M. Luckie, Alexander Marder, B. Huffaker, K. Claffy
{"title":"Learning Regexes to Extract Network Names from Hostnames","authors":"M. Luckie, Alexander Marder, B. Huffaker, K. Claffy","doi":"10.1145/3497777.3498545","DOIUrl":"https://doi.org/10.1145/3497777.3498545","url":null,"abstract":"We present the design, implementation, evaluation, and validation of a system that automatically learns regular expressions (regexes) to extract network names from Internet hostnames assigned by operators using their own conventions. Our fully automated method does not rely on a human to provide a starting regex, labeled examples of valid extractions, or a dictionary of network names. Our method first learns the dictionary of network names, and then automatically generates and evaluates regexes that extract these names. We validate our dictionary against ground truth, finding that 97.3% of the names our regexes extract are valid names for the networks.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"38 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114796338","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"What the Tropical Pacific Wants From Starlink for Christmas: Will LEO Networks Finally Bridge the Digital Divide to Remote Islands?","authors":"U. Speidel","doi":"10.1145/3497777.3498548","DOIUrl":"https://doi.org/10.1145/3497777.3498548","url":null,"abstract":"The tropical Pacific with its many remote islands is home to hundreds of thousands of people reliant on satellite for Internet service. The new generation low-earth-orbit (LEO) networks are hailed as game changers, but how well are Starlink and its competitors shaping up when it comes to serving this part of the world? This paper looks at aspects from system capacity to constellation configuration, content delivery, gateway placement and routing to assess what works and does not work for the region, and what needs to happen for Pacific Islanders to truly benefit from LEO networks.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"45 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"125115965","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Faizul Haq, Adeeba Naaz, T. V. P. K. Bantupalli, Kotaro Kataoka
{"title":"DRL-FTO: Dynamic Flow Rule Timeout Optimization in SDN using Deep Reinforcement Learning","authors":"Faizul Haq, Adeeba Naaz, T. V. P. K. Bantupalli, Kotaro Kataoka","doi":"10.1145/3497777.3498549","DOIUrl":"https://doi.org/10.1145/3497777.3498549","url":null,"abstract":"Optimization of flow rule timeouts promises to reduce the frequency of message exchange between the SDN controller and the switches and contributes to the reduction of the controller load. However, such optimization is challenging due to the dynamically changing traffic patterns. Many algorithm-based solutions are based on the estimation of flow duration. However, such estimation approaches cannot achieve as good results as learning through observation, the actual attempt to optimize the timeout, and evaluating such actions in the network. This paper proposes “DRL-FTO”, a Deep Reinforcement Learning based approach to optimize the flow rule timeouts so that the number of message exchanges between the SDN controller and switches is minimized even though the characteristics of incoming traffic dynamically changes. We developed the proof of concept implementation of DRL-FTO and evaluated using the synthesized Internet traffic in Mininet environment with Ryu SDN controller. The evaluation results exhibited that DRL-FTO reduces the message exchange without compromising the throughput in the data plane, and, as a positive consequence, the SDN controller load can also be reduced.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"57 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"122086443","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"capsAEUL: Slow HTTP DoS Attack Detection using Autoencoders through Unsupervised Learning","authors":"Tahir Ahmed Shaik, Kotaro Kataoka","doi":"10.1145/3497777.3498550","DOIUrl":"https://doi.org/10.1145/3497777.3498550","url":null,"abstract":"Slow HTTP Denial of Service (DoS) attacks are defined as application layer vulnerabilities that make HTTP services degrade their performance or reach a denial state. The Slow HTTP DoS attacks can evade the generic DoS attack detection techniques because of their low volume but long lasting attack traffic. Existing solutions on Slow HTTP DoS attack detection mainly rely on static threshold based detection techniques or supervised machine learning techniques. However, the use of unsupervised learning techniques has not been widely studied. This paper proposes capsAEUL, which uses multiple Autoencoders as an unsupervised learning technique for detecting all of Slowloris, Slowread, and Slow POST of Slow HTTP DoS attack as an integrated system. The PoC implementation of capsAEUL exhibits the comparable prediction performance in terms of the high accuracy and the decent AUC scores.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"127522263","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Ryusei Shiiba, Satoru Kobayashi, Osamu Akashi, K. Fukuda
{"title":"Verifying Network Properties in SRv6 based Service Function Chaining","authors":"Ryusei Shiiba, Satoru Kobayashi, Osamu Akashi, K. Fukuda","doi":"10.1145/3497777.3498546","DOIUrl":"https://doi.org/10.1145/3497777.3498546","url":null,"abstract":"Segment Routing over IPv6 (SRv6) is a simple and scalable protocol for building service function chaining (SFC) on IPv6 data plane. Despite the benefits, managing the data plane of service chains in SRv6 is an error-prone task for network operators, especially in large-scale data center networks. Data plane verification is a promising approach to formally verify the operator requirements. However, the existing approaches do not fully support header modifications with a variable length header in SRv6 and network functions for the service chains. In this paper, we propose a new data plane verification approach for the service chain management. Unlike the existing works, our proposed data plane model for the verification