Emerging Software-Defined Networking (SDN) technique brings new opportunities to improve network performance. Some SDN-enabled programmable switches are deployed in legacy networks, and thus legacy and programmable switches could coexist, generating hybrid SDNs. In this paper, we study the node upgrade for layer-2 hybrid SDN and propose Shortcutter to accelerate the transmission. Preliminary results show that the proposed Shortcutter can reduce the forwarding path’s length 7% on average, compared with baseline solutions.
{"title":"Poster: Enabling Fast Forwarding in Hybrid Software-Defined Networks","authors":"Yijun Sun, Zehua Guo, Songshi Dou, Junjie Zhang, Changlin Li, Xiang Ouyang","doi":"10.1109/ICNP52444.2021.9651943","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651943","url":null,"abstract":"Emerging Software-Defined Networking (SDN) technique brings new opportunities to improve network performance. Some SDN-enabled programmable switches are deployed in legacy networks, and thus legacy and programmable switches could coexist, generating hybrid SDNs. In this paper, we study the node upgrade for layer-2 hybrid SDN and propose Shortcutter to accelerate the transmission. Preliminary results show that the proposed Shortcutter can reduce the forwarding path’s length 7% on average, compared with baseline solutions.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"78 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124555449","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651948
Jason Hussey, Ethan Taylor, Kerri Stone, T. Camp
Network traffic classification is used to identify the nature of traffic on a network. Entities capable of monitoring net-work traffic use classification for all manner of reasons, including identification of mobile applications being used on the network. It is possible that the usage of encrypted messaging applications by users on these networks can be detected, betraying elements of their privacy.In this paper, we describe a system that leverages campus network resources to generate real-world data alongside a more curated dataset captured from Android application traffic. We also explore the ability of machine learning (ML) models to accurately classify traffic from these encrypted messaging applications. Understanding what is revealed from network data is important given that the use of these applications is meant to maximize privacy in the first place.
{"title":"Poster: Data Collection for ML Classification of Encrypted Messaging Applications","authors":"Jason Hussey, Ethan Taylor, Kerri Stone, T. Camp","doi":"10.1109/ICNP52444.2021.9651948","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651948","url":null,"abstract":"Network traffic classification is used to identify the nature of traffic on a network. Entities capable of monitoring net-work traffic use classification for all manner of reasons, including identification of mobile applications being used on the network. It is possible that the usage of encrypted messaging applications by users on these networks can be detected, betraying elements of their privacy.In this paper, we describe a system that leverages campus network resources to generate real-world data alongside a more curated dataset captured from Android application traffic. We also explore the ability of machine learning (ML) models to accurately classify traffic from these encrypted messaging applications. Understanding what is revealed from network data is important given that the use of these applications is meant to maximize privacy in the first place.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126406384","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651979
Linir Zamir, Aman Shaan, Mehrdad Nojoumian
Consensus protocols are a key feature in decentral-ized systems where multiple unreliable nodes operate, e.g., in Blockchain technologies with many worldwide applications such as supply chain management, cryptocurrencies and information sharing. ISRaft is a consensus protocol built upon Raft, a previously developed protocol that is used for replicated state machines when a group of nodes is required to achieve a consensus related to the state of the machine. This paper therefore proposes an alternative version of the ISRaft consensus protocol to allow communication among nodes in a secured fashion while maintaining the security features of the original ISRaft algorithm even in the presence of adversarial nodes. The proposed model utilizes a trust parameter to enforce cooperation, i.e., a trust value is assigned to each node to prevent malicious activities over time. This is a practical solution for autonomous units with resource-constrained devices where a regular encrypted communication method can negatively affect the system performance.
