Large-scale IP Research Articles

High Capacity and Resilient Large-Scale Deterministic IP Networks

High Capacity and Resilient Large-Scale Deterministic IP Networks

Large-Scale IP Usage Identification via Deep Ensemble Learning (Student Abstract)

Understanding users' behavior via IP addresses is essential towards numerous practical IP-based applications such as online content delivery, fraud prevention, and many others. Among which profiling IP address has been extensively studied, such as IP geolocation and anomaly detection. However, less is known about the scenario of an IP address, e.g., dedicated enterprise network or home broadband. In this work, we initiate the first attempt to address a large-scale IP scenario prediction problem. Specifically, we collect IP scenario data from four regions and propose a novel deep ensemble learning-based model to learn IP assignment rules and complex feature interactions. Extensive experiments support that our method can make accurate IP scenario identification and generalize from data in one region to another.

A Threat Intelligence Analysis Method Based on Feature Weighting and BERT-BiGRU for Industrial Internet of Things

The combination of 5G technology and the industrial Internet of things (IIoT) makes it possible to realize the interconnection of all things. Still, it also increases the risk of attacks such as large-scale DDoS attacks and IP spoofing attacks. Threat intelligence is a collection of information causing potential and nonpotential harm to the industrial Internet. Extracting network security entities and their relationships from threat intelligence text and constructing structured threat intelligence information are particularly important for IIoT security protection. However, threat intelligence is mostly text reports, which means the value information needs to be extracted manually by security analysts, and it is highly dependent on personnel experience. Therefore, this study proposes an IIoT threat intelligence analysis method based on feature weighting and BERT-BiGRU. In this method, BERT-BiGRU is used to classify attack behavior and attack strategy. Then, the attack behavior is weighted to make the classified result more accurate according to the relationship between attack strategy and attack behavior in ATT&CK for ICS knowledge. Finally, the possibility of attack and the harm degree of attack are calculated to form the threat value of the attack. The security analysts can judge the emergency response sequence by the threat value to improve the accuracy and efficiency of emergency response. The results indicate that the proposed method in this study is more accurate than the other standard methods and is more suitable for the unstructured threat intelligence analysis of IIoT.

Community detection based on similarities of communication behavior in IP networks

Communities are an important feature of real-world networks that can reveal the structure and dynamic characteristics of networks. Accordingly, the accurate detection and analysis of the community structure in large-scale IP networks is highly beneficial for their optimization and security management. This paper addresses this issue by proposing a novel community detection method based on the similarity of communication behavior between IP nodes, which is determined by analyzing the communication relationships and frequency of interactions between the nodes in the network. On this basis, the nodes are iteratively added to the community with the highest similarity to form the final community division result. The results of experiments involving both complex public network datasets and real-world IP network datasets demonstrate that the proposed method provides superior community detection performance compared to that of four existing state-of-the-art community detection methods in terms of modularity and normalized mutual information indicators.

Joint routing and scheduling for large-scale deterministic IP networks

With the advent of 5G and the evolution of Internet protocols, industrial applications are moving from vertical solutions to general purpose IP-based infrastructures that need to meet deterministic Quality of Service (QoS) requirements. The IETF DetNet working group aims at providing an answer to this need with support for (i) deterministic worst-case latency and jitter, and (ii) zero packet loss for time-sensitive traffic.In this paper we focus on the joint routing and scheduling problem in large-scale deterministic networks using Cycle Specified Queuing and Forwarding (CSQF), an extension of Cyclic Queuing and Forwarding (CQF) with multiple transmission queues and support of segment routing. In this context, we present two centralized algorithms to maximize traffic acceptance for network planning and online flow admission. We propose an effective solution based on column generation and dynamic programming. Thanks to the reinforcement of the model with valid inequalities, we improve the upper bound and the solution. We demonstrate on realistic instances that we reach an optimality gap smaller than 10% in a few seconds. Finally, we also derive an ultra-fast adaptive greedy algorithm to solve the problem at the cost of a small extra gap.

