predicting the behavior of real-time traffic (e.g., VoIP) in mobility scenarios could help the operators to better plan their network infrastructures and to optimize the allocation of resources. Accordingly, in this work the authors propose a forecasting analysis of crucial QoS/QoE descriptors (some of which neglected in the technical literature) of VoIP traffic in a real mobile environment. The problem is formulated in terms of a multivariate time series analysis. Such a formalization allows to discover and model the temporal relationships among various descriptors and to forecast their behaviors for future periods. Techniques such as Vector Autoregressive models and machine learning (deep-based and tree-based) approaches are employed and compared in terms of performance and time complexity, by reframing the multivariate time series problem into a supervised learning one. Moreover, a series of auxiliary analyses (stationarity, orthogonal impulse responses, etc.) are performed to discover the analytical structure of the time series and to provide deep insights about their relationships. The whole theoretical analysis has an experimental counterpart since a set of trials across a real-world LTE-Advanced environment has been performed to collect, post-process and analyze about 600,000 voice packets, organized per flow and differentiated per codec., Comment: 15 pages

Nowadays, most telecommunication services adhere to the Service Function Chain (SFC) paradigm, where network functions are implemented via software. In particular, container virtualization is becoming a popular approach to deploy network functions and to enable resource slicing among several tenants. The resulting infrastructure is a complex system composed by a huge amount of containers implementing different SFC functionalities, along with different tenants sharing the same chain. The complexity of such a scenario lead us to evaluate two critical metrics: the steady-state availability (the probability that a system is functioning in long runs) and the latency (the time between a service request and the pertinent response). Consequently, we propose a latency-driven availability assessment for multi-tenant service chains implemented via Containerized Network Functions (CNFs). We adopt a multi-state system to model single CNFs and the queueing formalism to characterize the service latency. To efficiently compute the availability, we develop a modified version of the Multidimensional Universal Generating Function (MUGF) technique. Finally, we solve an optimization problem to minimize the SFC cost under an availability constraint. As a relevant example of SFC, we consider a containerized version of IP Multimedia Subsystem, whose parameters have been estimated through fault injection techniques and load tests.

Service provisioning mechanisms implemented across 5G infrastructures take broadly into use the network service chain concept. Typically, it is coupled with Network Function Virtualization (NFV) paradigm, and consists in defining a pre-determined path traversed by a set of softwarized network nodes to provide specific services. A well known chain-like framework is the IP Multimedia Subsystem (IMS), a key infrastructure of 5G networks, that we characterize both by a performance and an availability perspective. Precisely, supported by a designed from scratch testbed realized through Clearwater platform, we perform a stochastic assessment of a softwarized IMS (softIMS) architecture where two main stages stand out: i) a performance analysis, where, exploiting the queueing network decomposition method, we formalize an optimization problem of resource allocation by modeling each softIMS node as an M/G/c system; ii) an availability assessment, where, adopting the Stochastic Reward Net methodology, we are able to characterize the behavior of softIMS in terms of failure/repair events, and to derive a set of optimal configurations satisfying a given availability requirement (e.g. five nines) while minimizing deployment costs. Two routines dubbed OptCNT and OptSearchChain have been devised to govern the performance and availability analyses, respectively.

Most softwarized telco services are conveniently framed as Service Function Chains (SFCs). Indeed, being structured as a combination of interconnected nodes, service chains may suffer from the single point of failure problem, meaning that an individual node malfunctioning could compromise the whole chain operation. To guarantee "highly available" (HA) levels, service providers are required to introduce redundancy strategies to achieve specific availability demands, where cost constraints have to be taken into account as well. Along these lines we propose HASFC (standing for High Availability SFC), a framework designed to support, through a dedicated REST interface, the MANO infrastructure in deploying SFCs with an optimal availability-cost trade off. Our framework is equipped with: i) an availability model builder aimed to construct probabilistic models of the SFC nodes in terms of failure and repair actions; ii) a chaining and selection module to compose the possible redundant SFCs, and extract the best candidates thereof. Beyond providing architectural details, we demonstrate the functionalities of HASFC through a use case which considers the IP Multimedia Subsystem, an SFC-like structure adopted to manage multimedia contents within 4G and 5G networks.