{"title":"ISRaft Consensus Algorithm for Autonomous Units","authors":"Linir Zamir, Aman Shaan, Mehrdad Nojoumian","doi":"10.1109/ICNP52444.2021.9651979","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651979","url":null,"abstract":"Consensus protocols are a key feature in decentral-ized systems where multiple unreliable nodes operate, e.g., in Blockchain technologies with many worldwide applications such as supply chain management, cryptocurrencies and information sharing. ISRaft is a consensus protocol built upon Raft, a previously developed protocol that is used for replicated state machines when a group of nodes is required to achieve a consensus related to the state of the machine. This paper therefore proposes an alternative version of the ISRaft consensus protocol to allow communication among nodes in a secured fashion while maintaining the security features of the original ISRaft algorithm even in the presence of adversarial nodes. The proposed model utilizes a trust parameter to enforce cooperation, i.e., a trust value is assigned to each node to prevent malicious activities over time. This is a practical solution for autonomous units with resource-constrained devices where a regular encrypted communication method can negatively affect the system performance.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"28 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133589163","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651913
Sara Bitan, Adi Molkho
We present STIP, a new model for Scalable Trusted IP networks, that are secure and resilient to cyber-attacks without impairing reliability. STIP addresses managed network use-cases including enterprise network authentication and authorization, and ISP use-cases, including trust based routing, and application aware networking. It can provide an enabling infrastructure that improves resilience to the painful BGP hijacking and distributed denial of service attacks.At the data plane, STIP consists of a trusted forwarding engine, that uses authenticated trust extensions to process traffic reliably. At the control and management plane STIP divides the network into trust domains that evaluate trustworthiness of devices in the domain, and distribute it securely using transitive trust. Our vision is Internet-wide STIP deployment . We present a migration process based on trust domains that can be used to gradually upgrade current IP networks to STIP.
{"title":"STIP: A new model of trusted network","authors":"Sara Bitan, Adi Molkho","doi":"10.1109/ICNP52444.2021.9651913","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651913","url":null,"abstract":"We present STIP, a new model for Scalable Trusted IP networks, that are secure and resilient to cyber-attacks without impairing reliability. STIP addresses managed network use-cases including enterprise network authentication and authorization, and ISP use-cases, including trust based routing, and application aware networking. It can provide an enabling infrastructure that improves resilience to the painful BGP hijacking and distributed denial of service attacks.At the data plane, STIP consists of a trusted forwarding engine, that uses authenticated trust extensions to process traffic reliably. At the control and management plane STIP divides the network into trust domains that evaluate trustworthiness of devices in the domain, and distribute it securely using transitive trust. Our vision is Internet-wide STIP deployment . We present a migration process based on trust domains that can be used to gradually upgrade current IP networks to STIP.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"8 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129069266","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651961
Ralf Kundel, Nehal Baganal Krishna, Christoph Gärtner, Tobias Meuser, Amr Rizk
Congestion control mechanisms in computer networks rely mainly on a feedback loop having a reaction time equal to the flow RTT. Reducing this feedback time helps the sender to react faster to changing network conditions such as congestion. In this work, we propose reverse-path congestion notification on top of programmable networking switches. Our approach can significantly lower the reaction time, such that the congestion control implementation can adapt much faster to changing network conditions. The proposed approach aims to work with current TCP implementations with no required changes to the communication endpoints. Last, we show how the presented approach could be realized by utilizing off-the-shelf programmable switches.
{"title":"Poster: Reverse-Path Congestion Notification: Accelerating the Congestion Control Feedback Loop","authors":"Ralf Kundel, Nehal Baganal Krishna, Christoph Gärtner, Tobias Meuser, Amr Rizk","doi":"10.1109/ICNP52444.2021.9651961","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651961","url":null,"abstract":"Congestion control mechanisms in computer networks rely mainly on a feedback loop having a reaction time equal to the flow RTT. Reducing this feedback time helps the sender to react faster to changing network conditions such as congestion. In this work, we propose reverse-path congestion notification on top of programmable networking switches. Our approach can significantly lower the reaction time, such that the congestion control implementation can adapt much faster to changing network conditions. The proposed approach aims to work with current TCP implementations with no required changes to the communication endpoints. Last, we show how the presented approach could be realized by utilizing off-the-shelf programmable switches.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"102 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122507912","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651959
Muhammad Naeem Tahir, M. Katz, Zunera Javed
In recent years, the vehicular ad hoc networking (VANET) concept has supported the development of emerging safety related applications for vehicles based on cooperative awareness between vehicles. This cooperative awareness can be achieved by exploiting wireless sensors and technologies to transmit periodic messages to neighboring vehicles. These messages normally contain information regarding vehicles, such as position, speed, distance between vehicles, etc. For the transfer of safety messages, Wi-Fi and the suit of IEEE 802.11p/WAVE protocols were commonly used initially but now cellular-based LTE and 5G are the emerging technologies for VANETs. In this paper, a comparison is performed considering the European ITS-G5 standard, Wi-Fi, LTE and 5G by exchanging safety messages in VANETs. We have exchanged real-time road weather and traffic observation data to evaluate the performance of the aforementioned wireless technologies in terms of successful message delivery probability. Our results reveal that due to weak communication links and the lack of line of sight (LOS) communication for Vehicle to Infrastructure (V2I) and Vehicle to Vehicle (V2V) scenarios, Wi-Fi and 802.11p are outperformed by LTE and 5G networks.
