Packet Streams Research Articles

System performance evaluation by combining RTC and VHDL simulation: A case study on NICs

• We combine Real-Time Calculus (RTC) and VHDL simulation for performance evaluation. • We predict analytically NIC’s buffer-size requirements in a network node. • We identify FIFO overflow scenarios by analytic methods. • We present a compositional model of the network-to-memory data path using RTC. • We provide real-time guarantees that are valid up to a certain level of confidence. Analytic models allow the performance evaluation of proposed system changes without requiring complex and expensive detailed simulations. In this paper, Real-Time Calculus (RTC), a high-level analysis technique previously proposed for stream-processing hard real-time systems and frequently used to evaluate trade-offs in packet stream processing architectures, has been applied to analyse the behaviour of network interfaces. Moreover, the simulation of HDL (Hardware Description Language) models has been used to build the RTC descriptions required to analyse the behaviour of these relatively complex systems. As a case study of this proposed combination of Real-Time Calculus and HDL simulation, the prediction of buffer-size requirements and bottlenecks on the Network Interface Card (NIC) of a node receiving Ethernet packets, is also provided. This work intends to increase the efficiency of the performance evaluation of systems by providing real-time guarantees on delays and backlogs that are valid up to a certain level of confidence, as opposed to the hard guarantees commonly derived by formal methods.

Runtime connection-oriented guaranteed-bandwidth network-on-chip with extra multicast communication service

This paper presents a flexible runtime connection-oriented guaranteed-bandwidth Network on Chip (NoC). Comparing with a standard time-division multiplexing (TDM) method, our local ID-based method provides better flexibility to establish dynamic runtime connections. A specific pre-designed algorithm for finding a conflict-free scheduling, as commonly used in the TDM-based method, is not needed. The contention problem is solved with the hardware solution based on the locally organized message identity (ID), in which flits belonging to the same stream packet will have the same unique/local identity-tag (ID-tag) on each communication link. The ID-tags of each stream will vary locally over communication links and are updated. The updating is organized by ID-tag mapping management units. The routing is organized using runtime programmable routing reservation table. In addition, the proposed methodology supports also a deadlock-free multicast routing service.

Study on a Self-Adapt Streaming Media Data Transmission Package Based on RTCP

This paper analyzes the transmission loss of streaming media and presents a adaptive algorithm which can Intelligently adjust itself to the size of the network packet stream when network resources are adequate for the situation,. The algorithm calculates the best data packet based on RTCP protocol by controlling the change of the server-side data packet size to dynamically adjust the sending rate, so that it can achieve the best multimedia data streams transmission in a limited time and under limited network resources to improve QoS of stream media of network.

Modeling of Router-based Request Redirection for Content Distribution Network

The increase of digital data between content’s servers and clients in a network causes congestion problems when downloading big web contents including files, streaming media, etc. The problem becomes pronounced when a narrow bandwidth or unexpected termination of streaming services is appeared. Content Delivery Network (CDN) is introduced to overcome such problems by redirect client’s request to the best server which proximal and least loaded. However, with intensity increase of people accessing a particular content, the performance of CDN is reduced and sometimes congested. We propose an architecture to solve such problems with a new method to redirect client’s request through a special router called Service-oriented Router (SoR). In this paper, several analytical studies and experiments have been conducted and the result show that router-based redirection is more effective than DNS-based redirection that is currently being used. SoR has been introduces as a content-based router and has capability to do deep packet inspection (DPI) into the packet streams and analyze them. We use SoR in our proposed method as a CDN’s core-router to redirect client’s request to the best server. Our experiment conducted with model and numerical analytic supported by optimal redirection probability based on delay between router and server. The experiment result confirmed that the router-based redirection reduced the response time by 23.3% compared to the DNSbased redirection.

