Application-level Data Research Articles

Network traffic application identification based on message size analysis

Identifying network applications is centric to many network management and security tasks. A large number of approaches exist in the literature, most of which are based on statistical and machine learning techniques. For protecting the user privacy, the majority of the existing methods rely on discriminative traffic attributes at the network and transport layers, such as interaction schemes, packet sizes and inter-arrival times. In this work, we propose a novel blind, quintuple centric approach by exploring traffic attributes at the application level without inspecting the payloads. The identification model is based on the analysis of the first application-layer messages in a flow (quintuple), based on their sizes, directions and positions in the flow. The underlying idea is that the first messages of a flow usually carry some application level signaling and data transfer units (command, request, response, etc.) that can be discriminative through their patterns of size and direction. A Gaussian mixture model is proposed to characterize the applications, based on a study of the common characteristics of application-level protocols. The blind classifier is based on Markov models with low complexity and reasonable computational requirements, where the training procedure consists of profiling the target applications separately. Promising results were obtained for some popular protocols including many peer-to-peer applications.

An approach to enhance pnetCDF performance in environmental modeling applications

Abstract. Data intensive simulations are often limited by their I/O (input/output) performance, and "novel" techniques need to be developed in order to overcome this limitation. The software package pnetCDF (parallel network Common Data Form), which works with parallel file systems, was developed to address this issue by providing parallel I/O capability. This study examines the performance of an application-level data aggregation approach which performs data aggregation along either row or column dimension of MPI (Message Passing Interface) processes on a spatially decomposed domain, and then applies the pnetCDF parallel I/O paradigm. The test was done with three different domain sizes which represent small, moderately large, and large data domains, using a small-scale Community Multiscale Air Quality model (CMAQ) mock-up code. The examination includes comparing I/O performance with traditional serial I/O technique, straight application of pnetCDF, and the data aggregation along row and column dimension before applying pnetCDF. After the comparison, "optimal" I/O configurations of this application-level data aggregation approach were quantified. Data aggregation along the row dimension (pnetCDFcr) works better than along the column dimension (pnetCDFcc) although it may perform slightly worse than the straight pnetCDF method with a small number of processors. When the number of processors becomes larger, pnetCDFcr outperforms pnetCDF significantly. If the number of processors keeps increasing, pnetCDF reaches a point where the performance is even worse than the serial I/O technique. This new technique has also been tested for a real application where it performs two times better than the straight pnetCDF paradigm.

Is the Time Allocated to Review Patent Applications Inducing Examiners to Grant Invalid Patents?: Evidence from Micro-Level Application Data

We explore how examiner behavior is altered by the time allocated for reviewing patent applications. Insufficient examination time may hamper examiner search and rejection efforts, leaving examiners more inclined to grant invalid applications. To test this prediction, we use application-level data to trace the behavior of individual examiners over the course of a series of promotions that carry with them reductions in examination-time allocations. We find evidence emonstrating that such promotions are associated with reductions in examination scrutiny and increases in granting tendencies, as well as evidence that those additional patents being issued on the margin are of below-average quality.

What Is the Probability of Receiving a US Patent?

TABLE OF CONTENTS Introduction I. Data and Methodology II. Patent Examination in United States A. The Examination Process B. Continuation Procedures III. Allowance Rates Across Technology Fields IV. Allowance Rates Across Inventor Types V. Conclusion Appendix INTRODUCTION Inventors choose to protect their inventions with patents for a variety of reasons. (1) A key element of inventors' cost-benefit calculus regarding patents is expectation that their will succeed. Unfortunately, there is little information about historical rates at which United States Patent and Trademark Office (USPTO) grants This lack of information about probability of obtaining a makes it difficult for inventors to determine best way to protect their intellectual property. The absence of systematic evidence on allowance rates also skews policy discussions about examination standards employed by USPTO. Some scholars argue that USPTO grants patents too easily, pointing to patents like Beerbrella (U.S. Patent #6637447), swinging methods (U.S. Patent #6368227), and a user-operated amusement apparatus for kicking user's buttocks (U.S. Patent #6293974). These scholars argue that a large number of such frivolous, rubber-stamped patents are hindering, rather than promoting, U.S. innovation system. (2) For example, some entities, often referred to as patent trolls, allegedly obtain patents with dubious claims solely to extract rents from genuine inventors who may appear to be infringing on entities' Judge Posner recently opined that the problem of trolls is a function in part of promiscuity with which office has issued patents. (3) Despite numerous allegations of USPTO laxity and calls for reforms based on anecdotal observations of silly patents, few studies have attempted to calculate actual percentage of U.S. that succeed. The calculation of allowance rates, while seemingly simple, is complicated by several aspects of examination process. First, that are initially rejected after examination can produce new, closely related called continuations. Continuations are difficult to track, but may ultimately emerge as Second, USPTO publishes examination outcomes only for granted applications, if filed before November 29, 2000, or for pending eighteen months after application date if filed on or after November 29, 2000. (4) Third, applicants alter claims in their during examination process. The allowance of some patentable claims within an application is not same as allowance of an application as it was filed, and this distinction should be taken into account in any discussion of allowance rates, particularly as it pertains to extent of scrutiny associated with examination process. In this study, we address above challenges by analyzing unique application-level data available internally at USPTO. The data tracks 2.15 million utility filed from 1996 to 2005 and examined until June 30, 2013, by which time 99.8% of progenitor had been granted or abandoned. (5) Progenitor applications are unrelated to any previously filed U.S. applications. This allows us to link each progenitor application to related subsequent produced by various continuation procedures. We can thereby accurately estimate probability of allowance without limitations of previous studies based on partial samples of published or exit cohorts. (6) In order to capture complexity of examination process, we calculate three measures of allowance rates: (i) first-action allowance rate, proportion of progenitor allowed without further examination; (ii) progenitor allowance rate (or simply, allowance rate), proportion of progenitor allowed without any continuation procedure, and (iii) family allowance rate, proportion of progenitor that produce at least one patent, including outcomes of continuation that emerge from progenitor applications. …

