{"title":"How to prevent AS hijacking attacks","authors":"Johann Schlamp, G. Carle, E. Biersack","doi":"10.1145/2413247.2413265","DOIUrl":"https://doi.org/10.1145/2413247.2413265","url":null,"abstract":"The Border Gateway Protocol (BGP) was designed without security aspects in mind. This fact makes the Internet vulnerable to attacks: complete networks can be hijacked to blackhole or intercept traffic. In this work, we extend the set of known hijacking attacks with a real case study on AS hijacking, carried out in order to send spam from a victim's network. This type of attack is more sophisticated than common IP prefix hijacking, and is aimed at a long-term benefit, with effective use for several months. On our poster, we thoroughly investigate the aforementioned incident based on live data from both the control and the data plane. Our analysis yields insights into the attacker's proceeding to covertly hijack a whole autonomous system, mislead an upstream provider and abuse an unallocated address space. We further discuss the potential for prevention and reveal shortcomings of state of the art BGP security extensions like RPKI. Based on these findings, we outline the concept of an early warning system for AS hijacking with pre-emptive capabilities.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"10 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"129085308","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
J. Bermond, D. Coudert, Gianlorenzo D'angelo, Fatima Zahra Moataz
{"title":"Diverse routing in networks with star SRLGs","authors":"J. Bermond, D. Coudert, Gianlorenzo D'angelo, Fatima Zahra Moataz","doi":"10.1145/2413247.2413262","DOIUrl":"https://doi.org/10.1145/2413247.2413262","url":null,"abstract":"The notion of Shared Risk Link Group, SRLG has been introduced to capture multiple correlated failures in a network. A SRLG is a set of links that fail simultaneously if a given event (risk) occurs. In such multiple failures scenario, the problem of Diverse Routing consists in finding two SRLG-disjoint paths between a pair of nodes. We consider such problem for localized failures, when all the links of a SRLG verify the star property i.e. when they are incident to the same node. We prove that in this case the problem is in general NP-complete and determine some polynomial cases.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124331479","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Actors and publish/subscribe: an efficient approach to scalable distribution in data centers","authors":"Dominik Charousset, T. Schmidt, Matthias Wählisch","doi":"10.1145/2413247.2413280","DOIUrl":"https://doi.org/10.1145/2413247.2413280","url":null,"abstract":"Data center applications are required to be fault-tolerant and self-healing, and at the same time to scale dynamically with the number of available hardware resources. Highly efficient task distribution is crucial for such services that require low latency and high availability. This paper introduces pub/sub actors as a paradigm to build distributed data center applications without a single point of failure. Our approach does not actively distribute tasks, but uses group communication and an orchestration protocol. Requests are received by a group of potential servers, but only processed by one of them. We present a key-value store using libcppa as a case study of promising performance.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"41 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"126331251","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ashwin Rao, Justine Sherry, A. Legout, A. Krishnamurthy, W. Dabbous, D. Choffnes
{"title":"Meddle: middleboxes for increased transparency and control of mobile traffic","authors":"Ashwin Rao, Justine Sherry, A. Legout, A. Krishnamurthy, W. Dabbous, D. Choffnes","doi":"10.1145/2413247.2413286","DOIUrl":"https://doi.org/10.1145/2413247.2413286","url":null,"abstract":"Mobile networks are the most popular, fastest growing and least understood systems in today’s Internet ecosystem. Despite a large collection of privacy, policy and performance issues in mobile networks, users and researchers are faced with few options to characterize and address them. In this poster we present Meddle, a framework aimed at enhancing transparency in mobile networks and providing a platform that enables users (and researchers) control mobile traffic.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"40 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133093346","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Decoupling BGP policy from routing with programmable reactive policy control","authors":"Peter Thai, J. D. Oliveira","doi":"10.1145/2413247.2413276","DOIUrl":"https://doi.org/10.1145/2413247.2413276","url":null,"abstract":"In this extended abstract, we propose an SDN-based interdomain policy control methodology. Our main focus is on ASes built entirely on SDN architecture, but we will also provide methods for integrating ASes built fully on traditional packet forwarding devices. We seek to support the three basic AS relationships traditionally supported by BGP. They are (i) customer-provider: one AS pays another to forward traffic, (ii) peer-to-peer: both ASes mutually benefit from forwarding each others' packets, and (iii) redundancy: one AS uses another as backup in case of path failure.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"345 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133212133","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hongyi Chen, Zhigang Sun, Bin Huang, Tao Li, Xilong Mao
{"title":"Who is more reliable?: an evaluation method for distributed-memory aggregation in the internet","authors":"Hongyi Chen, Zhigang Sun, Bin Huang, Tao Li, Xilong Mao","doi":"10.1145/2413247.2413273","DOIUrl":"https://doi.org/10.1145/2413247.2413273","url":null,"abstract":"Traditional disk-oriented storage systems can no longer meet the high requirements of applications in latency and bandwidth, for which RAMCloud, was proposed to replace the disk with RAM. We consider using the memory of end-users in existing Internet to achieve a similar memory storage system. However the end-users' behavior are not as controllable as the servers in data center, which would lead to a high data loss rate. So how to ensure the data's reliability is the biggest challenge. To improve the reliability, as well as the resource utilization, we present a thought of Contributor scoring, establishing a scoring model according to Contributors' behavior. This model will classify Contributors into certain levels. Moreover, we train the Model with genetic algorithms. Experimental results show that the optimized model can effectively divide the Contributor, ensure certain reliability.It has great significance to this user memory storage system for improving the reliability and resource utilization.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"35 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130730336","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
