Packet Streams Research Articles

Supervised learning of spatial features with STDP and homeostasis using Spiking Neural Networks on SpiNNaker

Artificial Neural Networks (ANN) have gained significant popularity thanks to their ability to learn using the well-known backpropagation algorithm. Conversely, Spiking Neural Networks (SNNs), despite having broader capabilities than ANNs, have always posed challenges in the training phase. This paper shows a new method to perform supervised learning on SNNs, using Spike Timing Dependent Plasticity (STDP) and homeostasis, aiming at training the network to identify spatial patterns. Spatial patterns refer to spike patterns without a time component, where all spike events occur simultaneously. The method is tested using the SpiNNaker digital architecture. A SNN is trained to recognise one or multiple patterns and performance metrics are extracted to measure the performance of the network. Some considerations are drawn from the results showing that, in the case of a single trained pattern, the network behaves as the ideal detector, with 100% accuracy in detecting the trained pattern. However, as the number of trained patterns on a single network increases, the accuracy of identification is linked to the similarities between these patterns. This method of training an SNN to detect spatial patterns may be applied to pattern recognition in static images or traffic analysis in computer networks, where each network packet represents a spatial pattern. It will be stipulated that the homeostatic factor may enable the network to detect patterns with some degree of similarity, rather than only perfectly matching patterns. The principles outlined in this article serve as the fundamental building blocks for more complex systems that utilise both spatial and temporal patterns by converting specific features of input signals into spikes. One example of such a system is a computer network packet classifier, tasked with real-time identification of packet streams based on features within the packet content.

PrismParser: A Framework for Implementing Efficient P4-Programmable Packet Parsers on FPGA

The increasing complexity of modern networks and their evolving needs demand flexible, high-performance packet processing solutions. The P4 language excels in specifying packet processing in software-defined networks (SDNs). Field-programmable gate arrays (FPGAs) are ideal for P4-based packet parsers due to their reconfigurability and ability to handle data transmitted at high speed. This paper introduces three FPGA-based P4-programmable packet parsing architectural designs that translate P4 specifications into adaptable hardware implementations called base, overlay, and pipeline, each optimized for different packet parsing performance. As modern network infrastructures evolve, the need for multi-tenant environments becomes increasingly critical. Multi-tenancy allows multiple independent users or organizations to share the same physical network resources while maintaining isolation and customized configurations. The rise of 5G and cloud computing has accelerated the demand for network slicing and virtualization technologies, enabling efficient resource allocation and management for multiple tenants. By leveraging P4-programmable packet parsers on FPGAs, our framework addresses these challenges by providing flexible and scalable solutions for multi-tenant network environments. The base parser offers a simple design for essential packet parsing, using minimal resources for high-speed processing. The overlay parser extends the base design for parallel processing, supporting various bus sizes and throughputs. The pipeline parser boosts throughput by segmenting parsing into multiple stages. The efficiency of the proposed approaches is evaluated through detailed resource consumption metrics measured on an Alveo U280 board, demonstrating throughputs of 15.2 Gb/s for the base design, 15.2 Gb/s to 64.42 Gb/s for the overlay design, and up to 282 Gb/s for the pipelined design. These results demonstrate a range of high performances across varying throughput requirements. The proposed approach utilizes a system that ensures low latency and high throughput that yields streaming packet parsers directly from P4 programs, supporting parsing graphs with up to seven transitioning nodes and four connections between nodes. The functionality of the parsers was tested on enterprise networks, a firewall, and a 5G Access Gateway Function graph.

IKern: Advanced Intrusion Detection and Prevention at the Kernel Level Using eBPF

