Encrypted traffic has been known to be vulnerable to traffic analysis attacks that exploit the statistical features of encrypted traffic flows, such as packet sizes, timing, and direction, to infer information about the underlying content, which undermines the privacy guarantees of end-to-end encryption. While state-of-the-art attacks leverage deep learning models to achieve high accuracy, most attacks work under the less realistic closed-set assumption. Deploying such attacks in practice requires addressing the open-set scenario, which allows the models to filter out target content from other background traffic. Concurrently, Large Language Models (LLM) are increasingly gaining traction due to their ability to adapt to diverse tasks in domains outside NLP, especially in applications with sequential data. Inspired by this, our work introduces TrafficGPT, a novel traffic analysis attack that leverages GPT-2, a popular LLM, to enhance feature extraction, thereby improving the open-set performance of downstream classification. We use five existing encrypted traffic datasets to show how the feature extraction by GPT-2 improves the open-set performance of traffic analysis attacks compared to ET-BERT and CNN-based approaches by 12.7% and 13.7%, respectively.
eBPF and XDP are promising technologies that are capable of accelerating packet processing inside the Linux kernel. Despite these benefits, eBPF is constrained by a number of rigorous restrictions that are imposed to protect the kernel. One such restriction is the lack of support for floating-point values, which was introduced to achieve faster execution and avoid non-deterministic behavior. However, this has become a significant obstacle to expanding the functionality of eBPF programs with advanced algorithms. In this paper, we propose dynamic fixed-point as a solution to overcome this challenge within the restrictions of eBPF. Dynamic fixed-point values are an expansion from traditional fixed-point values, with the bit allocation adjusted dynamically. Benefit of dynamic fixed-point is that the accuracy of calculations are improved, which is one of the critical shortcomings of fixed-point. To demonstrate the effectiveness of our approach, we have designed and implemented a prototype of an entropy-based traffic anomaly detection framework and have reported on its throughput and the detection accuracy. Our prototype, which employs dynamic fixed-point, has achieved an 18% improvement in throughput while also matching the detection accuracy of a similar system that employs floating-point values in user space.
As the number of Internet users continues to increase, there is an urgent need to train Internet engineers to support this infrastructure. Our research team is designing and managing an educational program to foster Internet engineers for undergraduate students in the Asia-Pacific (APAC) region. As part of the program, we are conducting on-site hands-on exercises to create a computer network with remote locations using Research and Education Networks (RENs). Since these onsite hands-on exercises will be conducted in various places in the APAC region, delays caused by physical distance are unavoidable. Therefore, our team has designed a low response time hands-on exercise environment to ensure comfortable student activities. Furthermore, to verify the effectiveness of this design, we conducted a simulation verification using a virtual environment. We confirmed that the design provides a low response time, even considering the unavoidable latency over distances in the APAC region.
Deploying Internet-of-Things (IoT) assets, such as cameras, printers, and building sensors, at scale introduces operational and cyber risks to organizations. While public repositories such as the National Vulnerability Database (NVD) or Exploit-DB provide valuable data on known cyber risks, each comes with its specific query format, and their knowledge is often fragmented, lacking a comprehensive perspective. Organizations often require the capability to assess current vulnerabilities and forecast future risks from distributed and nonunified sources. This paper aims to empower digital infrastructure teams to obtain a complete view of IoT cyber risks. First, we map public repositories for digital product vulnerabilities, exploits, and patches (solutions). This includes highlighting their interrelationships and the information they offer. Second, we develop a data schema to detail cyber risks associated with specific products, like equipment, operating systems, or applications. We build “vesData", a tool that takes a product name as input and automatically produces a machine-processable data structure of its risk knowledge. We apply our tool to obtain public risk data of about 20 consumer IoT products in our lab—our tool and data will be released openly. Third, we demonstrate a preliminary use case of our structured IoT risk data, which predicts new vulnerabilities, patches, and exploits for existing ones.
Generally, a network administrator designs, constructs, and operates an enterprise network. Since inconsistency between the network design understood by the administrator and the actual network configuration might arise due to mistakes or errors, a method for automatically detecting such inconsistency is needed. The following four techniques are necessary for this purpose. (i) A machine-readable notation to represent the network configuration. (ii) A tool to write down the network design using the machine-readable notation. (iii) A tool to automatically detect the current network configuration and write it down in the machine-readable notation. (iv) A tool to compare the two outputs generated in (ii) and (iii). This paper employs the network ontology called Bonsai for (i). Bonsai can represent not only physical configurations but also virtualization technologies such as VLAN and overlay. This paper proposes three tools, nc-design, nc-detect, and nc-diff for (ii)-(iv), and confirms that they work as expected in the test network. This paper also measures their fundamental performance.