David Gugelmann, Dominik Schatzmann, Vincent Lenders
{"title":"AFR: automatic multi-stage forensic data retrieval","authors":"David Gugelmann, Dominik Schatzmann, Vincent Lenders","doi":"10.1145/2413247.2413254","DOIUrl":"https://doi.org/10.1145/2413247.2413254","url":null,"abstract":"The investigation of malware infections in enterprise networks is today a tedious task with a lot of manual intervention in order to find the scattered relevant bits and bytes from infected hosts. We propose in this work AFR, a framework for automatic multi-stage forensic data retrieval, that automatically analyzes and retrieves network, memory and disk data to preserve the evidence of host compromise at a central location. AFR performs automated malware analysis using traditional intrusion detection techniques like network intrusion detection systems and anti-virus software but combines the resulting alarms in real-time to proactively retrieve and archive data that is relevant for retrospective investigations. The proactive retrieval approach reduces the manual work load of IT administrators while significantly improving the likelihood that volatile data is collected before it vanishes. We show that proactive storing of selected memory and disk dumps is feasible and scales over time in virtualized thin client enterprise environments.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131100495","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"The complete picture of the Twitter social graph","authors":"Maksym Gabielkov, A. Legout","doi":"10.1145/2413247.2413260","DOIUrl":"https://doi.org/10.1145/2413247.2413260","url":null,"abstract":"In this work, we collected the entire Twitter social graph that consists of 537 million Twitter accounts connected by 23.95 billion links, and performed a preliminary analysis of the collected data. In order to collect the social graph, we implemented a distributed crawler on the PlanetLab infrastructure that collected all information in 4 months. Our preliminary analysis already revealed some interesting properties. Whereas there are 537 million Twitter accounts, only 268 million already sent at least one tweet and no more than 54 million have been recently active. In addition, 40% of the accounts are not followed by anybody and 25% do not follow anybody. Finally, we found that the Twitter policies, but also social conventions (like the follow-back convention) have a huge impact on the structure of the Twitter social graph.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130689791","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Implications of source routing","authors":"Onur Ascigil, K. Calvert","doi":"10.1145/2413247.2413255","DOIUrl":"https://doi.org/10.1145/2413247.2413255","url":null,"abstract":"Over the years, a number of source routing architectures have been put forward [2, 1, 5]. A source routing architecture is one where packets indicate the paths that they follow. Because such architectures seem to offer a number of advantages, especially with respect to competition and evolvability, we believe the case for a source-routed network layer is worth examining in detail. Our model of source routing consists of packets carrying (loose) provider-level source routes (i.e., interdomain paths) and distributed path providing servers that collect routing updates disseminated by transit providers, compute (inter-domain level) paths, and provide those paths to end systems for placement in packets. Thus routing is provided as a service with distributed path providers, similar to ROSE [6]. We also assume a mechanism along the lines of Platypus [7] so that providers can verify packets for routing-policycompliance and proof-of-payments. While it offers significant benefits, source routing also introduces some new technical and economic challenges. With such a different “factoring” of the routing process, we envision such an architecture to have a different business model in selling transit services to users. Because source routing empowers users to select indirect providers from whom users obtain transit service, users would be required to compensate their indirect providers in addition to the direct providers for the transit services. In order to scale the money transactions between users and all the direct and indirect transit providers, we envision a set of third party resellers, path brokers, who buy transit (relaying) service from providers, and then sell paths to users. Path brokers and path providers can be the same entity or can be separate. A major barrier towards deploying source routing is the “con-","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"67 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114498216","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Exploring reachability via settlement-free peering","authors":"S. Meyer, Matthias Wählisch, T. Schmidt","doi":"10.1145/2413247.2413277","DOIUrl":"https://doi.org/10.1145/2413247.2413277","url":null,"abstract":"The importance of an autonomous system is typically derived by its economic relevance, in Internet terms measured by the number of customer ASes it provides with connectivity. Such simple business relationship does not hold anymore. In this paper, we analyze the importance of peer-to-peer links between BGP peers. We show that settlement-free peering may change the global rank of an AS by three orders of magnitude.","PeriodicalId":185637,"journal":{"name":"CoNEXT Student '12","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2012-12-10","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"124525913","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}