The development of new technologies has significantly enhanced the monitoring and analysis of network traffic. Modern solutions like the Extended Berkeley Packet Filter (eBPF) demonstrate a clear advancement over traditional techniques, allowing for more customized and efficient filtering. These technologies are crucial for influencing system performance as they operate at the lowest layer of the operating system, such as the kernel. Network-based Intrusion Detection/Prevention Systems (IDPS), including Snort, Suricata, and Bro, passively monitor network traffic from terminal access points. However, most IDPS are signature-based and face challenges on large networks, where the drop rate increases due to limitations in capturing and processing packets. High throughput leads to overheads, causing IDPS buffers to drop packets, which can pose serious threats to network security. Typically, IDPS are targeted by volumetric and multi-vector attacks that overload the network beyond the reception and processing capacity of IDPS, resulting in packet loss due to buffer overflows. To address this issue, the proposed solution, iKern, utilizes eBPF and Virtual Network Functions (VNF) to examine and filter packets at the kernel level before forwarding them to user space. Packet stream inspection is performed within the iKern Engine at the kernel level to detect and mitigate volumetric floods and multi-vector attacks. The iKern detection engine, operating within the Linux kernel, is powered by eBPF bytecode injected from user space. This system effectively handles volumetric Distributed Denial of Service (DDoS) attacks. Real-time implementation of this scheme has been tested on a 1Gbps network and shows significant detection and reduction capabilities against volumetric and multi-vector floods.

Assessing the Impact of Media Stream Packet Size Adaptation on Wireless Multimedia Applications

Multimedia applications constitute greater percentage of traffic in wireless networks. Thus, require investigation of factors influencing effective delivering of media contents in the future, which will include not only conventional multimedia broadcast, but also video streaming to users on demand while meeting the expected quality requirements. In this article, analysis of effect of media packet size adaptation on quality performance of multimedia application is presented. Experiments were performed using standard test media sequences. The encoded media streams at different packet sizes were transmitted over wireless channel at different channel conditions. The quality performance of received media streams were measured using Peak to Signal Noise Ratio (PSNR) software tool to assess the impact of media packet adaptation on quality performance of multimedia applications. A comparative quality performance under same poor channel condition, shows that small media packet size of 256 bytes recorded the highest received quality performance of 22.52dB, compared to the quality performance of 21.87dB for 384 bytes, 21.37dB for 512 bytes, 20.68dB bytes for 640 bytes and 19.47dB for 768 byes, respectively. The findings show media packet size and channel conditions have significant impact on the quality performance of wireless multimedia applications.

Nefis: A network coding based flexible device-to-device video streaming scheme

Wireless device-to-device (D2D) communication has empowered efficient and convenient video sharing among neighboring devices. However, the mobility and diversity of user devices, combined with dynamically shifting channel conditions, make these processes susceptible to environmental interference. In this paper, we introduce an adaptive network coding scheme tailored for D2D raw source video streaming in the scalable video coding (SVC) format. Video frames are partitioned into equal-sized fragments and encoded into streaming packets with the addition of certain redundancy. To address the observed deficiency where decoding throughput of coded video frames is generally lower than that of the encoding operation on mobile device platforms, we introduce a parallel decoding algorithm based on LU decomposition. Furthermore, we propose a flexible adjustment mechanism, named Nefis, which dynamically adapts the network coding redundancy and stream resolution based on the statistical model established to predict current network conditions and video streaming quality. Implementation on Android platform demonstrates that Nefis reduce redundancy in bandwidth usage during streaming process and enhance resilience to network dynamics. Experimental results also conclusively demonstrate the feasibility and advantages of network coding technology in D2D streaming applications. Nevertheless, achieving these advantages requires carefully designed encoding and decoding mechanisms.

Stochastic power processing through logic operation of power packets.

This article presents an application of the recently proposed logic operation of power based on power packetization. In a power packet despatching system, the power supply can be considered as a sequence of power pulses, where the occurrence of pulses follows a probability that corresponds to the capacity of the power sources or power lines. In this study, we propose a processing scheme to reshape a stream of power packets from such stochastic sequences to satisfy the load demand. The proposed scheme is realized by extending the concept of stochastic computing to the power domain. We demonstrate the operation of the proposed scheme through experiments and numerical simulations by implementing it as a function of a power packet router, which forms a power packet despatching network. The stochastic framework proposed in this study provides a new design foundation for low-power distribution networks as an embodiment of the close connection between the cyber and physical components.

A One-Pass Clustering Based Sketch Method for Network Monitoring

Network monitoring solutions need to cope with increasing network traffic volumes, as a result, sketch-based monitoring methods have been extensively studied to trade accuracy for memory scalability and storage reduction. However, sketches are sensitive to skewness in network flow distributions due to hash collisions, and need complicated performance optimization to adapt to line-rate packet streams. We provide Jellyfish, an efficient sketch method that performs one-pass clustering over the network stream. One-pass clustering is realized by adapting the monitoring granularity from the whole network flow to fragments called subflows, which not only reduces the ingestion rate but also provides an efficient intermediate representation for the input to the sketch. Jellyfish provides the network-flow level query interface by reconstructing the network-flow level counters by merging subflow records from the same network flow. We provide probabilistic analysis of the expected accuracy of both existing sketch methods and Jellyfish. Real-world trace-driven experiments show that Jellyfish reduces the average estimation errors by up to six orders of magnitude for per-flow queries, by six orders of magnitude for entropy queries, and up to ten times for heavy-hitter queries.

