ISP Networks Research Articles

CESNET-TLS-Year22: A year-spanning TLS network traffic dataset from backbone lines.

The modern approach for network traffic classification (TC), which is an important part of operating and securing networks, is to use machine learning (ML) models that are able to learn intricate relationships between traffic characteristics and communicating applications. A crucial prerequisite is having representative datasets. However, datasets collected from real production networks are not being published in sufficient numbers. Thus, this paper presents a novel dataset, CESNET-TLS-Year22, that captures the evolution of TLS traffic in an ISP network over a year. The dataset contains 180 web service labels and standard TC features, such as packet sequences. The unique year-long time span enables comprehensive evaluation of TC models and assessment of their robustness in the face of the ever-changing environment of production networks.

Measurement-Noise Filtering for Automatic Discovery of Flow Splitting Ratios in ISP Networks

Network telemetry and analytics is essential for providing highly dependable services in modern computer networks. In particular, network flow analytics for ISP networks allows operators to inspect and reason about traffic patterns in their networks in order to react to anomalies. High performance network analytics systems are designed with scalability in mind, and can consequently only observe partial information about the network traffic. Still, they need to provide a holistic view of the traffic, including the distribution of different traffic flows on each link. It is impractical to monitor such fine-grained telemetry, and in large, heterogeneous networks it is often too complex and error-prone, if not impossible, to access and maintain all technical specifications and router-specific configurations needed to determine e.g. the load balancing weights used when traffic is split onto multiple paths. The ratios by which flows are split on the possible paths must be derived indirectly from the measured flow demands and link utilizations. Motivated by a case study provided by a major European ISP, we suggest an efficient method to estimate the flow splitting ratios. Our approach, based on quadratic linear programming, is scalable and achieves robustness to the measurement noise found in a typical network analytics deployment by filtering out certain constraints in the linear program. Finally, we implement an automated tool for estimating the flow splitting ratios and document its applicability on real data from the ISP.

An Analysis of the Domain Names Linked to the Important World Events using a Longitudinal Measurement Approach

Since the lack of sufficient security mechanisms, domain system (DNS) has become the main operational infrastructure for cyber intruders to launch cyber-attacks. Therefore, how to discover and block the potential malicious domains and its corresponding IP addresses fast and accurately has become a hot research area as it is one of the most important method in preventing unknown cyber-attacks. In this paper, we proposed an approach to detect malicious domains by analyzing massive mobile web traffic data. We used multiple features to classify, including the textual features and the traffic statistics features of domains and presented three typical classifiers to compare the classifying effect of each. Spark framework is leveraged to speed up the calculation of a large-scale DNS traffic. The efficiency of our system makes us believe the approach can help a lot in the field of network security. The new features are harder to be tampered with and can help determine whether a domain is malicious from a more comprehensive perspective. We evaluate MalPortrait on the passive DNS traffic collected from real-world large ISP networks.

A new community business model for a free, open, and neutral network: Considering the wireless to fiber transition

Free, open, and neutral network (FONN) is an alternative to the prevailing proprietary ISP networks on the Internet. From the FONN manifesto, we conceive two main goals: to give freedom to users and to cooperate in building and maintaining the FONN infrastructure. However, the manifesto avoids talking about the business model of this infrastructure and neglects to give the appropriate role to each member of the community in building and maintaining this infrastructure. Moreover, current research misplaces FONN’s cooperation in the avoidance of the tragedy of the commons and also overlooks ownership. The move from wireless to fiber has amplified the consequences of not considering ownership or member roles. In order to fill the previous gaps, in this article we will first relate the objectives of this manifesto to the field of free software. Next we will argue that FONN’s cooperation should be placed in the avoidance of the tragedy of the anticommons. Inspired by free software we define a new business model for FONN besides discussing different ownership licenses. Furthermore, we state the roles of members and rigorously model the economic flow of construction and maintenance costs. The main implication of the proposed business model is that future FONNs will avoid the economic and organizational collapse of some current FONN communities, mainly because funding cannot be based solely on crowdfunding or volunteering. Yet, as an overall benefit, FONN avoids the duplication of infrastructure. This new business model has been used successfully in the fiber deployment of a FONN section.

