Large Campus Network Research Articles

MetaVRadar: Measuring Metaverse Virtual Reality Network Activity

The ''metaverse'', wherein users can immerse in virtual worlds through their VR headsets to work, study, play, shop, socialize, and entertain, is fast becoming a reality. However, little is known about the network dynamics of metaverse VR applications, which are needed to make telecommunications network infrastructure ''metaverse ready'' to support superlative user experience. This work is an empirical measurement study of metaverse VR network behavior. By analyzing metaverse sessions on the Oculus VR headset, we first develop a categorization of user activity into distinct states ranging from login home to streetwalking and event attendance to asset trading, characterizing network traffic per state, thereby highlighting the vastly more complex nature of a metaverse session compared to streaming video or gaming. Our second contribution develops a real-time method MetaVRadar to detect metaverse session and classify the user activity state leveraging formalized flow signatures and volumetric attributes. Our third contribution practically implements MetaVRadar in a large university campus network to demonstrate its usability.

QoS Guarantee Framework of English Literature Course Online System Based on Concurrent Optimization Network Environment

First, the initial connection isolation method ICS is established to separate false connections generated by malicious network behaviors from normal established connections, and form a controllable initial connection table. A strategy combining extended RSVP protocol and DiffServ model is designed to ensure the realization of QoS in large campus network. The simulation test results show that the application of this model can effectively improve the QoS of large-scale campus networks, and the problems that need to be paid attention to when running the parallel operation of the database management system correctly in the network environment. Especially to prevent data corruption and loss when developing multi-user systems.

IntStream: Towards Flexible, Expressive, and Scalable Network Telemetry

Due to the complexity of the network structure and the high growth of the transmission speed, the measurement and management of the network are facing serious challenges. The traditional bottom-up network telemetry methods are no longer applicable to complex network scenarios. To bridge this gap, we propose IntStream, a flexible, expressive and scalable network telemetry framework to allow network operators to measure and analyze network through passive stream processing and active probing. However, there are three key challenges to building an intent-based telemetry system: (1) The diversity of network data sources. (2) The complexity of the measurement tasks. (3) The low overhead requirements of the telemetry system. IntStream introduces a lightweight component to extract and parse data from various data sources and divides the data stream processing into local and global stages. IntStream provides a set of rich expressive primitives to support operators to write telemetry tasks based on intent. By performing part of the telemetry task on the local stage, the transmission overhead of intermediate data can be effectively reduced. The evaluation results conducted on a large campus network show that IntStream can support a wide range of telemetry tasks while reducing the intermediate data transmission overhead by 99.31% on average.

IPoE based campus network IPv4/IPv6 dual-stack admission control design and implementation

With the expansion of the campus network, various security risks have appeared. Most campus networks have implemented AAA, but seldom implemented admission control, which decreases the efficiency of dynamic allocation of IP addresses and makes it possible for users to avoid traffic billing. In order to realize the admission control of IPv4/IPv6 dual-stack network in large-scale campus network, we design and implement IPoE-based dual-stack admission control for the campus network in Tsinghua University. In IPoE, users can obtain IP address by DHCP with Ethernet physical link access. Authentication is achieved through a variety of user authentication methods. IP packets are encapsulated in Ethernet and pass through the access network to BRAS devices. BRAS devices find the user's address assignment information based on the client hardware address and the current Vlan ID after receiving the client's DHCP confirmation request message. Our main contributions include: for the various application scenarios under unified IPv4/IPv6 network, session-level IPoE technology is proposed; with the application of different configuration template in different protocol stack, various account control policy is submitted to AAA servers to achieve multi-type, multi-scenario requirements; to deal with the risk in large scale campus network, BRAS, AAA server, DHCP server can cooperate to realize that only authorized users are permitted to obtain addresses, thus avoid the security threats from unauthorized users; to cope with the high load pressure under large-scale deployment, the whitelist of webportal configured on the BRAS side reduces the load on webportal servers. The actual deployment shows that the dual-stack access authentication system has achieved the design objectives and runs smoothly.

Discovering Suspicious APT Behaviors by Analyzing DNS Activities.

As sensors become more prevalent in our lives, security issues have become a major concern. In the Advanced Persistent Threat (APT) attack, the sensor has also become an important role as a transmission medium. As a relatively weak link in the network transmission process, sensor networks often become the target of attackers. Due to the characteristics of low traffic, long attack time, diverse attack methods, and real-time evolution, existing detection methods have not been able to detect them comprehensively. Current research suggests that a suspicious domain name can be obtained by analyzing the domain name resolution (DNS) request to the target network in an APT attack. In past work based on DNS log analyses, most of the work would simply calculate the characteristics of the request message or the characteristics of the response message or the feature set of the request message plus the response message, and the relationship between the response message and the request message was not considered. This may leave out the detection of some APT attacks in which the DNS resolution process is incomplete. This paper proposes a new feature that represents the relationship between a DNS request and the response message, based on a deep learning method used to analyze the DNS request records. The algorithm performs threat assessment on the DNS behavior to be detected based on the calculated suspicious value. This paper uses the data of 4, 907, 147, 146 DNS request records (376, 605, 606 records after DNS Data Pre-processing) collected in a large campus network and uses simulation attack data to verify the validity and correctness of the system. The results of the experiments show that our method achieves an average accuracy of 97.6% in detecting suspicious DNS behavior, with the orange false positive (FP) at 2.3% and the recall at 96.8%. The proposed system can effectively detect the hidden and suspicious DNS behavior in APT.