Machine Learning (ML) techniques are becoming an invaluable support for network intrusion detection, especially in revealing anomalous flows, which often hide cyber-threats. Typically, ML algorithms are exploited to classify/recognize data traffic on the basis of statistical features such as inter-arrival times, packets length distribution, mean number of flows, etc. Dealing with the vast diversity and number of features that typically characterize data traffic is a hard problem. This results in the following issues: i) the presence of so many features leads to lengthy training processes (particularly when features are highly correlated), while prediction accuracy does not proportionally improve; ii) some of the features may introduce bias during the classification process, particularly those that have scarce relation with the data traffic to be classified. To this end, by reducing the feature space and retaining only the most significant features, Feature Selection (FS) becomes a crucial pre-processing step in network management and, specifically, for the purposes of network intrusion detection. In this review paper, we complement other surveys in multiple ways: i) evaluating more recent datasets (updated w.r.t. obsolete KDD 99) by means of a designed-from-scratch Python-based procedure; ii) providing a synopsis of most credited FS approaches in the field of intrusion detection, including Multi-Objective Evolutionary techniques; iii) assessing various experimental analyses such as feature correlation, time complexity, and performance. Our comparisons offer useful guidelines to network/security managers who are considering the incorporation of ML concepts into network intrusion detection, where trade-offs between performance and resource consumption are crucial.

The Next Generation 5G Networks can greatly benefit from the synergy between virtualization paradigms, such as the Network Function Virtualization (NFV), and service provisioning platforms such as the IP Multimedia Subsystem (IMS). The NFV concept is evolving towards a lightweight solution based on containers that, by contrast to classic virtual machines, do not carry a whole operating system and result in more efficient and scalable deployments. On the other hand, IMS has become an integral part of the 5G core network, for instance, to provide advanced services like Voice over LTE (VoLTE). In this paper we combine these virtualization and service provisioning concepts, deriving a containerized IMS infrastructure, dubbed cIMS, providing its assessment through statistical characterization and experimental measurements. Specifically, we: i) model cIMS through the queueing networks methodology to characterize the utilization of virtual resources under constrained conditions; ii) draw an extended version of the Pollaczek-Khinchin formula, which is useful to deal with bulk arrivals; iii) afford an optimization problem focused at maximizing the whole cIMS performance in the presence of capacity constraints, thus providing new means for the service provider to manage service level agreements (SLAs); $iv)$ evaluate a range of cIMS scenarios, considering different queuing disciplines including also multiple job classes. An experimental testbed based on the open source platform Clearwater has been deployed to derive some realistic values of key parameters (e.g. arrival and service times).

The Network Function Virtualization (NFV) paradigm has been devised as an enabler of next generation network infrastructures by speeding up the provisioning and the composition of novel network services. The latter are implemented via a chain of virtualized network functions, a process known as Service Function Chaining. In this paper, we evaluate the availability of multi-tenant SFC infrastructures, where every network function is modeled as a multi-state system and is shared among different and independent tenants. To this aim, we propose a Universal Generating Function (UGF) approach, suitably extended to handle performance vectors, that we call Multidimensional UGF. This novel methodology is validated in a realistic multi-tenant telecommunication network scenario, where the service chain is composed by the network elements of an IP Multimedia Subsystem implemented via NFV. A steady-state availability evaluation of such an exemplary system is presented and a redundancy optimization problem is solved, so providing the SFC infrastructure which minimizes deployment cost while respecting a given availability requirement.