Flow aggregation for large-scale SDNs with scattered address space allocation

Software-Defined Networking (SDN) has obtained a lot of attention in the last decade and has played a significant role in the development of next-generation networks (NGN). IP networks can also benefit from the SDN evolution to fulfill the data traffic booming. However, the transition of the traditional networking model to SDN architectures poses scalability issues due to the possible flow entry explosion in SDN switches. The limited size of flow-table of SDN switches is not sufficient to handle thousands upon thousands of flows in a large-scale IP network. On the other hand, the interleaved allocation of non-contiguous IP addresses also leads to inefficient routing aggregation and reduces the feasibility of the serious implementation of SDN severely. Therefore, we propose an aggressive flow aggregation scheme—Destination Address Translation and Source-Port Translation on Demand (DATSPToD), which is based on the modified address and port rewriting. DATSPToD enables the aggregation of flow entries in SDNs by translating the destination addresses of multiple same-destination flows with different-source into one flow entry, thus significantly reducing the volume of flow-table occupancy of core-layer SDN switches, even in freely scattered IP address space environments. Simulation results show that DATSPToD outperforms non-aggregation and both wildcard aggregation schemes for a significant reduction of the flow-table occupancy under varied traffic patterns and topologies, especially in large-scale SDNs such as the Internet during the SDN migration period. Compared to the competed schemes under varied traffic patterns and topologies, the simulation results of the DATSPToD could significantly reduce flow-table occupancies by at least1 13%, and by up to 52%. The table-miss rates could be reduced from 11% to 66%.

Availability of Required Data to Support Criminal Investigations Involving Large-Scale IP Address–Sharing Technologies

The use of large-scale IP address sharing technologies (commonly known as Carrier-Grade NAT and AP) presents a challenge for law enforcement agencies due to the fact that incoming source port information is not routinely logged by Internet-facing servers. The absence of this information means that it’s becoming increasingly difficult for law enforcement agencies to identify suspects in criminal activity online. In this article, the author considers the reasons source port information isn’t routinely logged and proposes some immediate actions that can be taken to help improve the situation.

Traffic matrix prediction and estimation based on deep learning in large-scale IP backbone networks

Network traffic analysis has been one of the most crucial techniques for preserving a large-scale IP backbone network. Despite its importance, large-scale network traffic monitoring techniques suffer from some technical and mercantile issues to obtain precise network traffic data. Though the network traffic estimation method has been the most prevalent technique for acquiring network traffic, it still has a great number of problems that need solving. With the development of the scale of our networks, the level of the ill-posed property of the network traffic estimation problem is more deteriorated. Besides, the statistical features of network traffic have changed greatly in terms of current network architectures and applications. Motivated by that, in this paper, we propose a network traffic prediction and estimation method respectively. We first use a deep learning architecture to explore the dynamic properties of network traffic, and then propose a novel network traffic prediction approach based on a deep belief network. We further propose a network traffic estimation method utilizing the deep belief network via link counts and routing information. We validate the effectiveness of our methodologies by real data sets from the Abilene and GÉANT backbone networks.

Large-scale IP network data analysis for anomalies detection thanks to SVM

An SVM (Support Machine Vector) algorithm has been implemented to sense traffic anomalies through a largescale IP Network. We have applied this algorithm on data provided by the well-known large-scale American IP Network (Abilene Network). The developed SVM algorithm can classify the Network traffic into two cat egories of classes namely: normal; and abnormal. The implementation of this algorithm has been performed on real collected data thanks to Netflow protocol and has yielded satisfactory results with a classification rate going over 96% and a false alarms rate lower than 10%.

A New Decomposition-Based Pricing Technique For Solving Large-Scale Mixed IP with a Computer Technique

In this paper, we develop a new Decomposition-Based Pricing (DBP) procedure to filter the unnecessary decision ingredients from large scale mixed integer programming (MIP) problem, where the variables are in huge number will be abated and the complicacy of restrictions will be straightforward. We then develop a generalized computer technique corresponding to our new DBP method by using the programming language A Mathematical Programming Language (AMPL). A number of examples have been illustrated to demonstrate our method.GANIT J. Bangladesh Math. Soc.Vol. 34 (2014) 5-20

LINKC: A Kind of Large Scale IP Network Link Coverage Optimization Algorithms

LINKC: A Kind of Large Scale IP Network Link Coverage Optimization Algorithms

Hybrid IP/SDN Networking: Open Implementation and Experiment Management Tools

The introduction of SDN in large-scale IP provider networks is still an open issue and different solutions have been suggested so far. In this paper we propose a hybrid approach that allows the coexistence of traditional IP routing with SDN based forwarding within the same provider domain. The solution is called OSHI - Open Source Hybrid IP/SDN networking as we have fully implemented it combining and extending Open Source software. We discuss the OSHI system architecture and the design and implementation of advanced services like Pseudo Wires and Virtual Switches. In addition, we describe a set of Open Source management tools for the emulation of the proposed solution using either the Mininet emulator or distributed physical testbeds. We refer to this suite of tools as Mantoo (Management tools). Mantoo includes an extensible web-based graphical topology designer, which provides different layered network "views" (e.g. from physical links to service relationships among nodes). The suite can validate an input topology, automatically deploy it over a Mininet emulator or a distributed SDN testbed and allows access to emulated nodes by opening consoles in the web GUI. Mantoo provides also tools to evaluate the performance of the deployed nodes.