Adaptive Statistical Signatures of Network Soft-Failures in User Devices

Efficient fault detection and characterization are crucial requirements for automated network diagnosis systems. In this paper, we present normalized statistical signatures (NSSs), a network ‘softfailure’ characterization technique for user devices (UDs) based upon exhaustive sets of aggregated statistical features extracted from transmission control protocol (TCP) packet streams. TCP streams are collected on-demand (e.g. upon user complaint) with fixed data transfer limits to capture the artifacts resulting from UD faults. NSSs created using live network and testbed data are able to uniquely characterize many faults and offer insight into how various types of features are affected by the faults and networks. We then introduce the link adaptive signature estimation (LASE) technique to reduce the quantities of collected NSSs required for generalized diagnostic systems with variable link parameters. We create feature estimator functions using multivariate regression techniques to generate artificial NSSs, which are subsequently used to train machine learning systems that have robust generalization capabilities. Performance of a prototype fault classifier system based on NSSs shows that an overall detection accuracy of 98% can be achieved for eight types of faults in a live network environment. In this paper, we specifically focus on formulating the basic framework of NSS and LASE, and limit the analysis to wired networks. This work can later be extended to encompass more complex fixed and mobile wireless networking environments. We expect that the combination of NSSs and LASE can serve as the foundation of next-generation automated network diagnosis systems.

Asynchronous Source Clock Frequency Recovery through Aperiodic Packet Streams

We consider the most general case of source clock frequency recovery (SCFR) in packet networks, i.e., asynchronous SCFR through aperiodic packet streams, where there is neither a common reference clock nor any relation between packet generation intervals and a source clock frequency. We formulate the problem of asynchronous SCFR with timestamps as a linear case of regression through the origin (RTO) and propose two schemes, one based on recursive least squares (RLS) method and the other based on simple heuristics of cumulative ratio of interarrival and interdeparture times, which provide better estimates of the source clock frequency with faster convergence than conventional phase-locked loop (PLL)-based schemes.

Implementation of RED Algorithm to Detect Malicious Packet Losses

We consider the problem of detecting whether a compromised router is maliciously manipulating its stream of packets. In particular, we are concerned with a simple yet effective attack in which a router selectively drops packets destined for some victim. Unfortunately, it is quite challenging to attribute a missing packet to a malicious action because normal network congestion can produce the same effect. Modern networks routinely drop packets when the load temporarily exceeds their buffering capacities. Previous detection protocols have tried to address this problem with a user -defined threshold: too many dropped packets imply malicious intent. However, this heuristic is fundamentally unsound; setting this threshold is, at best, an art and will certainly create unnecessary false positives or mask highly focused attacks. We have designed, developed, and implemented a compromised router detection protocol that dynamically infers, based on measured traffic rates and buffer sizes, the number of congestive packet losses that will occur. Once the ambiguity from congestion is removed, subsequent packet losses can be attributed to malicious actions.

Technologies, Methodologies and Challenges in Network Intrusion Detection and Prevention Systems

This paper presents an overview of the technologies and the methodologies used in Network Intrusion Detection and Prevention Systems (NIDPS). Intrusion Detection and Prevention System (IDPS) technologies are differentiated by types of events that IDPSs can recognize, by types of devices that IDPSs monitor and by activity. NIDPSs monitor and analyze the streams of network packets in order to detect security incidents. The main methodology used by NIDPSs is protocol analysis. Protocol analysis requires good knowledge of the theory of the main protocols, their definition, how each protocol works.Keywords: Intrusion Detection and Prevention System, Protocol Analysis, Sensor, Signature, State(ProQuest: ... denotes formulae omitted.)1 IntroductionIncreasing size and complexity of the Internet and Intranet networks have led to increasing number of vulnerabilities that could be exploited. Thus, the internal and external attacks on the information systems are increasing at an alarming rate. Also, these are becoming more severe and sophisticated. The attackers find ingenious ways to bypass the security controls and to compromise the security and the well functioning of the information systems. They are motivated by financial, political, and military objectives. In this context, defending wide area networks from malicious traffic, unauthorized access to systems involves many problems.In security information systems Network Intrusion Detection and Prevention Systems (NIDPS) are important tools to detect possible incidents and also, to attempt to stop them in real time. Due to changing attacks, intrusion detection methodologies and technologies continuously evolve, adding new detection capabilities, to avoid detection. They must adapt to new forms of malware, to the public networks, increased traffic.2 Concepts of Intrusion DetectionAn intrusion is a successful action to gain access to an information system, to compromise it or to make it unavailable. This is possible due to the presence of vulnerability in the target system that can be exploited by a motivated intruder.Intrusion Detection and Prevention is the process of monitoring the information systems by sensors or agents and analyzing the collected information to detect and to attempt to stop the attacks in real time, identifying vulnerabilities, the violation of security policies or standard security practices.An Intrusion Detection and Prevention System (IDPS) is a tool that monitors information systems, collects, analyzes information, and initiates responses when an intrusion is detected.Intrusion Detection Systems (IDSs) mainly work as defensive mechanisms. They only alert the system administrators that an incident has occurred. Intrusion Prevention Systems (IPSs) can take some actions to attempt to stop the attack, such as breaking the connection or modifying the firewall rules to deny access to the intruder. The response of the classic IDS can be slow if the system administrator is busy while the response of the IPS is automatic. An architecture that uses together IPS and IDS technologies is the best solution for defense in depth.Conceptually, a generic IDPS consists of modular components. It mainly has the following components: monitoring system, storage, analyzer, and responder.* Monitoring system - monitors and logs the events in a computer system or network;* Storage - stores information, called audit record, about suspicious activities or intrusions; also, the security policies used in analysis are stored;* Analyzer - uses different analysis methodologies to detect the incidents;* Responder - the response mechanism of incidents.The IDPSs could be classified as:* By detection methodology [12], [18]:- misuse-based detection- anomaly-based detection- stateful protocol analysis* By activity [12]:- network-based- wireless-based- network behavior analysis- host-based* By behavior on detection:- passive- active* By collection and analysis frequency:- continuous- periodicThe detection methodologies describe the characteristics of the analyzer. …