NetTiSA: Extended IP flow with time-series features for universal bandwidth-constrained high-speed network traffic classification

Network traffic monitoring based on IP Flows is a standard monitoring approach that can be deployed to various network infrastructures, even the large ISP networks connecting millions of people. Since flow records traditionally contain only limited information (addresses, transport ports, and amount of exchanged data), they are also commonly extended by additional features that enable network traffic analysis with high accuracy. These flow extensions are, however, often too large or hard to compute, which then allows only offline analysis or limits their deployment only to smaller-sized networks. This paper proposes a novel extended IP flow called NetTiSA (Network Time Series Analysed) flow, based on analysing the time series of packet sizes. By thoroughly testing 25 different network traffic classification tasks, we show the broad applicability and high usability of NetTiSA flow. For practical deployment, we also consider the sizes of flows extended by NetTiSA features and evaluate the performance impacts of their computation in the flow exporter. The novel features proved to be computationally inexpensive and showed excellent discriminatory performance. The trained machine learning classifiers with proposed features mostly outperformed the state-of-the-art methods. NetTiSA finally bridges the gap and brings universal, small-sized, and computationally inexpensive features for traffic classification that can be scaled up to extensive monitoring infrastructures, bringing the machine learning traffic classification even to 100Gbps backbone lines.

Compiling Service Function Chains via Fine-Grained Composition in the Programmable Data Plane

Service function chains (SFCs) are fundamental services in today's datacenters and ISP networks. Explosive volume of network traffic creates high demands for low latency and high performance. The emergence of programmable data planes has offered a new way to overcome the problem. However, limited by pipeline constraints in hardware architecture, implementing multiple network functions on programmable data planes is challenging. Besides, considering various types of network functions, e.g., stateful network functions, a general model is essential for abstracting distinct network functions. In this article, we propose <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> which provides a fine-grained SFCs deployment scheme in programmable data planes. Control flow graph (CFG) is proposed to abstract and analyze various network functions. Then we model pipeline constraints in the hardware architecture using an ILP (Integer Linear Programming), and model the SFCs deployment in the substrate network as a one big switch (OBS) problem. To reduce deployment cost, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> first composes multiple SFCs to a compound CFG for eliminating redundant logics within SFCs, further decomposes the compound CFG based on the resource limitation per stage, and finally maps the OBS into the substrate network. We have implemented <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> in both bmv2 software switch and P4 hardware switch (i.e., Intel Tofino ASIC). Evaluation results show that <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">pSFC</i> reduces switch costs by 45.7% and decreases average latency by 22% without compromising throughput.

BlockQoS: Fair Monetization of On-demand Quality-of-Service using Blockchains

Video conferencing has become an essential tool for working from home. However, poor audio/video quality resulting from unstable Internet connections undermines the productivity of important tasks. Additionally, the static monetization model for ISP networks, which employs third parties, cannot support on-demand and dynamic Quality-of-Service sessions that are necessary to maximize the Quality-of-Experience (QoE) of video conferencing. To address this, we introduce BlockQoS: Fair Monetization of On-Demand Quality-of-Service using Blockchains. BlockQoS allows clients to request and manage their Quality-of-Service requirements through a blockchain-based platform operating using a smart contract. It implements a decentralized monetization model to eliminate third parties, enforce transparency in service-level agreements (SLAs), and reduce blockchain operating costs by utilizing off-chain billing validated using zero-knowledge proofs (zk-SNARK). Additionally, we propose a Quality-of-Service delivery verification mechanism that enforces service level agreements on the hardware external to the blockchain, and a dynamic evaluation method based on the concept of Nash equilibrium in game theory that prevents malicious behavior by ISPs and users. We implemented BlockQoS over Ethereum with a Ryu controller, zk-SNARK, and SGX. Our experiments show that BlockQoS offers transaction cost reduction of up to 88% (gas cost) and latency reduction of up to 87% compared to the state-of-the-art on-chain solutions.

MAGNNETO: A Graph Neural Network-Based Multi-Agent System for Traffic Engineering

Current trends in networking propose the use of Machine Learning (ML) for a wide variety of network optimization tasks. As such, many efforts have been made to produce ML-based solutions for Traffic Engineering (TE), which is a fundamental problem in ISP networks. Nowadays, state-of-the-art TE optimizers rely on traditional optimization techniques, such as Local search, Constraint Programming, or Linear programming. In this paper, we present MAGNNETO, a distributed ML-based framework that leverages Multi-Agent Reinforcement Learning and Graph Neural Networks for distributed TE optimization. MAGNNETO deploys a set of agents across the network that learn and communicate in a distributed fashion via message exchanges between neighboring agents. Particularly, we apply this framework to optimize link weights in OSPF, with the goal of minimizing network congestion. In our evaluation, we compare MAGNNETO against several state-of-the-art TE optimizers in more than 75 topologies (up to 153 nodes and 354 links), including realistic traffic loads. Our experimental results show that, thanks to its distributed nature, MAGNNETO achieves comparable performance to state-of-the-art TE optimizers with significantly lower execution times. Moreover, our ML-based solution demonstrates a strong generalization capability to successfully operate in new networks unseen during training.

