The purpose of the IT Service Portfolio Management (SPM) process is it to align an organization’s service offering with its IT strategy. It is an integral part of every Service Management System (SMS) and mandated in some way by each IT Service Management (ITSM) framework, but has been less formally researched than more operations-oriented and structured processes like Incident Management. ITSM frameworks often contain quite extensive guidance on particular processes like SPM, which can make them hard to efficiently implement, especially for small and medium-sized organizations. Furthermore, when trying to choose which recommendations to apply for one’s organization, telling the commonalities and differences of the various frameworks is anything but easy due to a lack of formalization. This publication presents a model-based approach to compare ITSM frameworks, to distinguish between the most essential and less essential elements of their process guidance and applies this approach exemplary to the guidance for Service Portfolio Management by ITIL, ISO/IEC 20000, MOF and FitSM.
The automation of system management has been expanding, and there has been interest lately in an automated workflow generation that automatically generates the workflows of system updates. However, because these automation technologies operate under the assumption that systems work in accordance with their underlying system model, they are not good at handling unexpected behaviors of target systems.In this paper, we propose a way to incorporate unexpected handling into our declarative system update mechanism by automatically generating a "recovery workflow" to roll back a target system in the event of abnormal system stops. We evaluate our tool through a practical three-tier architecture system operating a simple Web service, and found that our method can complete generation of a recovery workflow in one second, and roll back the system from all system states.
Untrusted network clients can undergo a classification process before they are allowed to use more of a service's resources, and services typically rely on a table to remember the clients' classification. But as the number of clients increases so does the amount of state required to remember this classification over time.In this paper we explore the trade-off between data-structure accuracy and network size when needing to remember client state. We present Hashtray-a hash table library that consists of a generic API and instantiations of various kinds of tables-and a system to evaluate and compare different data structures.We evaluate Hashtray in the context of Denial-of-Service mitigation using both a modelled network of 10 6 machines, and a testbed experiment with over 200 hosts connecting to a version of Apache modified to use Hashtray. The system is open-sourced to enable others to extend or build on this work.
We present the Re-configurable Ethernet Common Public Radio Interface (ReCPRI) protocol as a replacement of the existing Ethernet Common Public Radio Interface (eCPRI) standard. Using the same communication infrastructure, this protocol is shown to provide the same functionality as eCPRI, maintaining full backward compatibility, all while reducing the required data bit rate and increasing the ADC sample rate by 4.4x. This is achieved using hardware-based data pre-processing at the radio tower. This protocol also makes the backhaul network SDN compatible. ReCPRI is capable of modifying the data bit rate dynamically as usage changes, modifying the hardware infrastructure in real time, migrating towers dynamically between Base Band Units, dynamically adding new functionality, and modifying the baseline infrastructure. This is all accomplished in real time, without interrupting service, and all from the Base Band Unit's software layer.
Blockchain protocols are based on a distributed database where stored data is guaranteed to be immutable. The requirement that all nodes have to maintain their own local copy of the database ensures security while consensus mechanisms help deciding which data gets added to the database and keep powerful adversaries from derailing the system. However, since the database that forms the foundation of a blockchain is a continuously growing list of blocks, scalability is an inherent problem of this technology. Some public blockchains need a few 100 GB to Terabytes of storage. In this work, we present the concept Superlight with self-contained proofs, which is designed to improve scalability of a public blockchain, while preserving security and decentralization. Instead of all nodes having a local copy of the whole blockchain to verify a transaction, nodes can derive the validity of a transaction by only using block headers. To keep the block headers compact, BLS signatures are used to combine signatures. We provide a definition of SCPs and show the required steps of a client to create a proof that is accepted by other nodes for transferring funds. The advantage of such a light-client-only blockchain is the lower storage requirement, while the drawback is an increased computational complexity due to BLS signatures, limited use-cases due to lack of a global state, and the requirement for an interactive protocol between sender, receiver, and miner to create a transaction.
Large-scale failures in communication networks due to natural disasters or malicious attacks can severely affect critical communications and threaten lives of people in the affected area. In the absence of a proper communication infrastructure, rescue operation becomes extremely difficult. Progressive and timely network recovery is, therefore, a key to minimizing losses and facilitating rescue missions. To this end, we focus on network recovery assuming partial and uncertain knowledge of the failure locations. We proposed a progressive multi-stage recovery approach that uses the incomplete knowledge of failure to find a feasible recovery schedule. Next, we focused on failure recovery of multiple interconnected networks. In particular, we focused on the interaction between a power grid and a communication network. Then, we focused on network monitoring techniques that can be used for diagnosing the performance of individual links for localizing soft failures (e.g. highly congested links) in a communication network. We studied the optimal selection of the monitoring paths to balance identifiability and probing cost. Finally, we addressed, a minimum disruptive routing framework in software defined networks. Extensive experimental and simulation results show that our proposed recovery approaches have a lower disruption cost compared to the state-of-the-art while we can configure our choice of trade-off between the identifiability, execution time, the repair/probing cost, congestion and the demand loss.