Did affordable housing mandates cause the subprime mortgage crisis?

The 1992 Federal Housing Enterprises Financial Safety and Soundness Act (GSE Act) mandated that a specified percentage of Fannie Mae and Freddie Mac purchases come from underserved populations. A number of prominent observers have pointed to the GSE Act as a root cause of the recent housing crisis. This paper evaluates the link between the GSE Act and relaxed mortgage market standards. Using loan application-level data from the Home Mortgage Disclosure Act, I analyze whether the GSE Act’s single-family affordable housing goals altered mortgage lending or purchasing decisions. To identify this effect, I use a regression discontinuity design that exploits arbitrary cutoffs used to determine whether a loan satisfies the GSE Act goals. I find that the GSE Act’s single-family affordable housing goals increased GSE purchases from very low-income borrowers by 4.4% but had no effect on mortgage lending. These results stand up to a number of specification and robustness checks.

Study on Information Security Monitoring Framework

As malware has become increasingly sophisticated over the past several years, it is no longer unusual to see it disable critical security services on a victims machine. In our threat model, we assume the attacker can compromise the users OS and any application running inside it. The results show that our threat model makes an introspection assumption stating that the OS and application level data structures in the User VM memory have not been altered, it is still instructive to consider what it would take to perform this type of attack, and the most security critical data is located in the User OS kernel.

Macroprudential Policy, Countercyclical Bank Capital Buffers and Credit Supply: Evidence from the Spanish Dynamic Provisioning Experiments

We analyze the impact of the countercyclical capital buffers held by banks on the supply of credit to firms and their subsequent performance. Countercyclical ‘dynamic’ provisioning unrelated to specific loan losses was introduced in Spain in 2000, and modified in 2005 and 2008. The resultant bank-specific shocks to capital buffers, combined with the financial crisis that shocked banks according to their available pre-crisis buffers, underpin our identification strategy. Our estimates from comprehensive bank-, firm-, loan-, and loan application-level data suggest that countercyclical capital buffers help smooth credit supply cycles and in bad times uphold firm credit availability and performance.

De-anonymizing the internet using unreliable IDs

Today's Internet is open and anonymous. While it permits free traffic from any host, attackers that generate malicious traffic cannot typically be held accountable. In this paper, we present a system called HostTracker that tracks dynamic bindings between hosts and IP addresses by leveraging application-level data with unreliable IDs. Using a month-long user login trace from a large email provider, we show that HostTracker can attribute most of the activities reliably to the responsible hosts, despite the existence of dynamic IP addresses, proxies, and NATs. With this information, we are able to analyze the host population, to conduct forensic analysis, and also to blacklist malicious hosts dynamically.

Capacity analysis of reservation-based random access for broadband wireless access networks

In this paper we propose a novel model for the capacity analysis on the reservation-based random multiple access system, which can be applied to the medium access control protocol of the emerging WiMax technology. In such a wireless broadband access system, in order to support QoS, the channel time is divided into consecutive frames, where each frame consists of some consequent mini-slots for the transmission of requests, used for the bandwidth reservation, and consequent slots for the actual data packet transmission. Three main outcomes are obtained: first, the upper and lower bounds of the capacity are derived for the considered system. Second, we found through the mathematical analysis that the transmission rate of reservation-based multiple access protocol is maximized, when the ratio between the number of mini-slots and that of the slots per frame is equal to the reciprocal of the random multiple access algorithm's transmission rate. Third, in the case of WiMax networks with a large number of subscribers, our analysis takes into account both the capacity and the mean packet delay criteria and suggests to keep such a ratio constant and independent of application-level data traffic arrival rate.