Federated Learning (FL) is a distributed machine learning platform enabling multiple entities to train an AI model with their local data collaboratively. In an edge-cloud environment, FL can be deployed in edge devices, which are closer to the data sources so that it can ensure privacy, and reduce latency and the processing load of the cloud. Besides these advantages, the deployment of FL in edge-cloud faces some challenges due to the heterogeneous nature of the edge-cloud environments. This paper discusses the impact of the heterogeneity of the edge on the performance of FL algorithms. By making use of a real, distributed Intrusion Detection System (IDS) for Domain Generation Algorithm (DGA) malware detection as a case study, the paper shows that the characteristics of data collected from different edge locations as well as the capabilities of heterogeneous edge devices have a great impact on the performance of FL algorithms. The paper discusses some factors in the aforementioned heterogeneous edge environment that affect the system performance. The results of the paper can be used as the basis for the development of novel, more efficient FL algorithms that can prioritize and select FL clients based on their characteristics.
Generative AI platforms backed by large-language models (LLMs) are taking the world by storm. Starting with ChatGPT launched a mere 18 months ago that can generate amazingly human-like text responses to prompts, there are now platforms that can generate code (GitHub Copilot), images (Dall-E), and even video clips (Sora). In this fast evolving world of GenAI, there is huge interest in the community in tracking the usage patterns of these platforms, as well as performance in terms of responsiveness and network load. Our paper is the first attempt to track usage of emerging GenAI platforms via real-time analysis of network traffic. This can be useful to enterprises seeking to know which GenAI services their employees use most; to Communications Service Providers wanting to know the network loads imposed; and to financial investors needing a pulse on market trends. We begin by explaining the network anatomy of ChatGPT prompt/response interactions in detail, and extend it to six other GenAI platforms supporting text, code, and image generation. We then develop a measurement method to identify and quantify GenAI interactions via real-time analysis of network traffic. We deploy our monitoring system in a University campus over a 5-month period, and reveal interesting insights such as GenAI usage distribution across days of the week and deviations during assessment periods; variation in prompt-to-response-size ratios across the various GenAI platforms; and differences in response times arising from model versions.
Six major submarine cable faults have severely disrupted business operations and public services in Pakistan in 2022. This is the largest number of network outages in a single year in the telecom history of the country, which routinely faces such blackouts. Using the example of Pakistan’s Internet infrastructure, which is a typical example of a network overtly dependent on international bandwidth, we examine the relationship between resilient network services and various constraints imposed by technology, economics, and geopolitics. Through a combination of network mapping based on aggregated BGP data and face-to-face interviews with a variety of stakeholders, we identify key vulnerabilities in Pakistan’s connectivity architecture and uncover the rationale behind connectivity decisions made by local Internet service providers (ISPs). We find that the lack of resilience of Pakistan’s Internet is the result of power relations and friction between ISPs, international content providers (content delivery platforms), and state institutions. We also emphasize the geopolitical underpinnings of Pakistan’s Internet connectivity and resilience.
"Rootless containers" is a concept that runs the entire container runtimes and containers without the root privileges. It protects the host from attackers exploiting container runtime vulnerabilities. However, when rootless containers communicate with external endpoints, the network performance is low compared to rootful containers. The performance degradation prevents users from utilizing rootless containers. In this paper, we propose bypass4netns that accelerates TCP/IP communications in rootless containers by bypassing slow network components. It switches sockets in containers to the host's sockets by intercepting syscalls and changing targets of file descriptors using Seccomp Notify. Our method with Seccomp Notify can handle statically linked applications that previous works cannot. We also propose high-performance rootless multi-node communication for rootless Kubernetes. bypass4netns achieved more than 30x faster throughput than without it and showed significant performance improvements on some applications. bypass4netns leverages secure container technology with higher communication performance without modifications to applications.
In this paper, to estimate the risk of economic loss incurred by both parties in production order transactions, we propose a scheme that enables escrow and confirmation of the results without relying on a third party. In such transactions, both parties risk incurring economic losses if the other party behaves dishonestly. Generally, the risk can be reduced with an escrow service provided by a trusted third party. However, there is a risk of fraud by the third party; in some cases, the third party may not be available for the buyer or seller. Several existing schemes utilize fair exchange and blockchain to disburse the deposited payment upon the delivery of specific data. However, in production order transactions, some cases cannot be handled only by completion of delivery, such as disputes that arise when the data does not meet the quality expected by the buyer. In such cases, before the transaction starts, a party would confirm the counterparty’s behavior in past transactions to estimate the risk of a dispute occurring. In this paper, we propose a scheme that records the history of past transaction processes while utilizing blockchain-based escrow and allows future counterparties to confirm the history as a reference for estimating risk. By the opportunity loss that a history of dishonest behavior causes and applying blockchain-based escrow, the scheme motivates sellers and buyers to behave in good faith. We implemented a prototype system on top of Ethereum and verified its feasibility. By expanding the scope of transactions, we expect that it will be possible to determine whether transactions between individuals over the Internet are feasible without relying on a specific escrow service.