End-to-End Network Traffic Reconstruction Via Network Tomography Based on Compressive Sensing

Traffic matrices (TM) represent the volumes of end-to-end network traffic between each of the origin---destination pairs. Accurate estimates of TM are used by network operators to perform network management functions and traffic engineering tasks. Despite a large number of methods devoted to the problem of traffic matrix estimation, the inference of end-to-end network traffic is still a main challenge in the large-scale IP backbone network, due to an ill-posed nature of itself. In this paper, we focus on the problem of end-to-end network traffic reconstruction. Based on the network tomography method, we propose a simple method to estimate end-to-end network traffic from the aggregated data. By analyzing, in depth, the properties of the network tomography method, compressive sensing reconstruction algorithms are put forward to overcome the ill-posed nature of the network tomography model. In this case, to satisfy the technical conditions of compressive sensing, we propose a modified network tomography model. Besides, we give a further discussion that the proposed model follows the constraints of compressive sensing. Finally, we validate our method by real data from the Abilene and GEANT backbone networks.

Tomofanout: a novel approach for large-scale IP traffic matrix estimation with excellent accuracy

Traffic matrix (TM) plays an important role in many network engineering and management tasks. However, the accurate TM estimation is still a challenge because the problem is highly under-constrained. In this paper, we propose a considerably accurate approach, termed as Tomofanout, for the estimation of TM in large-scale IP network using the available link load data, routing matrix, and partial direct measurement data of TM. Firstly, we propose an edge link fanout model which defines each edge link’s fanout, i.e., each edge link’s fractions of traffic emitting from that edge link to other edge links. Secondly, benefited from the edge link fanout’s diurnal pattern and stability, we are able to compute the edge link baseline fanout to estimate the TM at the following days by multiplying it by the edge link loads at the corresponding time intervals. In such way, an initial link-to-link TM estimation result is calculated by the edge link fanout model. Further, by making the corresponding transformation to the link-to-link TM, the router-to-router TM estimation result is thus obtained. Thirdly, the solution is then refined by the basic model of the Tomography method to keep consistent with both the edge and the interior link loads for further improvement of accuracy in estimation. In particular, the expectation maximization (EM) iteration of the basic model of Tomography method is used for further refinement. As the iteration is running on, the edge link fanout model solution is gradually approaching to the final estimation result, which is compatible with both the edge and the interior link loads. Fourthly, a general algorithm is proposed for computing the edge link baseline fanout and the estimation of the TM. Finally, the Tomofanout approach is validated by simulation studies using the real data from the Abilene Network. The simulation results demonstrate that Tomofanout achieves extremely high accuracy: its spatial relative error (SRE) is less than one half of Tomogravity’s, while its temporal relative error (TRE) is less than one half of Fanout’s and is only one third of Tomogravity’s.

Feature interview with Antonio Nucci

Dr. Antonio Nucci is the chief technology officer of Narus and is responsible for setting the company's direction with respect to technology and innovation. He oversees the entire technology innovation lifecycle, including incubation, research, and prototyping. He also is responsible for ensuring a smooth transition to engineering for final commercialization. Antonio has published more than 100 technical papers and has been awarded 38 U.S. patents. He authored a book, "Design, Measurement and Management of Large-Scale IP Networks Bridging the Gap Between Theory and Practice", in 2009 on advanced network analytics. In 2007 he was recognized for his vision and contributions with the prestigious Infoworld CTO Top 25 Award. In 2013, Antonio was honored by InfoSecurity Products Guide's 2013 Global Excellence Awards as "CTO of the Year" and Gold winner in the "People Shaping Info Security" category. He served as a technical lead member of the Enduring Security Framework (ESF) initiative sponsored by various U.S. agencies to produce a set of recommendations, policies, and technology pilots to better secure the Internet (Integrated Network Defense). He is also a technical advisor for several venture capital firms. Antonio holds a Ph.D. in computer science, and master's and bachelor's degrees in electrical engineering from Politecnico di Torino, Italy.