Finding recently persistent flows in high-speed packet streams based on cuckoo filter

In high-speed networks, flow-level traffic measurement is an essential tool to understand how network bandwidth is consumed and support the detection of anomalous traffic. While many prior work focuses on tracking the frequent flows (a.k.a. heavy hitters), in this paper, we put more focus on tracking the persistent flows, which jointly consider the frequency, duration and regularity of the packet arrival events of a flow. Although this more generalized metric called persistence has been defined before, it is still unknown how to use limited memory on data plane to monitor the top-k persistent flows in a recent time interval. In this paper, we propose an algorithm named PFD-DW built upon cuckoo filter (an improved version of hash table with better memory efficiency), to monitor the top-k persistent flows under the time-decaying window. It can be regarded as a variant of cuckoo filter, which transforms each bucket into a bucket-level min-heap. Its advantage is that, when the table is full and a packet of a new flow arrives, it can select the least persistent flow along the cuckoo kicking path as the victim of flow replacement. We deliberately avoid the scanning of the entire table to keep the high time efficiency. Based on real-world network traffic traces, we evaluate the performance of our DAKP-CF, a degraded version of PFD-DW that only considers each flow’s packet arrival frequency. The results show that it outperforms the existing algorithms for the top-k frequent flow identification task. It provides nearly 98% identification accuracy with roughly 50% less memory cost. We also evaluate our PFD-DW algorithm for the more generalized task of identifying the recently persistent flows. It provides 93% identification rate of top-3000 persistent flows using only 576KB memory, while attaining 1.5% persistence estimation error. Its memory cost is reduced by 97% than another proposed solution PFD-SW under sliding time window. We have also developed a prototype of PFD-DW, based on the Fd.io VPP software switch accelerated by Intel DPDK.

A generic sketch for estimating super-spreaders and per-flow cardinality distribution in high-speed data streams

For a high-speed network, it is an important task to process the IP packet stream using limited memory and measure its statistical metrics of interest. While many algorithms have been proposed to estimate the cardinality of a single data stream (i.e., the number of distinct elements), it remains a great challenge when a stream contains numerous sub-streams, called flows. In this paper, we focus on a problem of designing a generic data structure to measure multiple types of per-flow statistics in a high-speed stream, including per-flow cardinality, top-K super-spreading flows with the greatest cardinalities, per-flow cardinality moments and per-flow cardinality distribution. Previous solutions for generic measurement mainly focus on the frequency-related statistics measurement, while this paper makes a step forward to support deduplication, i.e., cardinality-related measuring. To address this new problem, we propose a generic sketch named M2D. The challenge is that the per-flow cardinality distribution is often highly skewed with a small proportion of super-spreaders. To tame the skewness, we adopt the adjustable progressive sampling technique, which samples subsets of flows by an exponentially decreasing probability according to their cardinalities. Based on the sampled super-spreaders, we estimate the moments of per-flow cardinalities with different orders. We finally apply the method of moments to reconstruct the per-flow cardinality distribution with no priori knowledge about its formula. Our experiments show M2D’s high memory efficiency (average savings of 38%) and satisfactory distribution estimation accuracy (2% to 98% improvement) than other algorithms.

Universal and Accurate Sketch for Estimating Heavy Hitters and Moments in Data Streams

