{"title":"Airshark: detecting non-WiFi RF devices using commodity WiFi hardware","authors":"Shravan K. Rayanchu, Ashish Patro, Suman Banerjee","doi":"10.1145/2068816.2068830","DOIUrl":"https://doi.org/10.1145/2068816.2068830","url":null,"abstract":"In this paper, we propose Airshark -- a system that detects multiple non-WiFi RF devices in real-time and using only commodity WiFi hardware. To motivate the need for systems like Airshark, we start with measurement study that characterizes the usage and prevalence of non-WiFi devices across many locations. We then present the design and implementation of Airshark. Airshark extracts unique features using the functionality provided by a WiFi card to detect multiple non-WiFi devices including fixed frequency devices (e.g., ZigBee, analog cordless phone), frequency hoppers (e.g., Bluetooth, game controllers like Xbox), and broadband interferers (e.g., microwave ovens). Airshark has an average detection accuracy of 91-96%, even in the presence of multiple simultaneously active RF devices operating at a wide range of signal strengths (-80 to -30 dBm), while maintaining a low false positive rate. Through a deployment in two production WLANs, we show that Airshark can be a useful tool to the WLAN administrators in understanding non-WiFi interference.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"16 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116881113","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Bernhard Ager, W. Mühlbauer, Georgios Smaragdakis, S. Uhlig
{"title":"Web content cartography","authors":"Bernhard Ager, W. Mühlbauer, Georgios Smaragdakis, S. Uhlig","doi":"10.1145/2068816.2068870","DOIUrl":"https://doi.org/10.1145/2068816.2068870","url":null,"abstract":"Recent studies show that a significant part of Internet traffic is delivered through Web-based applications. To cope with the increasing demand for Web content, large scale content hosting and delivery infrastructures, such as data-centers and content distribution networks, are continuously being deployed. Being able to identify and classify such hosting infrastructures is helpful not only to content producers, content providers, and ISPs, but also to the research community at large. For example, to quantify the degree of hosting infrastructure deployment in the Internet or the replication of Web content.\u0000 In this paper, we introduce Web Content Cartography, i.e., the identification and classification of content hosting and delivery infrastructures. We propose a lightweight and fully automated approach to discover hosting infrastructures based only on DNS measurements and BGP routing table snapshots. Our experimental results show that our approach is feasible even with a limited number of well-distributed vantage points. We find that some popular content is served exclusively from specific regions and ASes. Furthermore, our classification enables us to derive content-centric AS rankings that complement existing AS rankings and shed light on recent observations about shifts in inter-domain traffic and the AS topology.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"17 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114338495","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
J. Sanjuàs-Cuxart, P. Barlet-Ros, N. Duffield, R. Kompella
{"title":"Sketching the delay: tracking temporally uncorrelated flow-level latencies","authors":"J. Sanjuàs-Cuxart, P. Barlet-Ros, N. Duffield, R. Kompella","doi":"10.1145/2068816.2068861","DOIUrl":"https://doi.org/10.1145/2068816.2068861","url":null,"abstract":"Packet delay is a crucial performance metric for real-time, network-based applications. Obtaining per-flow delay measurements is particularly important to network operators, but is computationally challenging in high-speed links. Recently, passive delay measurement techniques have been proposed that outperform traditional active probing in terms of accuracy and network overhead. However, such techniques rely on the empirical observation that packet delays across different flows are temporally correlated, an assumption that is not met in presence of traffic prioritization, load balancing policies, or due to intricacies of the switch fabric.\u0000 We present a novel data structure called Lossy Difference Sketch (LDS) that provides per-flow delay measurements without relying on any specific delay model. LDS obtains a notable accuracy improvement compared to the state of the art with a small memory footprint and network overhead. The data structure can be sized according to target accuracy requirements or to fit a low memory budget.\u0000 We deploy an actual implementation of LDS in an operational research and education network and show that it obtains higher accuracy than temporal correlation-based techniques without exploiting any knowledge about the underlying delay model.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"159 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"114297738","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Tiago Rodrigues, Fabrício Benevenuto, M. Cha, K. Gummadi, Virgílio A. F. Almeida
{"title":"On word-of-mouth based discovery of the web","authors":"Tiago Rodrigues, Fabrício Benevenuto, M. Cha, K. Gummadi, Virgílio A. F. Almeida","doi":"10.1145/2068816.2068852","DOIUrl":"https://doi.org/10.1145/2068816.2068852","url":null,"abstract":"Traditionally, users have discovered information on the Web by browsing or searching. Recently, word-of-mouth has emerged as a popular way of discovering the Web, particularly on social networking sites like Facebook and Twitter. On these sites, users discover Web content by following URLs posted by their friends. Such word-of-mouth based content discovery has become a major driver of traffic to many Web sites today. To better understand this popular phenomenon, in this paper we present a detailed analysis of word-of-mouth exchange of URLs among Twitter users. Among our key findings, we show that Twitter yields propagation trees that are wider than they are deep. Our analysis on the geolocation of users indicates that users who are geographically close together are more likely to share the same URL.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"60 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133588978","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Brett Stone-Gross, Ryan Stevens, Apostolis Zarras, R. Kemmerer, Christopher Krügel, G. Vigna
