On the relationship between file sizes, transport protocols, and self-similar network traffic
Measurements of LAN and WAN traffic show that network traffic exhibits variability on different scales. We examine a mechanism that gives rise to self-similar network traffic and discuss performance. The mechanism we study is the transfer of files or messages whose size is drawn from a heavy-tailed distribution. In a realistic client/server network the degree to which file sizes are heavy-tailed can directly determine the degree of traffic self-similarity at the link level. This causal relationship is robust relative to changes in network resources, network topology, the influence of cross-traffic, and the distribution of interarrival times. Properties of the transport layer play an important role in preserving and modulating this relationship. The reliable transmission and flow control mechanisms of TCP serve to maintain the long-range dependency structure induced by heavy-tailed file size distributions. In contrast, if a non-flow-controlled and unreliable (UDP-based) transport protocol is used, the resulting traffic shows little self-similarity: although still bursty at short time scales, it has little long-range dependence. Performance implications of self-similarity are discussed as represented by various performance measures. Increased self-similarity as expected, results in degradation of performance. Queueing delay, in particular is discussed. Throughput-related measures such as packet loss and retransmission rate, however increase only gradually with increasing traffic self-similarity as long as reliable, flow-controlled transport protocol is used.

title: A Comparative Study of Genetic Search
abstract: We present a comparative study of genetic algorithms and their search properties when treated as a combinatorial optimization technique. This is done in the context of the NP-hard problem MAX-SAT, the comparison being relative to the Metropolis process, and by extension, simulated annealing. Our contribution is twofold. First, we show that for large and diicult MAX-SAT instances, the contribution of cross-over to the search process is marginal. Little is lost if it is dispensed altogether, running mutation and selection as an enlarged Metropolis process. Second, we show that for these problem instances , genetic search consistently performs worse than simulated annealing when subject to similar resource bounds. The correspondence between the two algorithms is made more precise via a decomposition argument, and provides a framework for interpreting our results.

title: On the effectiveness of route-based packet filtering for distributed DoS attack prevention in power-law internets
abstract: Denial of service (DoS) attack on the Internet has become a pressing problem. In this paper, we describe and evaluate route-based distributed packet filtering (DPF), a novel approach to distributed DoS (DDoS) attack prevention. We show that DPF achieves proactiveness and scalability, and we show that there is an intimate relationship between the effectiveness of DPF at mitigating DDoS attack and power-law network topology.The salient features of this work are two-fold. First, we show that DPF is able to proactively filter out a significant fraction of spoofed packet flows and prevent attack packets from reaching their targets in the first place. The IP flows that cannot be proactively curtailed are extremely sparse so that their origin can be localized---i.e., IP traceback---to within a small, constant number of candidate sites. We show that the two proactive and reactive performance effects can be achieved by implementing route-based filtering on less than 20% of Internet autonomous system (AS) sites. Second, we show that the two complementary performance measures are dependent on the properties of the underlying AS graph. In particular, we show that the power-law structure of Internet AS topology leads to connectivity properties which are crucial in facilitating the observed performance effects.

title: Stochastic analysis of packet-pair probing for network bandwidth estimation
abstract: In this paper, we perform a stochastic analysis of the packet-pair technique, which is a widely used method for estimating the network bandwidth in an end-to-end manner. There has been no explicit delay model of the packet-pair technique primarily because the stochastic behavior of a packet pair has not been fully understood. Our analysis is based on a novel insight that the transient analysis of the G/D/1 system can accurately describe the behavior of a packet pair, providing an explicit stochastic model. We first investigate a single-hop case and derive an analytical relationship between the input and the output probing gaps of a packet pair. Using this single-hop model, we provide a multi-hop model under an assumption of a single tight link. Our model shows the following two important features of the packet-pair technique: (i) The difference between the proposed model and the previous fluid model becomes significant when the input probing gap is around the characteristic value.  We give a discussion on recent packet-pair models in relation to the proposed model and show that most of them can be regarded as special cases of the proposed model.