In computer networks, traffic measurement is a module in a network probe to measure flow-level statistics from an IP packet stream, which are the basis for network performance monitoring and malicious activity detection. This module extracts the flow IDs from incoming IP packets, classifies packets into flows, and counts the number of packets (or bytes) for each flow. It is a great challenge to measure the per-flow statistics for a high-speed network device, using only the size-limited SRAM on its line cards. Therefore, many algorithms using sublinear memory have been proposed, such as CountMin and CountSketch. However, most of previous algorithms are designed for specific measurement tasks. To obtain multiple types of statistics, people have to deploy multiple sketches, which demands more resources of a network device. It is useful to design a universal sketch that can track not only the top- <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$k$</tex-math> </inline-formula> largest individual flows (called heavy hitters) but also the overall traffic distribution statistics (called moments). Prior work named UnivMon successfully tackled this ambitious quest. However, it incurs large and variable per-packet processing overhead, which may result in a significant throughput bottleneck in high-rate packet stream, given that each packet requires 33 hashes and 32 memory accesses on average and many times of that in the worst case. To address this performance issue, we fundamentally redesign the solution architecture from hierarchical sampling to new progressive sampling and from CountSketch to new GenericCM, which ensure that per-packet overhead is a small constant (5 hashes and 8 memory accesses in the worst case), making it more suitable for online operations, especially for hardware pipeline implementation. This new design also makes effort to reduce memory footprint or equivalently improve measurement accuracy under the same memory. Our experiments show that our solution reduces measurement error by roughly 98.1% for second-order moment and by 91.5% for entropy, when given the same 0.2MB memory as UnivMon.

PEDDA: Practical and Effective Detection of Distributed Attacks on enterprise networks via progressive multi-stage inference

Network attacks on enterprises are distributed in sources and versatile in patterns. However, practical solutions (firewalls) often focus on potential enterprise victims by way of coarse-grained monitoring due to their limited compute resources; thus, ineffective in detecting distributed sources and flows of network attacks. In contrast, fine-grained flow-level detection methods are impractical in handling millions of flows for large enterprises. We present PEDDA, a progressive multi-stage inference method to detect distributed attacks by leveraging dynamic controls of programmable networks. It flexibly applies inference stages, each with an orchestratable granularity, whereby packet streams are either proactively or reactively partitioned and analysed by specialised functions depending on the evolution of attacks. The granularity of each stage/function is dynamically determined by an optimisation framework subject to computing resource constraints. We prototype a proof-of-concept system consisting of three inference stages that monitors active enterprise hosts, detects and isolates those victims under attacks, and differentiates distributed sources and flows from benign ones, respectively. We evaluate the efficacy of our prototype by applying it to real traffic traces from a large enterprise network injected by DDoS attacks from a public dataset.

Effective website fingerprinting attack based on the first packet direction only

Tor is an anonymity protocol that utilizes multi-layers onion encryption to protect the privacy and anonymity of clients during crawling websites. However, Tor is vulnerable to website fingerprinting attacks in that the adversary analyzes the transferred traffic patterns passively and detects visited websites without decryption. The core of fingerprinting attacks depends on flow-based network information such as packet direction information that cannot be concealed using encryption. In the real world, the packet streams observed during a website fetch may be affected by network events like changes in download rate, queuing, retransmission, and packet loss. In this paper, we propose a correlation-based website fingerprinting attack based on only the packet direction information as a set of observations of random variables with an unknown probability distribution. In the proposed attack, instead of the whole of the traffic instances for each website, only the first fraction of transmitted packets are used for fingerprinting. The main focus of the proposed attack is on the preprocessing and classification parts and aims to evaluate the importance of direction information in website detection and mitigate the adverse effects of unpredicted network noises in attack performance. The preprocessing phase preprocesses background noises and unpredicted network events that a real-world adversary may confront. The CorrClassifier model is designed as a prototype of a classifier tailored to the attack conditions to calculate the similarity distance of observed traffic patterns to detect visited websites and reduce the complexity of the attack using a low-dimension correlation method. Preprocessing the noises before feeding them to the classifier helps the accuracy keep up more robustly while the polarity of the target website grows gradually because of the unexpected network conditions. Experiments in a closed-world setting indicate the effectiveness of the proposed method in detecting the targeted websites with 95% accuracy using only the first fraction of direction information.

Randomized Error Removal for Online Spread Estimation in High-Speed Networks

Flow spread measurement provides fundamental statistics that can help network operators better understand flow characteristics and traffic patterns with applications in traffic engineering, cybersecurity and quality of service. Past decades have witnessed tremendous performance improvement for single-flow spread estimation. However, when dealing with numerous flows in a packet stream, it remains a significant challenge to measure per-flow spread accurately while reducing memory footprint. The goal of this paper is to introduce new multi-flow spread estimation designs that incur much smaller processing overhead and query overhead than the state of the art, yet achieves significant accuracy improvement in spread estimation. We formally analyze the performance of these new designs. We implement them in both hardware and software, and use real-world data traces to evaluate their performance in comparison with the state of the art. The experimental results show that our best sketch significantly improves over the best existing work in terms of estimation accuracy, packet processing throughput, and online query throughput.