A Multichannel Cross-Layer Architecture for Multimedia Sensor Networks

Depending upon the technological developments, the same fast evolution has occurred in the structures of sensor networks, their composing devices which are sensor nodes, and their application areas. Those tiny, energy-constrained, mostly non-real-time data transmitting sensor nodes have evolved to more energy-containing, camera-adapted, real-time multimedia-data-transmitting devices. Developments in the usage areas and the capabilities have revealed some other problems such as time limited data transmission. In this paper, we propose a multichannel cross-layer architecture for Quality of Service (QoS) constrained multimedia sensor networks. The proposed architecture considers both the time and energy efficiency concepts. Energy efficiency is succeeded by ensuring the fair load distribution among the nodes during a real-time multimedia packet stream transmission. Besides ensuring the fair load distribution, on-time packet transmission is also assured by constructing the paths with a hard reservation technique depending on the predetermined QoS constraints. Simulations show that the proposed architecture provides higher performance than the Greedy approach and the LEERA scheme.

Buffer overflow management with class segregation

We consider a new model for buffer management of network switches with Quality of Service (QoS) requirements. A stream of packets, each attributed with a value representing its Class of Service (CoS), arrives over time at a network switch and demands a further transmission. The switch is equipped with multiple queues of limited capacities, where each queue stores packets of one value only. The objective is to maximize the total value of the transmitted packets (i.e., the weighted throughput).We analyze a natural greedy algorithm, greedy, which sends in each time step a packet with the greatest value. For general packet values (v1<⋯<vm), we show that greedy is (1+r)-competitive, where r=max1⩽i⩽m−1{vi/vi+1}. Furthermore, we show a lower bound of 2−vm/∑i=1mvi on the competitiveness of any deterministic online algorithm. In the special case of two packet values (1 and α>1), greedy is shown to be optimal with a competitive ratio of (α+2)/(α+1).

Adaptive Method of Increase of Package Network Load

The method of loading increase of package networks is considered. This method is based on the dynamic redistribution of the throughput of switch equipment among carrying capacities (bandwidths) of its ports. Redistribution is fulfilled synchronously with the pulsations of packet streams, which move over the entrances of these ports. In the complement of switch equipment, it entered the adaptive mechanism of automatic real time redistribution of the throughput of switch equipment among the bandwidths of ports. This mechanism allows to decrease the quantity of time intervals, when intensities of packet streams are exceeded by the set bandwidths of ports, and, thus to increase the load of equipment by useful traffic.

Intrusion Detection System for High Volume and High Velocity Packet Streams: A Clustering Approach

 Abstract—The success of any Intrusion Detection System lies in its ability to quickly adapt to new threats in near real time and further prevent new attacks. This implies extremely efficient machine learning algorithms in the backend, which in turn may use clustering algorithms capable of distinguishing between normal and anomalous network traffic. This work is a first step towards proposing such an IDS, which is built on clustering-based machine learning. The authors evaluate different clustering algorithms using a network packet trace and provide results, which help in evaluating these algorithms. The work-in-progress section of the paper visualizes the IDS which can be used in an environment where the traffic volumes are very high, enterprise boundaries are blurred, and the likelihood of malicious attacks is extremely high.