Many network services are provided by third-party providers, e.g. name resolution, content hosting, certificate authorities. Dependence on these providers may lead to cascading failures, resulting in many websites becoming unavailable. To mitigate the failures, it is necessary to have a deep understanding of the current situation of third-party dependencies. In this paper, we analyze the web dependencies on third-party DNS, content delivery networks and certificate authorities. We focus on the discrepancies that might exist between China and the global footprint. Our results reveals that while both China’s and global websites rely on third-party providers heavily, popular websites in China prefer building private name resolution services and deploy CDNs more redundantly. Perhaps more importantly, CA verification in China is dominated by DigiCert and fewer China’s websites enable OCSP Stapling, making the HTTPs ecosystem in China extremely fragile.
Single Sign-On (SSO) enables users to access multiple websites and applications using a single set of login credentials. Undoubtedly, SSO makes it easy for users to log in to multiple websites without remembering credentials. However, it is also important to consider the potential risk of users being unaware of how the identity of their account will be utilized, the development of online tracking techniques, and any potential exchange of information with third parties without the user’s knowledge. In this paper, we propose SSOLogin, which enables us to perform large-scale automation of website login through an SSO account. We confirm that SSOLogin automatically logins to 91.8% of SSO account available websites in Tranco Top 500 sites. Next, by crawling Tranco Top 10K websites with SSOLogin, we show that 1,420 sites (14.2%) contain SSO login (Google and Facebook) as of July 2023, primarily on Information Technology and News/Media websites in the United States and the United Kingdom. We then shed light on the characteristics of privacy leakage of websites with SSO logins by setting up measurements in Japan. We find that 99% of websites have third-party online tracking activities, which may pose risks to user privacy. After SSO login, the target website shows an increase in third-party tracking domains. Logging in with Google adds 81 new tracking domains, while Facebook adds 33 new domains. Despite the convenience of logging in with an SSO account, it is important to be aware of the potential privacy risks associated with this practice.
Vehicle teleoperation, a potential future service for connected vehicles, demands reliable and low-latency transmission of visual and auditory information to a remote operator. However, moving vehicles often encounter unstable communication environments, potentially compromising teleoperation. Multi-path communication technologies, which utilize multiple network links and enhance connectivity, can be pivotal enablers. To identify the optimal multi-path solution, a comprehensive evaluation across diverse scenarios is essential. In this research, we assessed network performance using multi-path UDP (MPUDP), MPQUIC, and MPTCP in scenarios emulating a teleoperated vehicle transmitting video via two mobile networks. We set a variety of metrics, latency, packet loss rate, and bandwidth limitations, for each link and observed their effect on multi-path transport implementation. Our metrics revealed varying benefits and trade-offs for each. MPUDP had predictable latency bounds while not fully mitigating packet loss. MPQUIC and MPTCP achieved packet loss elimination and bandwidth aggregation but added significant latency. In the static metric environment we tested, MPQUIC based implementation was deemed the most suitable for our use-case.
To secure all communications, Named Data Networking (NDN) requires that each entity joining an NDN network go through a bootstrapping process first, to obtain its initial security credentials. Several solutions have been developed to bootstrap IoT devices in localized environments, where the devices being bootstrapped are within the physical reach of their bootstrapper. However, distributed applications need to bootstrap remote users and devices into an NDN-based system over insecure Internet connectivity. In this work, we take Hydra, a federated distributed file storage system made of servers contributed by multiple participating organizations, as a use case to drive the design and development of a remote bootstrapping solution, dubbed Cornerstone. We describe the design of Cornerstone, evaluate its effectiveness, and discuss the lessons learned from this process.
Latency is a major issue towards practical use of augmented reality (AR) in mobile apps such as navigation and gaming. A string of work has appeared recently, proposing to offload a part of the AR-related processing pipeline to the edge [8]. One pitfall in these studies is the (simplified) assumption about the traffic demand and its implication to the network delay. As a reality check and to gather insights to deliver and render AR content in real time, we seek in this work a better understanding of how a popular AR game, Pokémon Go, delivers its data in situ.