Detecting Parallel Covert Data Transmission Channels in Video Conferencing Using Machine Learning

Covert communication channels are a concept in which a policy-breaking method is used in order to covertly transmit data from inside an organization to an external or accessible point. VoIP and Video systems are exposed to such attacks on different layers, such as the underlying real-time transport protocol (RTP) which uses Transmission Control Protocol (TCP) or User Datagram Protocol (UDP) packet streams to punch a hole through Network address translation (NAT). This paper presents different innovative attack methods utilizing covert communication and RTP channels to spread malware or to create a data leak channel between different organizations. The demonstrated attacks are based on a UDP punch hole created using Skype peer-to-peer video conferencing communication. The different attack methods were successfully able to transmit a small text file in an undetectable manner by observing the communication channel, and without causing interruption to the audio/video channels or creating a noticeable disturbance to the quality. While these attacks are hard to detect by the eye, we show that applying classical Machine Learning algorithms to detect these covert channels on statistical features sampled from the communication channel is effective for one type of attack.

A Novel Solution for Network Flexibility Problem in Mobile Multi-hop Tunneling Networks

Since the network throughput performance is limited by the available technology limits, there are too many attempts in the literature to improve the throughput performance of the network by modifying the routing algorithms currently in use. Although application of the tunneling on IP networks provides reserved paths for the higher priority packet streams and succeeds in providing faster communication performances, it is also determined in the literature that, the greatest up to date problem of tunneling networks is the flexibility problem, which is defined as the problem of difficulty to have minimal delay and highest throughput when congestions or node failures occur and the throughput decreases due to high traffic loads on the network. sIn this work, a high performance solution, called LB-ACN (Location Based- Avoid Congested Node) is proposed to solve this flexibility problem and to compensate the increased delay which came up due to the high traffic load and also due to inflexible tunneling network structure, considering the locations of the nodes in addition to their traffic loads. And it is shown that, it is succeeded to carry the throughput of the highly traffic loaded network back to 48.6 Mbps from 36.9 Mbps by about 31.7% performance improvement for which we could improve it from 36.9 Mbps up to 45.9 Mbps by 24.3% using the proposed ACN (Avoid Congested Node) algorithm in our previous work. As a result, we have succeeded in having about 7.4% more improvement on throughput performance in comparison with the previously proposed ACN algorithm.

Dual‐channel capsule generation adversarial network based blockchain technology for a secured dynamic optimal routing in mobile ad hoc network

AbstractMobile ad hoc network (MANET) routing is allocated packets to the base station. It preserves the routing buttressing and the efficiency of MANET. None of effective approaches presented so far averting spiteful node occurrences. To overcome this issue, in this article, dual‐channel capsule generation adversarial network (DCCGAN) optimized with arithmetic optimization algorithm is proposed for blockchain based trusted distributed routing scheme in MANET (DCCGAN‐AOA‐BC‐MANET). The proposed approach offers the distributed trust module for routing nodes in MANETs that is proof‐of‐authority through blockchain. Here, the token is engendered for the packet stream admittances with the secret key transmitted to every routing mobile node, also it offers the optimum path for data transmission. The trusted distributed optimum routing information is distributed based upon proposed blockchain based MANET. The proposed approach is simulated utilizing NS‐3 tool. The performance metrics, such as delay performance, average delay, average latency, average energy consume, BC token transactions throughput. The simulation of proposed DCCGAN‐AOA‐BC‐MANET method provides 76.26%, 65.57%, 80.32%, and 42.9% lower transaction latency, 73.06%, 63.82%, 85.56%, and 38.84% lower energy consumption compared to the existing methods.