{"title":"Poster: Connected Vehicles using Short-range (Wi-Fi & IEEE 802.11p) and Long-range Cellular Networks (LTE & 5G)","authors":"Muhammad Naeem Tahir, M. Katz, Zunera Javed","doi":"10.1109/ICNP52444.2021.9651959","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651959","url":null,"abstract":"In recent years, the vehicular ad hoc networking (VANET) concept has supported the development of emerging safety related applications for vehicles based on cooperative awareness between vehicles. This cooperative awareness can be achieved by exploiting wireless sensors and technologies to transmit periodic messages to neighboring vehicles. These messages normally contain information regarding vehicles, such as position, speed, distance between vehicles, etc. For the transfer of safety messages, Wi-Fi and the suit of IEEE 802.11p/WAVE protocols were commonly used initially but now cellular-based LTE and 5G are the emerging technologies for VANETs. In this paper, a comparison is performed considering the European ITS-G5 standard, Wi-Fi, LTE and 5G by exchanging safety messages in VANETs. We have exchanged real-time road weather and traffic observation data to evaluate the performance of the aforementioned wireless technologies in terms of successful message delivery probability. Our results reveal that due to weak communication links and the lack of line of sight (LOS) communication for Vehicle to Infrastructure (V2I) and Vehicle to Vehicle (V2V) scenarios, Wi-Fi and 802.11p are outperformed by LTE and 5G networks.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"25 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"121064034","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651915
Osama Shahid, Viraaji Mothukuri, Seyedamin Pouriyeh, R. Parizi, H. Shahriar
Billions of IoT devices are connected to networks all around us, enabling cyber-physical systems. These devices can carry and generate user-sensitive data, examples of such devices are smartwatches, medical equipment, and smart home gadgets. Individual IoT devices have some form of intrusion detection system integrated, but once they are all connected, a network threat to one device could mean a threat to many. IoT devices must have a robust intrusion detection system that would keep devices secure over a network. To aid with this, we provide a machine learning solution that adheres to Global Data Protection Regulation by keeping the user data secure locally on the IoT device itself. We propose a Federated Learning (FL) approach that capitalizes on a decentralized and collaborative way of training machine learning models. In this study, we practice federated learning technique to train and create a robust intrusion detection model for the security of IoT devices. We evaluate our proposed approach using three different use-cases to show the security enhancements that improve using the FL technique, resulting in a more reliable performance in this domain.
{"title":"Detecting Network Attacks using Federated Learning for IoT Devices","authors":"Osama Shahid, Viraaji Mothukuri, Seyedamin Pouriyeh, R. Parizi, H. Shahriar","doi":"10.1109/ICNP52444.2021.9651915","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651915","url":null,"abstract":"Billions of IoT devices are connected to networks all around us, enabling cyber-physical systems. These devices can carry and generate user-sensitive data, examples of such devices are smartwatches, medical equipment, and smart home gadgets. Individual IoT devices have some form of intrusion detection system integrated, but once they are all connected, a network threat to one device could mean a threat to many. IoT devices must have a robust intrusion detection system that would keep devices secure over a network. To aid with this, we provide a machine learning solution that adheres to Global Data Protection Regulation by keeping the user data secure locally on the IoT device itself. We propose a Federated Learning (FL) approach that capitalizes on a decentralized and collaborative way of training machine learning models. In this study, we practice federated learning technique to train and create a robust intrusion detection model for the security of IoT devices. We evaluate our proposed approach using three different use-cases to show the security enhancements that improve using the FL technique, resulting in a more reliable performance in this domain.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"20 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122179563","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651911
Sourav Panda, K. Ramakrishnan, L. Bhuyan
Data center workload fluctuations need periodic, but careful scheduling to minimize power consumption while meeting the task completion time requirements. Existing data center scheduling systems tightly pack containers to save power. However, with the growth of multi-tiered applications, there is a significant need to account for the affinity between application components, to minimize communication overheads and latency. Centralized container scheduling systems using graph partitioning algorithms cause a significant number of task migrations, with associated downtime.We design pMACH, a novel distributed container scheduling scheme for optimizing both power and task completion time in data centers. It minimizes task migrations and packs frequently communicating containers together without overloading servers. pMACH operates at peak energy efficiency, thus reducing energy consumption while also providing greater headroom for unpredictable workload spikes. We also propose in-network monitoring using smartNICs (sNIC) to measure the communications and then perform scheduling in a hierarchical, parallelized framework to achieve high performance and scalability. pMACH is based on incremental partitioning and it leverages the previous scheduling decision to significantly reduce the number of containers moved between servers, avoiding application downtime.Both testbed measurements and large-scale trace-driven simulations show that pMACH saves at least 13.44% more power compared to previous scheduling systems. It speeds task completion, reducing the 95th percentile by a factor of 1.76-2.11 compared to existing container scheduling schemes. Compared to other static graph-based approaches, our incremental partitioning technique reduces migrations per epoch by 82%.