Open Caching: An Innovative Way for Content Providers to Serve Customers

As media companies focus on growing their direct-to-consumer (D2C) businesses, the ecosystem that enables content delivery over IP-based networks continues to evolve and become even more critical. To gain efficiencies in the process, media technology providers want to better leverage each component in the content delivery path. Caching popular content at the network edge—bringing it closer to end users—is a common ISP network management practice that has long been a part of the internet’s architecture. But the new open caching standard enables a move away from proprietary systems, while still supporting an environment that leverages content delivery networks (CDNs), last mile providers, and streaming technologies that bring content closer to the consumer.

Decentralized Blockchain Based ISP Networks

This paper aims to point out the potential use, of Blockchain based decentralized computer networks in ISPs and how they promote a secure and private alternative to today’s centralized ISP networks.

On Efficient Service Function Chaining in Hybrid Software Defined Networks

To minimize operating expenses (OPEX) and enhance flexibility for network service provisioning, network function virtualization (NFV) is used to chain an ordered sequence of virtualized network functions (VNFs), also known as service function chain (SFC), which can be placed on commodity servers. As a highly complementary to NFV, software-defined networking (SDN) can offer an agile way of VNF orchestration with the capability of fine-granularity network control over flows. However, one-step migration to SDN is impossible in ISP networks. Thus, in this paper we resort to hybrid SDN to implement SFC provisioning. By jointly optimizing SDN deployment that largely determines capital expenditures (CAPEX) and VNF placement that decides OPEX, we manage to make a tradeoff between CAPEX and OPEX, and to find out an appropriate SDN deployment rate for network operator. We first formulate the problem as an integer linear programming (ILP) model <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> , then, reformulate it with column generation technique and decomposition theory to develop a distributed approximation algorithm CGPD which obtains a tight upper bound of optimal solution to <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> . In order to better decrease CAPEX, a dynamic programming-based heuristic EOES giving importance to effective resource sharing is further designed based on a hidden Markov model. The simulation results indicate that, the difference between <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\boldsymbol {P}$ </tex-math></inline-formula> and CGPD is marginal. CGPD outperforms EOES in terms of total cost, average delay and bandwidth utilization, and EOES on the other hand demands 20% SDN deployment rate which is half of that of CGPD.

Designing Routing Table by Using Static Algorithm of Routing

Transfering information in computer networks is administered through many intermediary routing devices and this task is devided into small size packets. While transfering packets from the local network to the remote networks, Default gateway is the destination address. As a rule, each network to which the router contacts, needs a separate interface. This interface is used both linking local networks (LAN) and global networks (WAN). To a large extent, Lan is an Ethernet network. WAN-s are used when we want to link networks on a large territory. For an instance, connection to WAN can be used when we need Lan to be switched onto ISP network. To administer this process, certain devices called routers are actively used. Their chief functions are to determine the optimal route of package and sending packets to their destination. In order to find the best route for sending a packet, the router uses its own routing table. It checks the packet destination and besides, it takes into account as to by which interface packets should be sent to each well-known network. When the optimal route is discovered, the router incapsulates the packet and secures sending the packet to its destination.The material presented in our study is interesting as the existing route is often replaced by the shorter route during the estimation process for the spesific fragment of the given network, and every further estimetion process should be taken into account to obtain right final result. Yet, in reality we must heed the fact that not only little length of ditance determines the transfer of informatio fast. The example given presents a quite interesting case of solving the task (in terms of determining the short possible route), and it can be successfully applied in learning process in this direction.

Using AI to detect and classify malicious domain names

On the Internet and other IP networks, the Domain Name System (DNS) is used to identify machines. Resource entries in the DNS link domain names to various sorts of data. Commonly, it is used to transform domain names to IP addresses so that computers may locate services and devices utilizing the underlying network protocols. Due to a lack of security safeguards, cybercriminals use the Domain Name System (DNS) to launch attacks. So how to quickly locate and block possibilities? Finding rogue websites and their IP addresses has become a prominent research topic. Preventing unknown cyber-attacks is critical. This article advocated analysing enormous amounts of mobile web traffic to find dangerous domains. To classify, we used text and domain traffic statistics. Then we gave three typical classifiers to compare their impacts. The Spark framework is used to calculate huge amounts of DNS traffic. Our system's efficiency persuades us. It can be very useful in network security. The new features are tough to use and assist in identifying rogue domains. We tested MalPortrait using real-world big ISP networks' passive DNS traffic.