Service-oriented Router Simulation Module Implementation in NS2 Simulator

The Service-oriented Router (SoR) is a router for next generation networks. This router has a high-throughput database and it has the capability to snoop all transaction in its interfaces. The SoR also provides an API which can provide stored content in order to enrich services. The SoR has the potential to shift the current Internet infrastructure to an information-based, open innovation platform. In order to evaluate the efficiency of SoR-based applications and services, a specific simulator is required. Though the NS2 simulator does not simulate payload handling, it is a well-known network simulator and there are many resources available for evaluations. In this research, we implemented three new modules for the NS2 platform to test the concepts of an SoR, an SoR agent, a packet container and a packet analyzer. The SoR agent can interconnect the application and physical layers of the NS2 module with an additional function that can handle user data as a real payload and attaches it to the IP packet. The packet container is an improved NS2 module that can attach user data and trace information. A successful simulation has been performed for end-to-end packet transfer with a 0.02s packet delivery delay compared to typical NS2 packet delivery. The NS2 router has been enhanced for packet stream analyzing and content centric packet re-routing. Content centric packet re-routing has been achieved with 0.01s additional delay for end-to-end packet delivery. Result shows that Deep Packet Inspection and content centric networking in an SoR-based network can be achieved.

Securing SIP-based VoIP infrastructure against flooding attacks and Spam Over IP Telephony

Security of session initiation protocol (SIP) servers is a serious concern of Voice over Internet (VoIP) vendors. The important contribution of our paper is an accurate and real-time attack classification system that detects: (1) application layer SIP flood attacks that result in denial of service (DoS) and distributed DoS attacks, and (2) Spam over Internet Telephony (SPIT). The major advantage of our framework over existing schemes is that it performs packet-based analysis using a set of spatial and temporal features. As a result, we do not need to transform network packet streams into traffic flows and thus save significant processing and memory overheads associated with the flow-based analysis. We evaluate our framework on a real-world SIP traffic—collected from the SIP server of a VoIP vendor—by injecting a number of application layer anomalies in it. The results of our experiments show that our proposed framework achieves significantly greater detection accuracy compared with existing state-of-the-art flooding and SPIT detection schemes.

Tracking Coincidence Events in PET Even When Count Rates Are Extremely High: The Lost-Event Tally Packet Concept

We describe techniques that extend the usefulness of real-time data-handling architectures designed for clinical positron emission tomography (PET)-especially for instances of extremely high (>; 10 M events/s) count rate. As is widely known, Rubidium-82 (82Rb) with a 1.3-min half-life is often used in clinical PET. When used, 82Rb is more often applied for dynamic and/or gated studies-typically with little or no delay between tracer injection and start of acquisition. The use of 82Rb for short-duration-framed studies in clinical PET has its own set of challenges. For example, a “too large” dose may temporarily exceed the acquisition throughput. When such saturation occurs, coincidence events are lost. In the case of 82Rb, such loss is typically short-lived and limited to the count-rate peak. Such saturation also leads to a truncation of the count-rate profile-a truncation that often limits curve fitting essential for an accurate compartmental model across the entire study. The techniques offered here help to resolve this issue. By electronically keeping track of those events that are subject to saturation loss in the acquisition channel, the complete count-rate profile itself is preserved. Such tracking is done in real time with an accurate log of loss quantities added to the list-mode stream. This approach enables the clinician to raise the 82Rb dose without a specific concern over count-rate profile truncation. We describe a special 64-bit nonevent (i.e., “tag”) packet that is automatically inserted into the list-mode stream. The “Lost-Event Tally” tag packet stream enables a full recovery of the rate profile even when event packets are lost. During acquisition, this tag packet is repeatedly inserted into the stream to report the counted event-packet loss (up to 1 048 575) since the previous such tag packet was inserted.

