Traffic Policing Mechanism Research Articles

Adaptive tuning of network traffic policing mechanisms for DDoS attack mitigation systems

Distributed denial-of-service (DDoS) attacks are responsible for shutting down servers, denying access to critical sectors of the economy, and generating substantial downtime costs and reputation harm. Only in 2020, over ten million DDoS attacks were observed worldwide. Commonly, open-loop network traffic rate policing is used to mitigate them. That is how network devices are currently designed. This paper shows how to extend the state-of-the-art design by introducing the adaptive closed-loop tuning of policing mechanisms. As demonstrated experimentally, open-loop policing based on the celebrated token-bucket mechanism generates a steady-state control error. In contrast, the robust self-tuning controller eliminates that control error while adjusting the bitrate limiting operations to the severe and hardware-specific network operating conditions during a DDoS attack. The study shows the controller’s implementation details and discusses the critical difficulties encountered in its technical development. Furthermore, it illustrates how the control error variance depends on the commanded traffic rate limit and explains why the self-tuning controller’s anti-windup filter may fail to bring the control signal back to the set of admissible control values. All experiments presented in this paper were conducted using real data from the Polish nation-wide cybersecurity system FLDX managed by the NASK National Research Institute.

Efficient policing for screen mirroring traffic

The greediness of multimedia applications in terms of their bandwidth demands calls for new and efficient network traffic control mechanisms, especially in wireless networks where the bandwidth is limited. In an enterprise-like environment, an additional burden is expected to be added to the network by screen mirroring traffic. Smart mobile devices are displacing personal computers in many daily applications but at the same time users still need to use a large display, keyboard and mouse. Hence, the transmission of low-latency, high fidelity video over a Wi-Fi link can lead to significant unfairness among users in terms of the bandwidth that is available to them, if this wireless video traffic is not accurately policed. In this work, we focus on the problem of policing screen mirroring traffic. We evaluate various classic and new traffic policing mechanisms, and we propose a new mechanism which is shown to clearly outperform all other mechanisms, including the widely used token bucket policer.

Video Activity-Based Traffic Policing: A New Paradigm

The constant development of new multimedia applications, which are “greedy” in terms of bandwidth and Quality of Service (QoS) requirements, calls for new approaches to the traffic policing problem. This paper proposes, analyzes and presents an extensive performance evaluation of such a new approach, namely the activity-based video traffic policing. Using as a motivation recent work, which has shown that the classic traffic policing mechanisms provide unnecessarily strict policing for conforming but bursty video users, we propose five simple and efficient new mechanisms, which take into consideration and exploit video activity and the Group-of Pictures (GoP) pattern of the video traces. Contrary to the classic approach, our mechanisms do not use a token generator based on a fixed rate, but vary the token generation rate according to specific video activity-based algorithms. The results show significant improvement for conforming users, and reveal that dynamic traffic policing can provide much higher efficiency than the widely used static mechanisms. One of the new mechanisms, the Frame Size Aware Token Bucket, is shown to clearly outperform all other policing approaches for conforming users, and to provide comparable policing results with the classic mechanisms for non-conforming video users.

Dynamic versus Static Traffic Policing: A New Approach for Videoconference Traffic over Wireless Cellular Networks

The subject of traffic policing for computer communication networks has been studied extensively in the literature. However, the constant development of new multimedia applications which are ldquogreedyrdquo in terms of bandwidth and Quality of Service requirements calls for new approaches to the traffic policing problem. In this work, we introduce a new video model for single H.263 videoconference sources and we use it in order to propose a new traffic policing approach for wireless videoconference traffic. We study well-known traffic policing mechanisms which still present interesting, unsolved problems when servicing video traffic and propose, to the best of our knowledge, for the first time in the relevant literature that the token generator is based on a traffic model and not on a fixed rate. The proposed approach shows significant improvement in the results obtained by all the traffic policing mechanisms, and hence, shows that dynamic traffic policing can provide much higher efficiency than the widely used static approach.