On the Benefits of Joint Optimization of Reconfigurable CDN-ISP Infrastructure

ISP networks have become a critical infrastructure in our society. Traffic in these networks is growing and is increasingly dominated by a small number of large CDNs connecting at multiple locations. Simultaneously, the networks are becoming more flexible, in terms of routing, CDN user mapping, and also regarding the IP topology: emerging optical technologies allow to flexibly reconfigure the network. This paper studies the potential gains of these reconfiguration flexibilities. The idea is to make CDN-ISP infrastructure demand-aware, that is, to re-optimize it towards the changing end-user demands over time. We present an optimization framework and conduct an extensive evaluation using data from a large European ISP. We find that such a reconfigurable infrastructure has indeed a high potential: by leveraging spatial and diurnal traffic patterns, the efficiency of ISP networks and CDNs is improved significantly. Specifically, the required backbone capacity is reduced by 15% while reducing path lengths by 30%, on average and during the critical peak hour. Moreover, such infrastructures can leverage re-optimizations during specific events, like the COVID-19 pandemic, and under link failures. We optimistically assume a cooperative environment of ISPs and CDNs, and we conclude by discussing trends that foster the identified benefits in practice.

SDN Security Review: Threat Taxonomy, Implications, and Open Challenges

Software-Defined networking (SDN) is a networking paradigm to enable dynamic, flexible, and programmatically efficient configuration of networks to revolutionize network control and management via separation of the control plane and data plane. The SDN technology has evolved in response to the demands from large data centers toward all types of networks, from IoT, enterprise, to ISP networks. On the one hand, SDN has provided solutions for high-demand resources, managing unpredictable data traffic patterns, and rapid network reconfiguration. It is further used to enhance network virtualization and security. On the other hand, SDN is still subject to many traditional network security threats. It also introduces new security vulnerabilities, primarily due to its logically centralized control plane infrastructure and functions. In this paper, we conduct a comprehensive survey on the core functionality of SDN from the perspective of secure communication infrastructure at different scales. A specific focus is put forward to address the challenges in securing SDN-based communications, with efforts taken up to address them. We further categorize the appropriate solutions for specific threats at each layer of SDN infrastructures. Lastly, security implications and future research trends are highlighted to provide insights for future research.

Bootstrapped LARAC algorithm for fast delay‐sensitive QoS provisioning in SDN networks

SummaryIn today's networks, QoS provisioning becomes a major concern for service providers due to the massive increase in connected devices (e.g., mobile devices, servers, and Things), traffic in between, and the diverse service requirements (e.g., delay and bandwidth). Software‐Defined Networking (SDN) promises solution for such issues with its central network control flexibility compared to traditional networking; nonetheless, a design of a fast and QoS guaranteeing routing algorithm is still needed. Delay Constrained Least Cost (DCLC) is a well‐known NP‐hard problem. LAgrange Relaxation‐based Aggregated Cost (LARAC) algorithm is a Dijkstra‐based QoS‐aware algorithm and one of many heuristic algorithms proposed in the literature to solve the DCLC problem. Despite its outstanding performance over other algorithms in SDN, it still needs improvement. In this article, we present a modified version of LARAC, called MODLARAC, to improve the solution feasibility search state by exploiting LARAC's lower‐bound paths before the approximation process start. Also, we modify its stop condition to avoid extra non‐useful Dijkstra calls. We implement and evaluate MODLARAC using a realistic ISP network topology using Mininet and controlled by Floodlight SDN controller. We then compare MODLARAC against the original LARAC and BiLAD algorithms. The obtained results showed improvement up to 20% reduction in Dijkstra calls count compared to original LARAC and BiLAD algorithms without a significant increase in path's cost or delay metrics. It reached only 3% increase in path cost and 7% in path delay in its worst case with a safe distance of 11% lower than the delay demand.

A Look Behind the Curtain: Traffic Classification in an Increasingly Encrypted Web