Technical Comparison between MPTCP and TCP in Heterogeneous Networks

Multipath TCP (MPTCP) is a project that has proposed by IETF group to allow packet streams to be separated across multiple sub-flow paths. MPTCP brings a great benefit in throughput, reliability, and fairness. However, MPTCP can be implemented in a little Linux distribution where it requires compiling and installing to become available for an actual and simulation scenario. In the paper, the performance analysis and evaluation results in both TCP and MPTCP are achieved through PC computer connected to Wi-Fi access point and 3G in heterogeneous networks. The simulation results prove that MPTCP performs better than single-path TCP for heterogeneous networks. All experiments over MPTCP and TCP leads to same results in terms of the throughput in heterogeneous networks. In this paper, four congestion control methods are implemented in the kernel and compared with each other understand the behaviors of those methods. The result of the experiment proves that Linked Increased Algorithm (LIA) has the advantage over the others in light data traffic while Balanced LIA (BLIA) has the advantage the others when there is heavy data traffic

FPGA-based 100G network readout solution for SHINE pixel detector

With the growing demand for X-ray imaging experiments, the area and performance of pixel array detectors continue to improve, and the readout of massive data gradually becomes a thorny problem. In Shanghai HIgh repetition rate XFEL aNd Extreme light facility (SHINE), the data rate of its high frame rate pixel detector is expected to exceed Tbps in the future. Traditional gigabit and ten-gigabit networks can no longer meet the readout requirements and the transmission bandwidth of the readout system has turned into a bottleneck. Combined with the state-of-the-art developments in the network, two FPGA-based 100G readout solutions are developed. The first solution, NET-CONV, can extract the raw data from the network packet and aggregate data streams from multiple 10G links into one 100G link. It supports parallel transmission of up to 12 channels and achieves a peak rate of 94 Gbps in the test. NET-TOE is developed as the second solution, which aims to improve the transmission speed of the Ethernet ports further. It implements a complete network protocol stack at 100 Gbps line rate, supporting maximum transmission unit (MTU) adjustment, TCP window scale, and UDP. The actual measurement indicates that the maximum data transmission rate reaches 97 Gbps.

Network Traffic Shaping for Enhancing Privacy in IoT Systems

Motivated by traffic analysis attacks based on the packet sizes and timing information in the Internet of Things (IoT) networks, we establish a rigorous event-level differential privacy (DP) model on infinite packet streams. We propose a traffic shaper satisfying a first-come-first-served queuing discipline that outputs traffic dependent on the input using a DP mechanism. We show that in special cases the proposed mechanism recovers existing shapers which standardize the output independently from the input. To find the optimal shapers for given levels of privacy and transmission efficiency, we formulate the constrained problem of minimizing the expected delay per packet and propose using the expected queue size across time as a proxy. We further show that the constrained minimization is a convex program. We demonstrate the effect of shapers on both synthetic data and packet traces from actual IoT devices. The experimental results reveal inherent privacy-overhead tradeoffs: more shaping overhead provides better privacy protection. Under the same privacy level, there is a tradeoff between dummy traffic and delay. When shaping heavier or less bursty traffic, all shapers become more overhead-efficient. We also show that increased traffic from more IoT devices makes guaranteeing event-level privacy easier. The DP shaper offers tunable privacy that is invariant with the change in the input traffic distribution and has an advantage in handling burstiness over traffic-independent shapers. This approach accommodates heterogeneous network conditions and user demands in privacy and overhead.

Timely Updates With Priorities: Lexicographic Age Optimality

In this paper, we consider a scheduling problem, in which several streams of status update packets with different priority levels are sent through a shared channel to their destinations. We introduce a notion of <i>lexicographic age optimality</i>, or simply <i>lex-age-optimality</i>, to evaluate the performance of multi-class status update policies. In particular, a lex-age-optimal scheduling policy first minimizes the Age of Information (AoI) metrics for high-priority streams, and then, within the set of optimal policies for high-priority streams, achieves the minimum AoI metrics for low-priority streams. We propose a new scheduling policy named Preemptive Priority, Maximum Age First, Last-Generated, First-Served (PP-MAF-LGFS), and prove that the PP-MAF-LGFS scheduling policy is lex-age-optimal. This result holds (i) for minimizing any time-dependent, symmetric, and non-decreasing age penalty function; (ii) for minimizing any non-decreasing functional of the stochastic process formed by the age penalty function; and (iii) for the cases where different priority classes have distinct arrival traffic patterns, age penalty functions, and age penalty functionals. For example, the PP-MAF-LGFS scheduling policy is lex-age-optimal for minimizing the probability of age violation of a high-priority stream and the time-average age of a low-priority stream. Numerical results are provided to illustrate our theoretical findings.