Scheduling Dynamic Multicast Requests in Advance Reservation Environment for Enterprise Video Conferencing Systems

In an enterprise video conferencing system, the enterprise network can be shared by hundreds of video conferences. On the other hand, participants may not arrive at the same time and stay until the end of the conference. The abilities to reserve resources in advance, as well as effective dynamic multicast when participants can join and leave the conference at any time, are essential in the distributed multi-party video conferencing systems. However, the effective advance reservation strategies of the dynamic multicast requests for a heavy traffic case still remains open. In this paper, we investigate the problem of Maximizing the number of admitted Dynamic Multicast requests in the Advance Reservation environment (MDMAR) for the enterprise video conferencing system. We take two path schemes of a fixed path and variable paths, as well as a heterogeneous bandwidth reservation model into account. Firstly, we prove that the MDMAR problem is NP-complete and formulate it mathematically as an integer linear program (ILP) for small networks. Then, we develop greedy algorithms and simulated annealing (SA) algorithms for enterprise networks. Comparative simulations are performed to evaluate the heuristic algorithms for both small networks and enterprise networks. We find that the SA algorithms can provide within 6% lower optimal solutions than the ILP algorithms for our small network, and up to 10% improvement over the greedy algorithms for the large campus or enterprise network.

Deriving and measuring DNS-based fingerprints

In this paper, we study a new privacy risk, namely DNS-based Fingerprints, introduced by passively collected DNS traffic. We intend to derive behavioral fingerprints from DNS traces, where each behavioral fingerprint targets at uniquely identifying its corresponding user and being immune to the change of time. The derived fingerprints have strong privacy implications such as de-anonymizing the DNS traces and tracking users’ locations across different networks. We have proposed a set of new patterns, which collectively form behavioral fingerprints by characterizing a user’s DNS activities through three different perspectives including the domain name, the inter-domain relationship, and domains’ temporal behavior. We have performed extensive evaluation based on a large volume of DNS queries collected from a large campus network across three weeks. The experimental results have demonstrated that the proposed DNS-based fingerprints can accomplish high accuracy on revealing network users’ presence in a new DNS stream based on their fingerprint patterns derived from a historical DNS stream. We also experimentally explored the correlation between users’ general network activities and their DNS-based fingerprints.

An Integrated Systematic Approach to Designing Enterprise Access Control

Today, the network design process remains ad hoc and largely complexity agnostic, often resulting in suboptimal networks characterized by excessive amounts of dependence and commands in device configurations. The unnecessary high configuration complexity can lead to a huge increase in both the amount of manual intervention required for managing the network and the likelihood of configuration errors, and thus must be avoided. In this paper, we present an integrated top–down design approach and show how it can minimize the unnecessary configuration complexity in realizing reachability-based access control, a key network design objective that involves designing three distinct network elements: virtual local-area network (VLAN), IP address, and packet filter. Capitalizing on newly developed abstractions, our approach integrates the design of these three elements into a unified framework by systematically modeling how the design of one element may impact the complexity of other elements. Our approach goes substantially beyond the current divide-and-conquer approach that designs each element in complete isolation, and enables minimizing the combined complexity of all elements. Specifically, two new optimization problems are formulated, and novel algorithms and heuristics are developed to solve the formulated problems. Evaluation on a large campus network shows that our approach can effectively reduce the packet filter complexity and VLAN trunking complexity by more than 85% and 70%, respectively, when compared with the ad hoc approach currently used by the operators.

Visualizing and characterizing DNS lookup behaviors via log-mining

The Domain Name System (DNS) is a critical Internet service, which translates easily memorized domain names to numerical IP addresses for locating computer resources and services. In this paper, we try to explore the behaviors of DNS lookup by mining DNS logs from three primary DNS servers in a large university campus network in China. Our dataset is made up of two parts, namely DNS query logs and messages received or send by DNS servers. Firstly, through analyzing these DNS query logs, we are able to understand the overall trend of users’ surfing. For dealing with huge DNS dataset, we introduce an algorithm we call DNSReduce, which can be used to dig out top 10 client IP addresses and top 10 destination domain names efficiently. Moreover, we make comparative analysis of lookup behavior between wired and wireless users. Secondly, with messages received or send by DNS servers we can find these DNS servers׳behaviors, i.e., TTLs, equivalent answers and are able to accurately identify domain names with dynamic IP addresses. We provide different and specific visualization techniques for presenting these analysis results and show these techniques are very useful for understanding user behaviors, analyzing security events and characterizing overall tendency in campus network management.