Estimation of the available bandwidth ratio of a remote link or path segments

Available bandwidth is usually sensitive to network anomalies such as physical link failure, congestion, and DDoS attack. Thus, real-time available bandwidth information can be used to detect network anomalies. Many schemes have been proposed to estimate the end-to-end available bandwidth or end-to-end capacity. However, the problem of estimating the available bandwidth for a specific remote link has not been investigated in detail yet. We propose a new scheme to estimate the available bandwidth ratio of a remote link or remote path segments, a group of consecutive links, without deploying our tool at the remote nodes. The scheme would be helpful in accurately pinpointing anomalous links. Two streams of ICMP timestamp packets are sent to both end nodes of a target link according to a Poisson process, and the available bandwidth ratio for the target link is estimated based on the measured packet delay. Since the proposed scheme needs not incur a short-term congestion, unlike conventional end-to-end available bandwidth estimation mechanisms, the intrusiveness is low and the proposed scheme overcomes the limitation of conventional approaches, inability to probe the links beyond the tight link with the minimum available bandwidth. The performance of the proposed scheme is evaluated by ns-2 simulation.

Optimization of discrete broadcast under uncertainty using conditional value-at-risk

The paper considers the problem of scheduling packets in wireless broadcast systems under uncertainty with the conditional value-at-risk (CVaR) constraints. In such systems, a server periodically transmits a stream of packets over a broadcast channel. The client that needs to access the data, tunes in to the channel and waits for the next packet. This allows one to serve a large number of clients in an efficient way and also keep clients’ location secret. We formulate and solve two alternative stochastic optimization problems that minimize the transmission time subject to CVaR constraints. Our results indicate that it is possible to derive an analytical solution to the problems in certain cases of practical interest. We also propose a methodology to obtain numerical solutions for the general case.

On combining network coding with duty-cycling in flood-based wireless sensor networks

Network coding and duty-cycling are two major techniques for saving energy in wireless sensor networks. To the best of our knowledge, the idea to combine these two techniques for even more aggressive energy savings, has not been explored. This is not unusual, since these two techniques achieve energy efficiency through conflicting means, e.g., network coding saves energy by exploiting overhearing (i.e., nodes are awake), whereas duty-cycling saves energy by reducing idle listening (i.e., nodes sleep). In this article, we thoroughly investigate if network coding and duty cycling can be used together for more aggressive energy savings in flood-based wireless sensor networks.Our main idea is to exploit the redundancy sometimes present in flooding applications that use network coding, and put a node to sleep (i.e., duty cycle) when a redundant transmission takes place (i.e., the node has already received and successfully decoded a sequence of network-coded packets). We propose a scheme, called DutyCode, in which a multiple access control (MAC) protocol implements packet streaming and allows the network coding-aware application to decide when a node can sleep. We also present an algorithm for deciding the optimal coding scheme for a node to further reduce energy consumption by minimizing redundant packet transmissions. Finally, we propose an adaptive switching technique between DutyCode and an existing duty-cycling MAC protocol. We investigate our proposed solutions analytically and implement them on mote hardware. Our performance evaluation results, obtained from a 42-node indoor testbed, show that our scheme saves 30–46% more energy than network coding-based solutions.

Effect of class clustering on delay differentiation in priority scheduling

Priority scheduling is the most viable way to implement QoS differentiation in telecommunication networks. Most studies on priority scheduling do not take into account possible class clustering. In particular, they assume that different classes occur randomly and independently in the arrival stream of packets. In reality, however, packets of the same class may have the tendency to arrive in clusters. By using existing results, it is shown that class clustering may have a severe impact on the achievable delay differentiation in priority scheduling.

Stochastic control of computer networks

Although transmission control protocol (TCP) is a proven protocol in networks with congestion-dominated packet losses, it is a poor match for mobile networks with bit-error-dominated packet losses. This article considers a control theoretic approach for more effective flow control in reliable network transmissions. An extended Kalman filter is developed to estimate two key network state indicators: individual queue sizes and packet arrival rates to each queue. A source node estimates these parameters for each of the downstream queues currently servicing packet streams originating from itself. These estimates can be used by an linear quadratic Gaussian (LQG) ‘steady-state’ linear perturbation proportional-plus-integral (PI) controller to regulate the size of downstream queues by altering the packet rate sent towards a particular downstream queue. Although this work demonstrates the effects of a single controller, it is anticipated that a network wide deployment could achieve significant throughput and stability benefits. The primary contributions of this work include: (a) development of the necessary Kalman filter theory, (b) design of a network state estimator using a transient queue behaviour model, (c) equations for the LQG synthesis of a steady-state linear perturbation PI controller and (d) demonstration of the resulting controller performance, which shows significant improvement over traditional TCP implementations.