{"title":"Understanding fraudulent activities in online ad exchanges","authors":"Brett Stone-Gross, Ryan Stevens, Apostolis Zarras, R. Kemmerer, Christopher Krügel, G. Vigna","doi":"10.1145/2068816.2068843","DOIUrl":"https://doi.org/10.1145/2068816.2068843","url":null,"abstract":"Online advertisements (ads) provide a powerful mechanism for advertisers to effectively target Web users. Ads can be customized based on a user's browsing behavior, geographic location, and personal interests. There is currently a multi-billion dollar market for online advertising, which generates the primary revenue for some of the most popular websites on the Internet. In order to meet the immense market demand, and to manage the complex relationships between advertisers and publishers (i.e., the websites hosting the ads), marketplaces known as \"ad exchanges\" are employed. These exchanges allow publishers (sellers of ad space) and advertisers(buyers of this ad space) to dynamically broker traffic through ad networks to efficiently maximize profits for all parties. Unfortunately, the complexities of these systems invite a considerable amount of abuse from cybercriminals, who profit at the expense of the advertisers.\u0000 In this paper, we present a detailed view of how one of the largest ad exchanges operates and the associated security issues from the vantage point of a member ad network. More specifically, we analyzed a dataset containing transactions for ingress and egress ad traffic from this ad network. In addition, we examined information collected from a command-and-control server used to operate a botnet that is leveraged to perpetrate ad fraud against the same ad exchange.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"58 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"128975586","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Mohammad Al-Fares, Khaled Elmeleegy, B. Reed, Igor Gashinsky
{"title":"Overclocking the Yahoo!: CDN for faster web page loads","authors":"Mohammad Al-Fares, Khaled Elmeleegy, B. Reed, Igor Gashinsky","doi":"10.1145/2068816.2068869","DOIUrl":"https://doi.org/10.1145/2068816.2068869","url":null,"abstract":"Fast-loading web pages are key for a positive user experience. Unfortunately, a large number of users suffer from page load times of many seconds, especially for pages with many embedded objects. Most of this time is spent fetching the page and its objects over the Internet.\u0000 This paper investigates the impact of optimizations that improve the delivery of content from edge servers at the Yahoo! Content Delivery Network (CDN) to the end users. To this end, we analyze packet traces of 12.3M TCP connections originating from users across the world and terminating at the Yahoo! CDN. Using these traces, we characterize key user-connection metrics at the network, transport, and the application layers. We observe high Round Trip Times (RTTs) and inflated number of round trips per page download (RTT multipliers). Due to inefficiencies in TCP's slow start and the HTTP protocol, we found several opportunities to reduce the RTT multiplier, e.g. increasing TCP's Initial Congestion Window (ICW), using TCP Appropriate Byte Counting (ABC), and using HTTP pipelining.\u0000 Using live workloads, we experimentally study the micro effects of these optimizations on network connectivity, e.g. packet loss rate. To evaluate the macro effects of these optimizations on the overall page load time, we use realistic synthetic workloads in a closed laboratory environment. We find that compounding HTTP pipelining with increasing the ICW size can lead to reduction in page load times by up to 80%. We also find that no one configuration fits all users, e.g. increasing the TCP ICW to a certain size may help some users while hurting others.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"42 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"123281292","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
A. Finamore, M. Mellia, M. Munafò, R. Torres, Sanjay G. Rao
{"title":"YouTube everywhere: impact of device and infrastructure synergies on user experience","authors":"A. Finamore, M. Mellia, M. Munafò, R. Torres, Sanjay G. Rao","doi":"10.1145/2068816.2068849","DOIUrl":"https://doi.org/10.1145/2068816.2068849","url":null,"abstract":"In this paper we present a complete measurement study that compares YouTube traffic generated by mobile devices (smart-phones,tablets) with traffic generated by common PCs (desktops, notebooks, netbooks). We investigate the users' behavior and correlate it with the system performance. Our measurements are performed using unique data sets which are collected from vantage points in nation-wide ISPs and University campuses from two countries in Europe and the U.S.\u0000 Our results show that the user access patterns are similar across a wide range of user locations, access technologies and user devices. Users stick with default player configurations, e.g., not changing video resolution or rarely enabling full screen playback. Furthermore it is very common that users abort video playback, with 60% of videos watched for no more than 20% of their duration.\u0000 We show that the YouTube system is highly optimized for PC access and leverages aggressive buffering policies to guarantee excellent video playback. This however causes 25%-39% of data to be unnecessarily transferred, since users abort the playback very early. This waste of data transferred is even higher when mobile devices are considered. The limited storage offered by those devices makes the video download more complicated and overall less efficient, so that clients typically download more data than the actual video size. Overall, this result calls for better system optimization for both, PC and mobile accesses.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"131356908","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