An Adaptive Fuzzy Control Double Leaky Bucket Using Backoff Time and Backpressure in Policing Mechanism Schemes over VDSL Network

When congestion occurs in VDSL networks, it will drop incoming frames because the buffer fills up frames until it over°ows. In backpressure algorithm suitable for low traffic [1], it prevents buffer overflows. In backo® time in leaky bucket over traffic policing mechanism suitable for high traffic [2], Backoff time computations are wildly used in order to avoid the impact on the network performance. In this paper, we propose a fuzzy control double leaky bucket using backpressure and backoff time detects violations in parameter negotiation. We evaluate and compare the performance of a fuzzy control backpressure and backo® time in double-leaky bucket as a policing mechanism (FBBD), a leaky bucket (LB), a jumping window (JW), a triggered jumping window (TJW) and a double-leaky bucket (DLB). The performance of fuzzy control backpressure and backo® time in double-leaky bucket was investigated through fluctuations in telecommunications traffic streams (burst/silent type). Simulation results show that in VDSL frames, the fuzzy logic control system helps improve the performance of our fuzzy control double-leaky bucket using backpressure and backoff time schemes as a policing mechanism much better than conventional policing mechanism by about 25 % in terms of conforming and non-conforming frames once various types of burst/silence traffic are generated.

WF2Q-M: Worst-case fair weighted fair queueing with maximum rate control

While existing weighted fair scheduling schemes guarantee minimum bandwidths/resources for the classes/processes of a shared channel, the maximum rate control, which is critical to service providers, carriers, and network managers for resource management and business strategies in many applications, is generally enforced by employing traffic policing mechanisms. These approaches use either a concatenation of the rate controller and scheduler, or a policer in front of the scheduler. The concatenation method uses two sets of queues and a management apparatus that incurs overhead. The latter method may allow bursty traffic to pass through the controller, which violates the maximum rate constraint, or results in packet loss. In this paper, we present a new weighted fair scheduling scheme, WF^2Q-M, which can simultaneously support maximum rate control and minimum service rate guarantees. WF^2Q-M uses the virtual clock adjustment method to enforce maximum rate control and distribute the excess bandwidths of saturated sessions to other sessions without recalculating the virtual starting and finishing times of sessions. In terms of performance, we prove that WF^2Q-M is theoretically bounded by a corresponding fluid reference model. A procedural scheduling implementation of WF^2Q-M is proposed, and a proof of correctness is given. Finally, we present the results of extensive experiments to show that the performance of WF^2Q-M is just as claimed.

A multifractual traffic policing mechanism

In this letter we Introduce a new traffic policing mechanism able to deal with multifractal sources. The ability of monitoring accurately a traffic flow is of extreme importance to avoid malicious behavior on the part of some users and to guarantee the required quality of service of other users. The proposed policing mechanism approximates an ideal algorithm.

Integer linear programming models and performance evaluation on wavelength rearrangement in a mesh-restored all-optical network

In this letter we Introduce a new traffic policing mechanism able to deal with multifractal sources. The ability of monitoring accurately a traffic flow is of extreme importance to avoid malicious behavior on the part of some users and to guarantee the required quality of service of other users. The proposed policing mechanism approximates an ideal algorithm

A multifractal traffic policing mechanism

In this letter we Introduce a new traffic policing mechanism able to deal with multifractal sources. The ability of monitoring accurately a traffic flow is of extreme importance to avoid malicious behavior on the part of some users and to guarantee the required quality of service of other users. The proposed policing mechanism approximates an ideal algorithm.

Scheduling and Traffic Policing for Variably Demanding Video Traffic Integrated with Voice and Data Traffic in 4th Generation Wireless Networks

In this paper, we present an effective mechanism for scheduling and traffic policing in 4th generation wireless networks. More specifically, we: a) extend our previous work on a Multiple Access Control (MAC) scheme for the multiplexing of voice, video and bursty data traffic over a very high-speed wireless TDMA channel, and we study our scheme's performance when MPEG-4 videoconference users of various traffic characteristics are present in the system, and b) we combine the MAC mechanism with an improved version of an efficient traffic policing mechanism. Our results are derived for cases with and without handoff traffic in the uplink channel, and it is shown that although the burstiness of MPEG-4 traffic and channel errors impedes the maximization of channel throughput, our scheme still achieves high channel throughput for all the combined voice/video/data loads examined.

Scalable QoS Assurances with Measurement-Based Admission Control

Among recent trends in Quality of Service (QoS) provisioning in the Internet is the Differentiated Services Architecture, termed DiffServ. The successful deployment of Diffserv to provide a premium QoS guarantees to network traffic requires an effective admission control mechanism, which needs to be scalable and relatively simple to implement. In this paper we present a QoS network framework with novel and effective measurement-based resource management and admission control mechanisms. The mechanism is based on the characteristics of measured arrival and departure traffic. Those characteristics are captured via a passive monitoring. We implement the mechanism at the edge routers of a DiffServ Domain. The admission control mechanism is only executed at the edge routers and doesn't require any signaling between inner routers. The mechanism does not depend on the underlying network topology or any specifications of the cross traffic present in the domain. Therefore the mechanism is scalable. In addition, the proposed approach does not require any traffic policing mechanism at the entrance of the network. This approach can provide the statistical QoS guarantees to a variety of service classes within a DiffServ domain. We show that the proposed framework can provide a high degree of network resource sharing among multiple traffic classes while satisfying their QoS requirements. To evaluate the effectiveness of the proposed framework, we perform a set of simulations on a number of bursty video traffic sources.