Mobile telecommunications are converging towards all-IP solutions. This is the case of the Long Term Evolution (LTE) technology that, having no circuit-switched bearer to support voice traffic, needs a dedicated VoIP infrastructure, which often relies on the IP Multimedia Subsystem architecture. Most telecom operators implement LTE-A, an advanced version of LTE often marketed as 4G+, which achieves data rate peaks of 300 Mbps. Yet, although such novel technology boosts the access to advanced multimedia contents and services, telco operators continue to consider the VoIP market as the major revenue for their business. In this work, the authors propose a detailed performance assessment of VoIP traffic by carrying out experimental trials across a real LTE-A environment. The experimental campaign consists of two stages. First, we characterize VoIP calls between fixed and mobile terminals, based on a dataset that includes more than 750,000 data-voice packets. We analyze quality-of-service metrics such as round-trip time (RTT) and jitter, to capture the influence of uncontrolled factors that typically appear in real-world settings. In the second stage, we further consider VoIP flows across a range of codecs, looking at the trade-offs between quality and bandwidth consumption. Moreover, we propose a statistical characterization of jitter and RTT (representing the most critical parameters), identifying the optimal approximating distribution, namely the Generalized Extreme Value (GEV). The estimation of parameters through the Maximum Likelihood criterion, leads us to reveal both the short- and long-tail behaviour for jitter and RTT, respectively., Comment: Data available at: https://www.researchgate.net/publication/342276809_DATASETS

The use of Machine Learning (ML) techniques in Intrusion Detection Systems (IDS) has taken a prominent role in the network security management field, due to the substantial number of sophisticated attacks that often pass undetected through classic IDSs. These are typically aimed at recognising attacks based on a specific signature, or at detecting anomalous events. However, deterministic, rule-based methods often fail to differentiate particular (rarer) network conditions (as in peak traffic during specific network situations) from actual cyber attacks. In this paper we provide an experimental-based review of neural-based methods applied to intrusion detection issues. Specifically, we i) offer a complete view of the most prominent neural-based techniques relevant to intrusion detection, including deep-based approaches or weightless neural networks, which feature surprising outcomes; ii) evaluate novel datasets (updated w.r.t. the obsolete KDD99 set) through a designed-from-scratch Python-based routine; iii) perform experimental analyses including time complexity and performance (accuracy and F-measure), considering both single-class and multi-class problems, and identifying trade-offs between resource consumption and performance. Our evaluation quantifies the value of neural networks, particularly when state-of-the-art datasets are used to train the models. This leads to interesting guidelines for security managers and computer network practitioners who are looking at the incorporation of neural-based ML into IDS., Comment: Early Access on IEEE Transactions on Network and Service Management

Nowadays, the Security Information and Event Management (SIEM) systems take on great relevance in handling security issues for critical infrastructures as Internet Service Providers. Basically, a SIEM has two main functions: i) the collection and the aggregation of log data and security information from disparate network devices (routers, firewalls, intrusion detection systems, ad hoc probes and others) and ii) the analysis of the gathered data by implementing a set of correlation rules aimed at detecting potential suspicious events as the presence of encrypted real-time traffic. In the present work, the authors propose an enhanced implementation of a SIEM where a particular focus is given to the detection of encrypted Skype traffic by using an ad-hoc developed enhanced probe (ESkyPRO) conveniently governed by the SIEM itself. Such enhanced probe, able to interact with an agent counterpart deployed into the SIEM platform, is designed by exploiting some machine learning concepts. The main purpose of the proposed ad-hoc SIEM is to correlate the information received by ESkyPRO and other types of data obtained by an Intrusion Detection System (IDS) probe in order to make the encrypted Skype traffic detection as accurate as possible.

Distributed Denial-of-Service (DDoS) attacks are usually launched through the $botnet$, an "army" of compromised nodes hidden in the network. Inferential tools for DDoS mitigation should accordingly enable an early and reliable discrimination of the normal users from the compromised ones. Unfortunately, the recent emergence of attacks performed at the application layer has multiplied the number of possibilities that a botnet can exploit to conceal its malicious activities. New challenges arise, which cannot be addressed by simply borrowing the tools that have been successfully applied so far to earlier DDoS paradigms. In this work, we offer basically three contributions: $i)$ we introduce an abstract model for the aforementioned class of attacks, where the botnet emulates normal traffic by continually learning admissible patterns from the environment; $ii)$ we devise an inference algorithm that is shown to provide a consistent (i.e., converging to the true solution as time progresses) estimate of the botnet possibly hidden in the network; and $iii)$ we verify the validity of the proposed inferential strategy over $real$ network traces., Comment: Submitted for publication