Review on Botnet Threat Detection in P2P

Botnets are nothing but the malicious codes such as viruses which are used for attacking the computers. These are act as threats and are very harmful. Due to distributed nature of botnets, it is hard to detect them in peer-to-peer networks. So we require the smarter technique to detect such threats. The automatic detection of botnet traffic is of high importance for service providers and large campus network monitoring. This paper gives the review on the various techniques used to detect such botnets. Keywords— Botnets, detection, peer-to-peer. __________________________________________________*****_________________________________________________

Study of Network Access Control System Featuring Collaboratively Interacting Network Security Components

Draw lessons from Cisco network access control thought, proposed one kind based on the 802.1x protocol of a network component security interaction type network access control system design and implementation, and to the large campus network application background and describes in detail the development and deployment of technology of the system, including identity authentication, billing, network access control, information statistics safety linkage, form a variety of different network components linkage collaboration, the traditional first connection security evaluation network access mode changes for the first safety assessment after connection, significantly improve the security of network.

Characterizing the file hosting ecosystem: A view from the edge

We present a comprehensive, longitudinal characterization study of the file hosting ecosystem using HTTP traces collected from a large campus network over a one-year period. We performed detailed multi-level analysis of the usage behavior, infrastructure properties, content characteristics, and user-perceived performance of the top five services in terms of traffic volume, namely RapidShare, Megaupload, zSHARE, MediaFire, and Hotfile. We carefully devised methods to identify user clickstreams in the HTTP traces, including the identification of free and premium user instances, as well as the identification of content that is split into multiple pieces and downloaded using multiple transactions. Throughout this characterization, we compare and contrast these services with each other as well as with peer-to-peer file sharing and other media sharing services.

A study of traffic, user behavior and pricing policies in a large campus network

Tsinghua University campus network is a large campus network in China, providing volume-based and flat-rate Internet access service for more than 31,000 students and staff. In order to better understand its traffic, user behavior and pricing policies to facilitate network planning and management, we collect a one-year-long flow-based traffic log and a 10-year-long user-based log at the boundary of this campus network, and then conduct an analysis study on these two data sets. In this paper, we first present characteristics of inbound traffic flows from the aspects of traffic prediction and inference. Then we analyze the geographical origins of incoming flows, and the result reveals that USA, Japan and Korea are the most important source countries of international traffic. Our user-based investigation shows that the properties of users have important influence on their behavior, e. g., major has stronger influence on users’ online time, while occupation has stronger influence on users’ international traffic volume. We also find that there are more and more users choosing flat rate pricing scheme instead of volume based pricing scheme, and these users tend to over-provision when they subscribe from tiered pricing options.

An empirical study of behavioral characteristics of spammers: Findings and implications

In this paper we present a detailed study of the behavioral characteristics of spammers based on a two-month email trace collected at a large US university campus network. We analyze the behavioral characteristics of spammers that are critical to spam control, including the distributions of message senders, spam and non-spam messages by spam ratios; the statistics of spam messages from different spammers; the spam arrival patterns across the IP address space; and the active duration of spammers, among others. In addition, we also formally confirm an informal observation that spammers may hijack network prefixes in sending spam messages, by correlating the arrivals of spam messages with the BGP route updates of the corresponding networks. In this paper we present the detailed results of the measurement study; in addition, we also discuss the implications of the findings for the (content-independent) anti-spam efforts.

Characteristics of YouTube network traffic at a campus network – Measurements, models, and implications

User-Generated Content has become very popular since new web services such as YouTube allow for the distribution of user-produced media content. YouTube-like services are different from existing traditional VoD services in that the service provider has only limited control over the creation of new content. We analyze how content distribution in YouTube is realized and then conduct a measurement study of YouTube traffic in a large university campus network. Based on these measurements, we analyzed the duration and the data rate of streaming sessions, the popularity of videos, and access patterns for video clips from the clients in the campus network. The analysis of the traffic shows that trace statistics are relatively stable over short-term periods while long-term trends can be observed. We demonstrate how synthetic traces can be generated from the measured traces and show how these synthetic traces can be used as inputs to trace-driven simulations. We also analyze the benefits of alternative distribution infrastructures to improve the performance of a YouTube-like VoD service. The results of these simulations show that P2P-based distribution and proxy caching can reduce network traffic significantly and allow for faster access to video clips.

An analysis of TCP reset behaviour on the internet

This paper presents a one-year study of Internet packet traffic from a large campus network, showing that 15-25% of TCP connections have at least one TCP RST (reset). Similar results have also been observed from measurements of other Internet links. The results in this paper show that reset connections arise from local events such as network outages, attacks, or reconfigurations, as well as from global trends in TCP usage. In particular, we identify application-level Web behaviour as the primary contributor to the global trend in reset TCP connections. The most prevalent anomaly is the absence of the normal connection termination handshake. Instead, connections are often reset by the client. We believe that particular implementations of HTTP/TCP connection management cause this global trend.