Managing service-level agreements in metro ethernet networks using backpressure

Ethernet, which has long been used for local area networks (LANs), is increasingly being employed for metropolitan area networks (MANs). Because it is familiar, simple, and cost-effective, it is becoming popular as a means of transporting data in a MAN. A prerequisite for providing different levels of service in a MAN is the ability to support and maintain service-level agreements (SLAs). Proper management of SLAs ensures that users do not violate their contracts and makes it possible to guarantee quality of service (QoS). Such management requires support for traffic flow control, monitoring, and policing. This paper presents a novel Ethernet traffic-policing mechanism based on backpressure and able to provide feedback to an end user or access network when SLAs are violated, instead of simply dropping packets. The performance of this mechanism is analyzed by means of tests. The tests focus on the effects of the mechanism on throughput and fairness for transmission control protocol (TCP) traffic and on jitter and packet drops for user datagram protocol (UDP) multimedia traffic. © 2003 Lucent Technologies Inc.

The effects of correlated arrivals at a server with credit‐based traffic policing

AbstractIn this paper we observe the steady state and transient behaviour of correlated cell arrivals into a server with credit‐based traffic policing. We derive expressions for the lag‐k correlations of the departure process from the traffic policing mechanism, and observe how dependencies in the departure stream affect cell loss at the server. The results illustrate the impact of the second‐order statistics and the higher moments of the cell arrival processes on the traffic policing mechanism performance. Copyright © 2001 John Wiley & Sons, Ltd.

Rate control for VBR video over ATM: simplification and implementation

Rate control is essential to ensure high-quality video transmission over asynchronous transfer mode (ATM) networks; both source and channel rates must not violate buffer or network traffic constraints in order to guarantee decoded video quality. To date, source and channel rate selection has been performed jointly because the rates are related through buffer and network constraints and therefore appear to be interdependent. It is shown that selection of these rates can be separated and the rate control problem is therefore simplified, allowing sequential source and channel rate selection without the need for iteration. A rate control algorithm is proposed which implements noniterative, separate sequential selection of source and channel rates in order to minimize the distortion variation between frames, subject to all buffer and network constraints. In particular, the leaky bucket is used as the traffic policing mechanism. Achieving a target rate for individual frames is facilitated by using a rate-distortion optimized video coder which allows coding to an exactly specified rate or distortion. Channel rate selection is performed following source rate selection with the goal of providing smooth traffic to the network, thereby allowing a high statistical multiplexing gain. Experiments demonstrate that the proposed noniterative rate control algorithm, when implemented using the optimized coder, achieves consistent video quality while providing smooth traffic to the network.

V-NET: A versatile network architecture for flexible delay guarantees in real-time networks

This paper proposes a Versatile Network Architecture (V-NET) to support flexible delay guarantees for applications in real-time networks. Applications communicate over the V-NET by using end-to-end network connections which support real-time and reliability characteristics tailored to meet the application's specified requirements. V-NET differs from other proposed architectures in that, in addition to addressing the issue of quality of service (QoS) feasibility for a wide spectrum of real-time applications, it also provides a mechanism to determine a network state dependent range of feasible delay values at each switching node along the routing path. These delay ranges can be used to assign per-node delays that reflect the resource availability of the node, thereby reducing the likelihood of bottlenecks along the routing path. The V-NET delay guarantees are provided for a variety of packet scheduling algorithms and traffic policing mechanisms. This flexibility is an important design consideration as a real-time network architecture must accommodate existing and future multimedia applications, with hard-, soft-, and non-real-time traffic. The performance evaluation results demonstrate the efficiency of this scheme in handling different traffic scenarios and QoS requirements. We have shown that it is possible, and indeed efficient, to determine an upper-bound on the delay of real-time traffic, when using our per-node delay assignment policies.

Lowpass traffic policing mechanism based on theleaky bucket

A traffic throttle can be modelled as a gate with one input and two outputs: pass for accepted calls, and gap for rejected calls. The gate decides whether to pass or to gap an incoming call according to its policing mechanism. The authors show that a small modification to a leaky bucket policing mechanism yields a lowpass filter. The proposed mechanism is a new type of a nonlinear filter.