naturally includes header modifications in SRv6 and network functions for the service chains. On the basis of the model, we develop a search-based verification technique for two fundamental network properties: network reachability and isolation of a service chain from the others. To confirm the appropriateness of the approach, we implement a data plane verifier based on the model. Using the verifier, we demonstrate the effectiveness of our approach in two case examples. Through the demonstration, we show that our approach is expressive enough to verify network properties for safely managing the service chains","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"53 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123688217","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Twitch’s CDN as an Open Population Ecosystem","authors":"Wei-Shiang Wung, Guan-Ting Ting, Ruey-Tzer Hsu, Cheng Hsu, Yu-Chien Tsai, Caleb Wang, Yuan-Tai Liu, Hsi Chen, Polly Huang","doi":"10.1145/3497777.3498551","DOIUrl":"https://doi.org/10.1145/3497777.3498551","url":null,"abstract":"The quality and continuity of the video services such as Twitch depend on the scale and well-being of their content distribution networks (CDNs). Each CDN may consist of 1000s of servers, physically feeding the videos to the clients. Opting for a better understanding, researchers have attempted to measure and analyze the CDNs of popular video services [10, 11, 12, 19]. These works are, however, one-time effort. Given the widespread use of Twitch, we find continuous survey of its CDN an important subject of study. The challenge lies in the cost of performing the Internet-scale scans – the probing traffic. The larger the CDNs and the more frequent the scans are, the higher the overhead. Instead of performing full scans repeatedly, we envision a cost-effective alternative that samples and estimates the CDN size (i.e., the number of servers). Only when the size change is significant, does the system trigger a full scan. To this end and inspired by Capture-Mark-Recapture (CMR), a methodology widely used in Ecology to estimate animal population with little human effort, we propose two mechanisms to estimate the CDN size with lightweight traffic. Using a data set collected in Nov 2019, we find a 7.25% average estimation error. Provided an estimation error bound, we can identify as well the best parameter combination to minimize the probing traffic.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"85 3-4 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-14","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123431415","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Kosuke Nakagawa, Manabu Tsukada, K. Shima, H. Esaki
{"title":"WebRTC-based measurement tool for peer-to-peer applications and preliminary findings with real users","authors":"Kosuke Nakagawa, Manabu Tsukada, K. Shima, H. Esaki","doi":"10.1145/3497777.3498544","DOIUrl":"https://doi.org/10.1145/3497777.3498544","url":null,"abstract":"Direct peer-to-peer (P2P) communication is often used to minimize the end-to-end latency for real-time applications that require accurate synchronization, such as remote musical ensembles. However, there are few studies on the performance of P2P communication between home network environments, thus hindering the deployment of services that require synchronization. In this study, we developed a P2P performance measurement tool using the Web Real-Time Communication (WebRTC) statistics application programming interface. Using this tool, we can easily measure P2P performance between home network environments on a web browser without downloading client applications. We also verified the reliability of round-trip time (RTT) measurements using WebRTC and confirmed that our system could provide the necessary measurement accuracy for RTT and jitter measurements for real-time applications. In addition, we measured the performance of a full mesh topology connection with 10 users in an actual environment in Japan. Consequently, we found that only 66% of the peer connections had a latency of 30 ms or less, which is the minimum requirement for high synchronization applications, such as musical ensembles.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"9 2 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116787092","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"MAC address randomization tolerant crowd monitoring system using Wi-Fi packets","authors":"Yuyi Cai, Manabu Tsukada, H. Ochiai, H. Esaki","doi":"10.1145/3497777.3498547","DOIUrl":"https://doi.org/10.1145/3497777.3498547","url":null,"abstract":"Media access control (MAC) addresses inside Wi-Fi packets can be used for beneficial activities such as crowdedness estimation, marketing, and hazard maps. However, the MAC address randomization systems introduced around 2014 make all conventional MAC-address-based crowd monitoring systems count the same device more than once. Therefore, there is a need to create a new crowd monitoring system tolerant to MAC address randomization to estimate the number of devices accurately. In this paper, Vision and TrueSight, two new crowd monitoring algorithms that estimate the number of devices, are proposed to prove that MAC-address-based crowd monitoring is still possible. In addition to probe requests, Vision uses data packets and beacon packets to mitigate the influence of randomization. Moreover, TrueSight uses sequence numbers and hierarchical clustering to estimate the number of devices. The experimental results of this study show that even without installing any special software, Vision can gather 440 randomly generated MAC addresses into one group and count only once, and TrueSight can estimate the number of devices with an accuracy of more than 75% with an acceptable error range of 1.","PeriodicalId":248679,"journal":{"name":"Proceedings of the 16th Asian Internet Engineering Conference","volume":"103 3-4","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2021-12-03","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114043323","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}