Reliable Transmission of Audio Streams in Lossy Channels Using Application Level Data Hiding

The paper improves the reliability of audio streams in a lossy channel. The mechanism groups audio data samples into source and carrier sets. The carrier set carry the information about the source set which is encoded using data hiding methodology - quantization index modulation. At the receiver side, a missing source data sample can be reconstructed using the carrier set and the remaining source set. Based on reliability constraints a hybrid design combining interleaving and data hiding is presented. Experiments show an improved reliability as compared to forward error correction and interleaving.

The session token protocol for forensics and traceback

In this paper we present the Session Token Protocol (STOP), a new protocol that can assist in the forensic analysis of a computer involved in malicious network activity. It has been designed to help automate the process of tracing attackers who log on to a series of hosts to hide their identity. STOP utilizes the Identification Protocol infrastructure, improving both its capabilities and user privacy. On request, the STOP protocol saves user-level and application-level data associated with a particular TCP connection and returns a random token specifically related to that session. The saved data are not revealed to the requester unless the token is returned to the local administrator, who verifies the legitimacy of the need for the release of information. The protocol supports recursive traceback requests to gather information about the entire path of a connection. This allows an incident investigator to trace attackers to their home systems, but does not violate the privacy of normal users. This paper details the new protocol and presents implementation and performance results.

SABUL: A Transport Protocol for Grid Computing

This paper describes SABUL, an application-level data transfer protocol for data-intensive applications over high bandwidth-delay product networks. SABUL is designed for reliability, high performance, fairness and stability. It uses UDP to transfer data and TCP to return control messages. A rate-based congestion control that tunes the inter-packet transmission time helps achieve both efficiency and fairness. In order to remove the fairness bias between flows with different network delays, SABUL adjusts its sending rate at uniform intervals, instead of at intervals determined by round trip time. This protocol has demonstrated its efficiency and fairness in both experimental and practical applications. SABUL has been implemented as an open source C++ library, which has been successfully used in several Grid computing applications.

Microsoft universal data access platform

Microsoft Universal Data Access defines a platform for developing multi-tier enterprise applications that require efficient access to diverse relational or non-relational data sources across intranets or the Internet. Universal Data Access consists of a collection of software components that interact with each other using system-level interfaces defined by OLE DB and providing an application-level data access model called ActiveX Data Objects (ADO). This talk provides an overview of the platform.

Burst scheduling networks

Most application-level data units are too large to be carried in a single packet and must be segmented for network delivery. To an application, the end-to-end delays and loss rate of its data units are more relevant measures of performance than ones specified for individual packets. From this observation, we introduced the concept of a burst (which subsumes the concept of a block in the ATM literature). A flow is modeled as a sequence of bursts, each of which models a sequence of packets that encapsulate an application data unit. We describe an approach towards designing integrated services packet-switching networks that provide QoS guarantees to bursts. We present a burst-based flow specification, an architecture and algorithms for packet scheduling, and tight bounds on end-to-end burst delays. In particular, we illustrate how to exploit the burst-based flow specification to improve implementation efficiency. We describe how burst scheduling networks can be designed to provide a real-time VBR service with no loss and, with burst-based admission control, a real-time VBR service at a specified loss rate.

Object-oriented communication structures for multimedia data transport

The evolving multimedia applications generate requirements for complex transport capabilities, i.e., functional features, in the end-to-end communication system such as handling of heterogeneity among communicating terminals, supporting finer levels of user-specifiable quality of data transport service, and synchronization of various data streams for delivery at users in real time. Accordingly, the communication system may be viewed as extending the basic capabilities provided by the backbone network (e.g., bandwidth allocation) into a set of transport capabilities suitable for complex applications. This paper presents: (1) an object-oriented view of the user interface to the communication system with an elegant separation of data transport functionalities, and (2) an approach to the design of underlying transport protocols. The object-orientation decomposes an application-level data transport into a set of network channel objects, with each channel object handling a separate data stream. The object interactions are modeled using a data-flow style, which allows a richer set of protocols to implement the communication system and offers flexibility to accommodate complex and heterogeneous subscriber services/terminals. The data-flow method also allows a high degree of communication level parallelism among data transport through channels. The view of a multimedia communication system as a parameterizable black-box, as underscored in the object-oriented structuring, allows easier interworking of the communication system with existing networks and easier integration of multimedia transport into programming environments.