{"title":"Two-stage anomaly detection using application specific heavy hitter analysis","authors":"Beibei Yang, A. Nakao","doi":"10.1109/NOMS.2018.8406302","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406302","url":null,"abstract":"Multiple network anomaly detection methods have been proposed to deal with rapidly increasing attacks and network disruptions. The existing hierarchical heavy hitter (HHH) is well studied, but it is still difficult to identify more specifically targeted anomalies, as they tend to be small in volume, thus, buried in the entire traffic. To resolve this issue, this paper proposes a new two-stage traffic aggregation method: first screening target application traffic and then applying HHH analysis on classified traffic. Characterizing the normal traffic behavior per application through HHH lattice facilitates the detection of anomalies even in the small traffic volume. Our preliminary evaluation reveals that our proposed method has an advantage in effectively detecting anomalies compared to the existing methods. We plan to further elaborate the anomaly detection capability of our proposed method under various traffic data.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"1 1","pages":"1-4"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80422093","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Maxime Compastié, Rémi Badonnel, O. Festor, Ruan He, Mohamed Kassi-Lahlou
{"title":"Unikernel-based approach for software-defined security in cloud infrastructures","authors":"Maxime Compastié, Rémi Badonnel, O. Festor, Ruan He, Mohamed Kassi-Lahlou","doi":"10.1109/NOMS.2018.8406155","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406155","url":null,"abstract":"The heterogeneity of cloud resources implies sub-stantial overhead to deploy and configure adequate security mechanisms. In that context, we propose a software-defined security strategy based on unikernels to support the protection of cloud infrastructures. This approach permits to address management issues by uncoupling security policy from their enforcement through programmable security interfaces. It also takes benefits from unikernel virtualization properties to support this enforcement and provide resources with low attack surface. These resources correspond to highly constrained configurations with the strict minimum for a given period. We describe the management framework supporting this software-defined security strategy, formalizing the generation of unikernel images that are dynamically built to comply with security requirements over time. Through an implementation based on MirageOS, and extensive experiments, we show that the cost induced by our security integration mechanisms is small while the gains in limiting the security exposure are high.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"96 1","pages":"1-7"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80428016","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"An unsupervised framework for detecting anomalous messages from syslog log files","authors":"Risto Vaarandi, Bernhards Blumbergs, Markus Kont","doi":"10.1109/NOMS.2018.8406283","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406283","url":null,"abstract":"System logs provide valuable information about the health status of IT systems and computer networks. Therefore, log file monitoring has been identified as an important system and network management technique. While many solutions have been developed for monitoring known log messages, the detection of previously unknown error conditions has remained a difficult problem. In this paper, we present a novel data mining based framework for detecting anomalous log messages from syslog- based system log files. We also describe the implementation and performance of the framework in a large organizational network.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"20 1","pages":"1-6"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"87910564","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Thomas Soenen, S. V. Rossem, W. Tavernier, Felipe Vicens, Dario Valocchi, P. Trakadas, Panos Karkazis, G. Xilouris, P. Eardley, Stavros Kolometsos, M. Kourtis, Daniel Guija, M. S. Siddiqui, P. Hasselmeyer, José Bonnet, D. López
{"title":"Insights from SONATA: Implementing and integrating a microservice-based NFV service platform with a DevOps methodology","authors":"Thomas Soenen, S. V. Rossem, W. Tavernier, Felipe Vicens, Dario Valocchi, P. Trakadas, Panos Karkazis, G. Xilouris, P. Eardley, Stavros Kolometsos, M. Kourtis, Daniel Guija, M. S. Siddiqui, P. Hasselmeyer, José Bonnet, D. López","doi":"10.1109/NOMS.2018.8406139","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406139","url":null,"abstract":"In pursuit of a flexible, resource efficient and high- performant 5G infrastructure, many operators, vendors and research consortia are currently developing, testing and integrating their NFV platform with associated management and orchestration (MANO) functionality. The SONATA NFV platform follows a micro-service design, which involves a tight coupling between an SDK, monitoring and MANO functionality, targeting a secure and stable software foundation. This experience paper gives a thorough overview on the encountered challenges, insights and resulting learnings when implementing and integrating the SONATA Service Platform using a continuous integration and delivery DevOps methodology. This is the result of a strong cooperation between prominent equipment vendors, network operators, software companies and universities, providing a set of constructive recommendations in hope of catalysing the development and deployment of NFV platforms.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"34 1","pages":"1-6"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"82237657","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Gopika Premsankar, Bissan Ghaddar, M. D. Francesco, R. Verago
{"title":"Efficient placement of edge computing devices for vehicular applications in smart cities","authors":"Gopika Premsankar, Bissan Ghaddar, M. D. Francesco, R. Verago","doi":"10.1109/NOMS.2018.8406256","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406256","url":null,"abstract":"Vehicular applications in smart cities, including assisted and autonomous driving, require complex data processing and low-latency communication. An effective approach to address these demands is to leverage the edge computing paradigm, wherein processing and storage resources are placed at access points of the vehicular network, i.e., at roadside units (RSUs). Deploying edge computing devices for vehicular applications in urban scenarios presents two major challenges. First, it is difficult to ensure continuous wireless connectivity between vehicles and RSUs, especially in dense urban areas with many buildings. Second, edge computing devices have limited processing resources compared to the cloud, thereby requiring careful network planning to meet the computational and latency requirements of vehicular applications. This article specifically addresses these challenges. In particular, it targets efficient deployment of edge computing devices in an urban scenario, subject to application- specific quality of service constraints. To this end, this article introduces a mixed integer linear programming formulation to minimize the deployment cost of edge devices by jointly satisfying a target level of network coverage and computational demand. The proposed approach is able to accurately model complex urban environments with many buildings and a large number of vehicles. Furthermore, this article presents a simple yet effective heuristic to deploy edge computing devices based on the knowledge of road traffic in the target deployment area. The devised methods are evaluated by extensive simulations with data from the city of Dublin. The obtained results show that the proposed solutions can effectively guarantee a target application- specific quality of service in realistic conditions.