Hyojoon Kim, Theophilus A. Benson, Aditya Akella, N. Feamster
{"title":"The evolution of network configuration: a tale of two campuses","authors":"Hyojoon Kim, Theophilus A. Benson, Aditya Akella, N. Feamster","doi":"10.1145/2068816.2068863","DOIUrl":"https://doi.org/10.1145/2068816.2068863","url":null,"abstract":"Studying network configuration evolution can improve our understanding of the evolving complexity of networks and can be helpful in making network configuration less error-prone. Unfortunately, the nature of changes that operators make to network configuration is poorly understood. Towards improving our understanding, we examine and analyze five years of router, switch, and firewall configurations from two large campus networks using the logs from version control systems used to store the configurations. We study how network configuration is distributed across different network operations tasks and how the configuration for each task evolves over time, for different types of devices and for different locations in the network. To understand the trends of how configuration evolves over time, we study the extent to which configuration for various tasks are added, modified, or deleted. We also study whether certain devices experience configuration changes more frequently than others, as well as whether configuration changes tend to focus on specific portions of the configuration (or on specific tasks). We also investigate when network operators make configuration changes of various types. Our results concerning configuration changes can help the designers of configuration languages understand which aspects of configuration might be more automated or tested more rigorously and may ultimately help improve configuration languages.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"31 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"133956072","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Evaluation of data communication opportunities from oil field locations at remote areas","authors":"Yang-Jie Chen, J. O. Berg, M. Ammar, E. Zegura","doi":"10.1145/2068816.2068828","DOIUrl":"https://doi.org/10.1145/2068816.2068828","url":null,"abstract":"Cellular data links are an effective outdoor Internet access solution in urban environments. In this paper, we evaluate cellular data service as a potential data communication solution for oil field crews operating at remote areas in the United States. In our study, we first record the performance of cellular data service at twelve oil field locations. Measurement results show extensive availability of cellular service at those locations making it potentially a data communication solution at field locations. Spatial diversity from multiple antennas is shown to improve the cellular data link's speed but quality of the link varies significantly due to attenuated/faded cellular signal. We then design a measurement framework and deploy measurement units to five oil field crews and carry out a side-by-side comparison of two different satellite links and cellular links from two service providers. Analysis of data sets consisting of more than 300 days' measurement shows that the cellular link has comparable or even higher availability than conventional satellite link at many field operations. However, the quality of its coverage is location dependent. This indicates that both cellular and satellite links should be used to provide highly available and cost-effective data communication for such operations.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"1 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"130256130","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}
{"title":"Towards understanding modern web traffic","authors":"Sunghwan Ihm, Vivek S. Pai","doi":"10.1145/2068816.2068845","DOIUrl":"https://doi.org/10.1145/2068816.2068845","url":null,"abstract":"As Web sites move from relatively static displays of simple pages to rich media applications with heavy client-side interaction, the nature of the resulting Web traffic changes as well. Understanding this change is necessary in order to improve response time, evaluate caching effectiveness, and design intermediary systems, such as firewalls, security analyzers, and reporting/management systems. Unfortunately, we have little understanding of the underlying nature of today's Web traffic.\u0000 In this paper, we analyze five years (2006-2010) of real Web traffic from a globally-distributed proxy system, which captures the browsing behavior of over 70,000 daily users from 187 countries. Using this data set, we examine major changes in Web traffic characteristics that occurred during this period. We also present a new Web page analysis algorithm that is better suited for modern Web page interactions by grouping requests into streams and exploiting the structure of the pages. Using this algorithm, we analyze various aspects of page-level changes, and characterize modern Web pages. Finally, we investigate the redundancy of this traffic, using both traditional object-level caching as well as content-based approaches.","PeriodicalId":287661,"journal":{"name":"ACM/SIGCOMM Internet Measurement Conference","volume":"69 1","pages":"0"},"PeriodicalIF":0.0,"publicationDate":"2011-11-02","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"116406448","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}