{"title":"pMACH: Power and Migration Aware Container scHeduling","authors":"Sourav Panda, K. Ramakrishnan, L. Bhuyan","doi":"10.1109/ICNP52444.2021.9651911","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651911","url":null,"abstract":"Data center workload fluctuations need periodic, but careful scheduling to minimize power consumption while meeting the task completion time requirements. Existing data center scheduling systems tightly pack containers to save power. However, with the growth of multi-tiered applications, there is a significant need to account for the affinity between application components, to minimize communication overheads and latency. Centralized container scheduling systems using graph partitioning algorithms cause a significant number of task migrations, with associated downtime.We design pMACH, a novel distributed container scheduling scheme for optimizing both power and task completion time in data centers. It minimizes task migrations and packs frequently communicating containers together without overloading servers. pMACH operates at peak energy efficiency, thus reducing energy consumption while also providing greater headroom for unpredictable workload spikes. We also propose in-network monitoring using smartNICs (sNIC) to measure the communications and then perform scheduling in a hierarchical, parallelized framework to achieve high performance and scalability. pMACH is based on incremental partitioning and it leverages the previous scheduling decision to significantly reduce the number of containers moved between servers, avoiding application downtime.Both testbed measurements and large-scale trace-driven simulations show that pMACH saves at least 13.44% more power compared to previous scheduling systems. It speeds task completion, reducing the 95th percentile by a factor of 1.76-2.11 compared to existing container scheduling schemes. Compared to other static graph-based approaches, our incremental partitioning technique reduces migrations per epoch by 82%.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124104363","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Pub Date : 2021-11-01DOI: 10.1109/ICNP52444.2021.9651956
Shunsuke Higuchi, Y. Koizumi, Junji Takemasa, A. Tagami, T. Hasegawa
This paper proposes an IP forwarding information base (FIB) encoding leveraging an emerging data structure called a learned index , which uses machine learning to associate key-position pairs in a key-value store. A learned index for FIB lookups is expected to yield a more compact representation and faster lookups compared to existing FIBs based on tries or hash tables, at the cost of efficient FIB updates, which is difficult to support with a learned index. We optimize our implementation for lookup speed, exploiting that for efficient FIB lookups it is enough to approximate the key-position pairs with a piece-wise linear function, instead of having to learn the key-position pairs. The experiments using real BGP routing information snapshots suggest that the size of the proposed FIB is compact and lookup speed is sufficiently fast regardless of the length of matched prefixes.
{"title":"Learned FIB: Fast IP Forwarding without Longest Prefix Matching","authors":"Shunsuke Higuchi, Y. Koizumi, Junji Takemasa, A. Tagami, T. Hasegawa","doi":"10.1109/ICNP52444.2021.9651956","DOIUrl":"https://doi.org/10.1109/ICNP52444.2021.9651956","url":null,"abstract":"This paper proposes an IP forwarding information base (FIB) encoding leveraging an emerging data structure called a learned index , which uses machine learning to associate key-position pairs in a key-value store. A learned index for FIB lookups is expected to yield a more compact representation and faster lookups compared to existing FIBs based on tries or hash tables, at the cost of efficient FIB updates, which is difficult to support with a learned index. We optimize our implementation for lookup speed, exploiting that for efficient FIB lookups it is enough to approximate the key-position pairs with a piece-wise linear function, instead of having to learn the key-position pairs. The experiments using real BGP routing information snapshots suggest that the size of the proposed FIB is compact and lookup speed is sufficiently fast regardless of the length of matched prefixes.","PeriodicalId":343813,"journal":{"name":"2021 IEEE 29th International Conference on Network Protocols (ICNP)","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-11-01","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130323291","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}