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"85 1","pages":"1-9"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86516172","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Centralized approach for trustworthy message dissemination in VANET","authors":"R. Shrestha, Rojeena Bajracharya, S. Nam","doi":"10.1109/NOMS.2018.8406184","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406184","url":null,"abstract":"In VANET, each vehicle near an event location actively collects and disseminates critical event information to adjacent vehicles. Most of the existing message trustworthiness schemes are not suitable for VANET. In this paper, we propose an efficient message trustworthiness scheme to disseminate trustworthy event messages in a timely manner in VANET. We compare our scheme with the Waze in a qualitative way and explain the main advantages of our scheme compared to the Waze.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"14 1","pages":"1-5"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88420939","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Generation mechanism of flaming phenomena in on-line social networks described by perturbation of asymmetric link effects","authors":"M. Aida, C. Takano, M. Murata","doi":"10.1109/NOMS.2018.8406301","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406301","url":null,"abstract":"Explosive dynamics in on-line social networks including flaming phenomena give serious impacts not only on stable operation of information networks but also social activities on the real world. The oscillation model in directed networks can describe generation the flaming phenomena in on-line social networks. In this paper, by introducing perturbation analysis, we describe the effect of directed link in the network to generation of the flaming phenomena, based om the oscillation model.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"375 1","pages":"1-4"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"80556684","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
R. C. Lunardi, Regio A. Michelin, C. V. Neu, A. Zorzo
{"title":"Distributed access control on IoT ledger-based architecture","authors":"R. C. Lunardi, Regio A. Michelin, C. V. Neu, A. Zorzo","doi":"10.1109/NOMS.2018.8406154","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406154","url":null,"abstract":"Due to increased number of attacks on the Internet of Things (IoT) devices, the security of IoT networks became critical. Some recent researches proposed the adoption of blockchain in IoT networks without a thorough discussion on the impact of the solution on the devices performance. Furthermore, blockchain employment in the context of IoT can be challenging due to the devices hardware limitations. To fill this gap, this paper proposes an IoT ledger-based architecture to ensure access control on heterogeneous scenarios. This research applies conventional devices used on IoT networks, such as Arduino, Raspberry and Orange Pi boards. Finally, we perform performance evaluation focused on access control of IoT devices and on information propagation through peers on a private IoT network scenario.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"13 1","pages":"1-7"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"90714274","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Service function chaining policy compliance checking","authors":"Yangjun Qiu, Xiaofeng Qiu, Yibin Cai","doi":"10.1109/NOMS.2018.8406194","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406194","url":null,"abstract":"The end-to-end network services often requires various Network Functions (NFs) that provides the L4-L7 functionality. Service Function Chaining (SFC), which consists of an ordered set of NFs, and Software Defined Network (SDN), which has global view of the network and programmability, easily enable the creation of network services. However, the underlying network forwarding behaviors may be not compliant with the SFC policies. In this paper, we analyze the fundamental cause of the incompliance and propose an algorithm to check the enforcement of SFC policies. Modules and structure to implement and integrate the algorithm to a SDN network is provided. Effectiveness and performance is demonstrated in Mininet as well as a test SDN network on campus.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"1 1","pages":"1-4"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88939369","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"On the configuration of radio resource management in a sliced RAN","authors":"J. Pérez-Romero, O. Sallent, R. Ferrús, R. Agustí","doi":"10.1109/NOMS.2018.8406280","DOIUrl":"https://doi.org/10.1109/NOMS.2018.8406280","url":null,"abstract":"Network slicing is a fundamental feature of 5G systems that facilitates the provision of particular system behaviours adapted to specific service/application domains on top of a common network infrastructure. A network slice is in general composed by a core network slice and a Radio Access Network (RAN) slice. The realization of RAN slices is particularly challenging because it requires configuring and operating traffic differentiation and protection mechanisms to simultaneously deliver multiple and diverse RAN behaviors over a given pool of radio resources. In this context, this paper proposes to characterize the behavior of a RAN slice through the specification of a set of control parameters that are used to dictate the operation of the packet scheduling function at Layer 2 and the radio admission control function at Layer 3. An evaluation of the suitability of these parameters for achieving efficient radio resource sharing and isolation between RAN slices is presented when configuring a network for supporting a slice with multiple enhanced Mobile BroadBand services and another slice for providing Mission Critical services. The analysis reveals the different impact of the Layer 3 and Layer 2 parameters for isolating services of different slices depending on whether they require guaranteed or non-guaranteed bit rates.","PeriodicalId":19331,"journal":{"name":"NOMS 2018 - 2018 IEEE/IFIP Network Operations and Management Symposium","volume":"19 1","pages":"1-6"},"PeriodicalIF":0.0,"publicationDate":"2018-04-23","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"73224295","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}