Large-Scale IP Network Flow-Level Abnormal Behavior Trends Analysis Using Combined Anomaly Grey Forecasting Algorithm

Network traffic analysis has received academic attention in recent years; nevertheless, few have investigated the case that the network traffic data collected may include missing values and sufficient network traffic data may not be acquired for privacy protection or the limitation of network storage equipment capacity. This paper investigates flow-level abnormal behavior trends prediction in large-scale IP networks by the means of analyzing small samples taken from massive data information. We propose an algorithm called Independent-Components-Analysis-Anomaly-Grey-Forecasting (ICA-AGF) and conduct experiments to evaluate the algorithm with Abilene network Netflow data.

Qos Constraints-Based Energy-Efficient Model for IP Networks

This paper proposes an energy-efficient model to overcome the energy-efficient problem in large-scale IP networks, based on QoS constraints. To characterize network energy consumption, we present a link energy consumption model based on the sleep and speed scaling mechanisms. If there is no traffic on a link, let it sleep, or activate it and divide its energy consumption into base energy consumption and traffic energy consumption. And then according to the link energy consumption model, we can build our energy-efficient model to improve the network energy efficiency. Finally, simulation results show that our model can significantly improve the network energy efficiency.

Optimizing QoS for Voice and Video using DiffServ-MPLS

Abstract: The new emerging QoS architectures are motivated by the desire to improve the overall performance of an IP network. Differentiated Services (Diffserv) define a model for implementing scalable differentiation of QoS in the Internet. Multiprotocol Label Switching (MPLS) is a fast label-based switching technique that offers new QoS capabilities for large scale IP networks. When an MPLS network supports DiffServ, traffic flows can receive class-based network treatment that provides bases for QoS guarantees. The objective of this work is to study the influence of the QoS mechanism via DiffServ-MPLS on network parameters such as jitter, delay and throughput. The comprehensive study showed general improvement in the throughput, jitter and delay particularly of voice and video transmission when using DiffServ-aware MPLS network as compared to pure IP only or MPLS only. Keywords: VOIP, MPLS, Diffserv QoS, OPNET 1. Introduction Various multimedia applications such as video streaming, VOIP and video conference are gaining demand bringing with it a massive congestion to the IP networks. With the emergences of multimedia applications in IP networks, bandwidth consumption has become a critical issue among the Internet community and Internet providers. Also a lot of the recent multimedia applications and services not only have bandwidth requirements, but also require other QoS assurances, like end-to-end delay, jitter or packet loss likelihood. These QoS requirements put new challenges on Internet service providers [1].

An approximation method of origin–destination flow traffic from link load counts

Traffic matrix (TM) is a key input of traffic engineering and network management. However, it is significantly difficult to attain TM directly, and so TM estimation is so far an interesting topic. Though many methods of TM estimation are proposed, TM is generally unavailable in the large-scale IP backbone networks and is difficult to be estimated accurately. This paper proposes a novel method of TM estimation in large-scale IP backbone networks, which is based on the generalized regression neural network (GRNN), called GRNN TM estimation (GRNNTME) method. Firstly, building on top of GRNN, we present a multi-input and multi-output model of large-scale TM estimation. Because of the powerful capability of learning and generalizing of GRNN, the output of our model can sufficiently capture the spatio-temporal correlations of TM. This ensures that the estimation of TM can accurately be attained. And then GRNNTME uses the procedure of data posttreating further to make the output of our model closer to real value. Finally, we use the real data from the Abilene Network to validate GRNNTME. Simulation results show that GRNNTME can perform well the accurate and fast estimation of TM, track its dynamics, and holds the stronger robustness and lower estimation errors.

VoIP Quality Measurement System Using Flow Mediation for Large-Scale IP Networks

We present the development of a VoIP quality of service (QoS) measurement system that enables operators to diagnose a QoS degradation segment. Our system uses a flow-based passive measurement method to fulfill the requirement for QoS measurement in large-scale IP networks. In particular, we adopt an access control list (ACL)-based filtering function that selects traffic to monitor and develop a function for correlating signals and media data records. This correlation function is required to dynamically configure ACL-based filtering for monitoring media streams whose port numbers are determined by a signaling protocol. To improve the scalability of existing measurement systems, we also develop a hardware-based filtering engine on a commercial switch as well as a mediation box that performs QoS calculation based on traffic records exported by the engine in a distributed manner. We demonstrate the feasibility of the measurement system by evaluating a prototype system.