title: Multiple Time Scale Congestion Control for Self-Similar Network Traffic
abstract: Analytical and empirical studies have shown that self-similar traffic can have a detrimental impact on network performance including amplified queuing delay and packet loss rate. Given the ubiquity of scale-invariant burstiness observed across diverse networking contexts, finding effective traffic control algorithms capable of detecting and managing self-similar traffic has become an important problem. In this paper, we study congestion control algorithms for improving network performance — in particular, throughput — under self-similar traffic conditions. Although scale-invariant burstiness implies the existence of concentrated periods of contention and idleness, the long-range dependence associated with self-similar traffic leaves open the possibility that correlation structure at larger time scales may be exploited for performance enhancement purposes. We construct a 2-level multiple time scale congestion control protocol that exercises congestion control concurrently across two time scales an order of magnitude apart. The first component — acting at the smaller time scale — is a generic linear increase/exponential decrease feedback congestion control that uses implicit prediction afforded by feedback to affect rate control sensitive to changes in network state at 20–200 ms time scales. The second component — acting at 2–5 s time scales — uses explicit prediction to detect persistent shifts in overall network contention and uses this information to modulate the aggressiveness exhibited by the first component. We show that cooperative interaction between the two congestion control modules acting on information at different time scales leads to improved performance vis-a-vis the case when the large time scale component is absent. We show that the improvement factor increases with long-range dependence and we show that as the number of flows engaging in multiple time scale congestion control (MTSC) increases, both fairness and efficiency are preserved.

title: Securing Web Service by Automatic Robot Detection
abstract: Web sites are routinely visited by automated agents known as Web robots, that perform acts ranging from the beneficial, such as indexing for search engines, to the malicious, such as searching for vulnerabilities, attempting to crack passwords, or spamming bulletin boards. Previous work to identify malicious robots has relied on ad-hoc signature matching and has been performed on a per-site basis. As Web robots evolve and diversify, these techniques have not been scaling. 
 
We approach the problem as a special form of the Turing test and defend the system by inferring if the traffic source is human or robot. By extracting the implicit patterns of human Web browsing, we develop simple yet effective algorithms to detect human users. Our experiments with the CoDeeN content distribution network show that 95% of human users are detected within the first 57 requests, and 80% can be identified in only 20 requests, with a maximum false positive rate of 2.4%. In the time that this system has been deployed on CoDeeN, robot-related abuse complaints have dropped by a factor of 10.

title: QoS-sensitive transport of real-time MPEG video using adaptive redundancy control
abstract: This paper presents an adaptive end-to-end protocol for quality of service (QoS)-sensitive transport of real-time MPEG video using packet-level forward error correction in dynamic networks. The objective is to facilitate a user-specified QoS end-to-end - i.e. without special network support - for real-time MPEG video whose timing constraints rule out the use of retransmission-based congestion control and QoS provisioning schemes. The degree of redundancy - overcode in forward error correction - injected into the network is adjusted as a function of network state, decreasing when the network is well-behaved to minimize unnecessary network resource consumption, and increasing when it is not to compensate for adverse network effects so as to maintain an invariant level of end-to-end QoS. We describe an adaptive packet-level forward error correction protocol called AFEC and analyze its properties with respect to optimality and stability. The optimal control problem is nontrivial due to the fact that increased redundancy, beyond a certain point, can backfire resulting in self-induced congestion which impedes the timely recovery of information - MPEG video frames - at the receiver. We experimentally evaluate the efficacy of our end-to-end QoS control by implementing and customizing AFEC to the transport of real-time MPEG video. We realize the system as a transport/application layer protocol running on UNIX workstations, and measure its performance over controlled network environments. We show that AFEC is able to effectively hide potentially adverse network effects such as packet drops and delays stemming from traffic burstiness and nonstationary structural changes using adaptive redundancy control, exporting a constant QoS service commensurate with user-specified QoS.

title: Analysis and design of the virtual rate control algorithm for stabilizing queues in TCP networks
abstract: The virtual rate control (VRC) algorithm has been proposed for active queue management (AQM) in TCP networks. VRC, a rate-based control mechanism, responds quickly to traffic changes, thus allowing for high utilization and small loss. It can effectively stabilize both the input rate and the queue length around their target levels. In this paper, we analyze the stability of the VRC algorithm based on a linearized TCP model with time delay and provide a design guideline for parameter setting to make the overall system stable. Finally, we confirm the validity of our analysis and the effectiveness of VRC compared to RED, PI, REM, and AVQ through extensive ns-2 simulations.