Traffic classification is essential in network management for operations ranging from capacity planning, performance monitoring, volumetry, and resource provisioning, to anomaly detection and security. Recently, it has become increasingly challenging with the widespread adoption of encryption in the Internet, e.g., as a de-facto in HTTP/2 and QUIC protocols. In the current state of encrypted traffic classification using Deep Learning (DL), we identify fundamental issues in the way it is typically approached. For instance, although complex DL models with millions of parameters are being used, these models implement a relatively simple logic based on certain header fields of the TLS handshake, limiting model robustness to future versions of encrypted protocols. Furthermore, encrypted traffic is often treated as any other raw input for DL, while crucial domain-specific considerations exist that are commonly ignored. In this paper, we design a novel feature engineering approach that generalizes well for encrypted web protocols, and develop a neural network architecture based on Stacked Long Short-Term Memory (LSTM) layers and Convolutional Neural Networks (CNN) that works very well with our feature design. We evaluate our approach on a real-world traffic dataset from a major ISP and Mobile Network Operator. We achieve an accuracy of 95% in service classification with less raw traffic and smaller number of parameters, out-performing a state-of-the-art method by nearly 50% fewer false classifications. We show that our DL model generalizes for different classification objectives and encrypted web protocols. We also evaluate our approach on a public QUIC dataset with finer and application-level granularity in labeling, achieving an overall accuracy of 99%.

α-MON: Traffic Anonymizer for Passive Monitoring

Packet measurements at scale are essential for several applications, such as cyber-security, accounting and troubleshooting. They, however, threaten users’ privacy by exposing sensitive information. Anonymization has been the answer to this challenge, i.e., replacing sensitive information with obfuscated copies. Anonymization of packet traces, however, comes with some challenges and drawbacks. First, it reduces the value of data. Second, it requires to consider diverse protocols because information may leak from many non-encrypted fields. Third, it must be performed at high speeds directly at the monitor, to prevent private data from leaking, calling for real-time solutions. We present <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> -MON, a flexible tool for privacy-preserving packet monitoring. It replicates input packet streams to different consumers while anonymizing protocol fields according to flexible policies that cover all protocol layers. Beside classic anonymization mechanisms such as IP address obfuscation, <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> -MON supports <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">${z}$ </tex-math></inline-formula> -anonymization, a novel solution to obfuscate rare values that can be uniquely traced back to limited sets of users. Differently from classic anonymization approaches, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">z-anonymity</i> works on a streaming fashion, with zero delay, operating at high-speed links on a packet-by-packet basis. We quantify the impact of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">z-anonymity</i> on traffic measurements, finding that it introduces minimal error when it comes to finding heavy-hitter services. We evaluate <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> -MON performance using packet traces collected from an ISP network and show that it achieves a sustainable rate of 40 Gbit/s on a Commercial Off-the Shelf server. <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\alpha $ </tex-math></inline-formula> -MON is available to the community as an open-source project.

DeMSF: a Method for Detecting Malicious Server Flocks for Same Campaign

Nowadays, cybercriminals tend to leverage dynamic malicious infrastructures with multiple servers to conduct attacks, such as malware distribution and control. Compared with a single server, employing multiple servers allows crimes to be more efficient and stealthy. As the necessary role infrastructures play, many approaches have been proposed to detect malicious servers. However, many existing methods typically target only on the individual server and therefore fail to reveal inter-server connections of an attack campaign.In this paper, we propose a complementary system, deMSF, to identify server flocks, which are formed by infrastructures involved in the same malicious campaign. Our solution first acquires server flocks by mining relations of servers from both spatial and temporal dimensions. Further we extract the semantic vectors of servers based on word2vec and build a textCNN-based flocks classifier to recognize malicious flocks. We evaluate deMSF with real-world traffic collected from an ISP network. The result shows that it has a high precision of 99% with 90% recall.

An anomaly based distributed detection system for DDoS attacks in Tier-2 ISP networks

In the present computer era, the vulnerabilities inherent in the Internet architecture enable various kinds of attacks. Distributed Denial of Service (DDoS) is one of such prominent attack that is a lethal threat to Internet domain that harnesses its computing and communication resources. The increase in network traffic rates of legitimate traffic and its flow similarity with attack traffic has made the DDoS detection very difficult despite deployment of diversified defense solutions. The ISPs are bound to invest heavily to counter such problems which has a significant impact on company finances. To provide uninterrupted quality services to the end users, ISPs needs to deploy a distributed solution for timely detection and discrimination of attack and behaviorally similar flash events (FE) traffic. Such distributed defense systems can be deployed at source-end, intermediate network-end or at the victim-end location. Since the volume of traffic to be analyzed is very large, the detection accuracy and low computational complexity of the proposed defense solution is always a challenging problem. This paper proposes an ISP level distributed, collaborative and automated (D-CAD) defense system for detecting DDoS attacks and FEs, and has the capability to effectively distinguishing the two. Additionally, D-CAD defense system is also capable of categorizing FE traffic and has low computational complexity. The proposed system is validated in novel software defined networks (SDN) using Mininet emulator. The results show that D-CAD defense system outperformed its existing counterparts on various detection system evaluation metrics.