With the increasing adoption of Internet of Things (IoT), research into anomaly detection (AD) in IoT network traffic is gaining importance. Malicious disturbances (e.g. malware and cyber attacks) and operational issues (e.g. software/sensor failures and physical damage) can seriously disrupt network operations. These problems can be detected with traffic monitoring and responded to with mitigation systems. In recent years, machine learning (ML) models have been successfully applied for AD, with state-of-the-art solutions reaching detection rates of . However, the heterogeneity of devices and anomalies in IoT networks poses a challenge for existing solutions. High AD accuracy is usually limited to the types of anomalies present in the training data, falling off significantly in the face of new anomalies. Many IoT-AD solutions are additionally limited to certain types of devices or require additional hardware setup. To tackle these challenges, we present SIURU, a flexible framework for AD research and development capable of applying various feature extraction and ML algorithms. SIURU’s intended deployment environment is broker-based publish-subscribe IoT systems, posing no additional constraints on the IoT device capabilities or network setup. SIURU supports the creation of custom pipelines with data loading, preprocessing, and encoding components, followed by training and testing of ML-based AD models and reporting of prediction results. To validate our proposed framework, we implement the architecture and evaluate its runtime performance. Finally, we demonstrate the effectiveness of the proposed architecture by a case example that tests the performance of eXplainable Artificial Intelligence (XAI) algorithms with multiple ADs and datasets.
Twitch is a live video service that is a leader in game streaming with 20 billion annual viewing hours and an annual viewer growth rate of +26%. To sustain this load and growth rate, Twitch maintains a content distribution network (CDN) to ensure high service quality and to distribute load. Its CDN is a critical online infrastructure that should be better understood. To supplement recent works attempting to measure Twitch’s CDN that crawled few active channels (~2%) and focused on mapping the CDN, we aimed to (1) scan the channels as complete as possible, which we refer to as a best-effort scan and (2) infer the server allocation scheme behind. To contain the crawling traffic, we scope the scan within Europe. We observed 1045 servers in 24 server clusters which are located in 17 cities across 13 countries in Europe. We found that Twitch’s server allocation scheme has two phases: In the first phase, a viewer’s location (i.e., a vantage point or VP) is determined from their IP prefix and a pool of nearby server cluster(s) is selected. In the second phase, when a new channel is requested, a server cluster is selected and a server in the cluster is randomly selected to handle the load.
This paper proposes an autonomous network management system based on closed-loop control to deal with network failures and congestion. The proposed system is realized by collaboration of Weaver, an automated system configuration designer based on Intent-based Networking, and KANVAS (Knowledge base system in wide Area Networks with Versatility, Availability, and Scalability), a framework for collecting and utilizing network information. In the proposed system, the KANVAS system collects and analyzes network conditions, and the Weaver system plans and executes countermeasures against a failure event based on the analysis results. This paper shows two case studies. In the first case study, the proposed system can automatically recover from a service failure caused by a node failure in approximately 8.5 minutes. In the second case study, the proposed system can reroute VPN due to congestion in the underlay network in approximately 35 seconds. These results show that the proposed system can automatically recover service networks from a failure and congestion that occur on the underlay network in shorter time than that required for manual recovery.
To leverage the potential of LoRaWAN, we have successfully developed a real-world field wireless sensor network dedicated to monitoring forest fires and air quality. This network operates across remote forested regions and semi-urban areas. The development effort encompasses the complete LoRaWAN network stack, including a tailored circuit board designed for LoRa communication and multi-sensor nodes, the establishment of network infrastructure, and a cloud-based data collection platform that strictly adheres to the LoRaWAN standard. In this context, we have introduced a retransmission mechanism in the LoRaWAN application layer for sensor data completeness, along with lorawanatd which operates the LoRaWAN hardware. This extension serves to enhance communication robustness between end nodes and the network cloud, ensuring a seamless and reliable data transmission. Our initiative also involved a comprehensive series of experiments, conducted using sensor nodes situated in proximity to forest fire-prone areas. These experiments were conducted to delve into optimal configurations and constraints related to radio wave propagation. Key performance metrics guiding these investigations include the Received Signal Strength Indicator (RSSI), Signal to Noise Ratio (SNR), Packet Delivery Ratio (PDR), and Data Completeness Ratio (DCR).
Wireless Sensor Networks (WSNs) are continuously used in different fields of application. As data transmission increases, it becomes necessary to suggest methods for enhancing energy efficiency, reducing data latency, and alleviating network congestion. Data Aggregation is an approach to enhance network lifetime and reduce data latency when data is transmitted across the network. Data gathered in WSNs must be aggregated properly and arrive in time at the gateway, as these are usually deployed to collect real-time data. Although different protocols have been developed to improve data aggregation, few have only been implemented in real-time WSNs. This study proposes a two-level cluster-based data aggregation protocol for real-time WSN clusters. The proposed data aggregation protocol is implemented in a testbed scenario to explore its feasibility and was evaluated using metrics that cover power consumption, packet transmissions between the sensor nodes and cluster head, percent of aggregation, total data points, and the resources identified for the protocol to operate properly. Overall, based on the test scenarios implemented, the protocol can significantly lessen the amount of data points to be sent to the sink wherein a minimum of 50% of the data points can be aggregated for accelerometer data while 40% for temperature data. Additionally, the aggregation protocol was able to retain a minimum of 33% of the original accelerometer data and a minimum of 51% of the temperature data.