Network flow monitoring has been a part of network security for the last dozen years. It is constantly evolving to keep pace with changes in network operation and innovative network attacks. The thesis contributes to the continuous efforts by exploring the possibilities unlocked by extending the flow data with application-specific information. We show how the construction of flows is affected by processing of application data, present the benefits to traffic analysis, and assess the inevitable performance loss caused by additional data processing. To compensate for the lost performance, several novel optimisation techniques are proposed for the flow monitoring process. Recognising that the increasing deployment of encryption is going to limit the benefits of application flow monitoring, we perform a survey of methods for measurement of encrypted traffic. The thesis is concluded by an outlook towards future possibilities for flow monitoring advancement.
Detection of network attacks is a challenging task, especially concerning detection coverage and timeliness. The defenders need to be able to detect advanced types of attacks and minimize the time gap between the attack detection and its mitigation. To meet these requirements, we present a stream-based IP flow data processing application for real-time attack detection using similarity search techniques. Our approach extends capabilities of traditional detection systems and allows to detect not only anomalies and attacks that match exactly to predefined patterns but also their variations. The approach is demonstrated on detection of SSH authentication attacks. We describe a process of patterns definition and illustrate their usage in a real-world deployment. We show that our approach provides sufficient performance of IP flow data processing for real-time detection while maintaining versatility and ability to detect network attacks that have not been recognized by traditional approaches.
The network flow monitoring has evolved to collect information beyond the network and transport layers, most importantly the application layer information. This information is used to improve network security and performance by enabling more precise performance analysis and intrusion detection. In this paper, we contribute to this effort by extending flow monitoring with information from the SSH protocol. Firstly, we analyze the SSH protocol to determine which information can be obtained from the connection establishment phase. Based on the analysis, we create an extension to our flow monitoring infrastructure that allows obtaining the selected information. Lastly, we analyze the SSH connections observed in the university campus network and discuss the benefits of performing the detailed SSH protocol analysis. We argue that with a precise recognition of login attempt results it is possible to improve the detection of successful bruteforce password attacks. Moreover, we publish an anonymized version of our dataset including the SSH specific information.
The research developed during my PhD [1] was driven by the need to understand how people interact with the web. This information gives ISPs and network managers better visibility and understanding of how users and web services change over time. Thanks to traces and logs of users’ traffic, my work focuses on two complementary aspects: (i) data analytics, and (ii) user modelling.In this work, I show how to reconstruct users’ online activity from passive measurements and to model their behaviour. I introduce machine learning approaches to identify the intentionally visited web-pages and web-sites. I highlight device usage evolution, the structure of the navigation and the interactions with social networks and search engines. I build users’ profiles and then I show how to re-identify users in a future time thanks to their behavioural fingerprints. This is also instrumental for security applications. I next study the interaction with online ads, capturing the impact of the temporal dynamics of shown advertisement and improving revenues.I make available all the anonymized datasets and code for the community, to guarantee results reproducibility and foster further analyses.
Modern advances in virtualization technologies have revolutionized how we build and manage computer systems. Virtualization technologies, however, adversely impact the predictability of system performance, which introduces several challenges in balancing performance and resource utilization.In this dissertation, we explore and address performance challenges by characterizing and modeling application performance for resource allocation in two application scenarios: distributed network emulation and network functions virtualization (NFV). More specifically, we focus on preserving experiment fidelity for distributed network emulators running on heterogeneous physical machines, while, in NFV, we characterize performance impacts of various virtualization and configuration options and make timely resource flexing decisions.
IO virtualization is a key technology that enables SDN and NFV applications. There are two mainstream IO virtualization technologies that are used to implement a virtualized network device: VIRTIO and SR-IOV. The VIRTIO technology is a software virtualization technology that renders efficient IO virtualization based upon paravirtualization. In contrast, SR-IOV is a hardware assisted device virtualization that requires support from both the platform and IO devices. Although the packet processing throughput of a virtualized network device leveraging SR-IOV technology outperforms a device leveraging VIRTIO technology, there remains a lack of standardization amongst NIC device vendors with respect to the management of SR-IOV devices. The adoption of SR-IOV technology tends to be limited in embedded environments where ad hoc management routines are typically used. In this paper, we introduce the concept of an SR-IOV hypervisor to depict a trust management interface that can be used to manage SR-IOV devices over enterprise scale infrastructures such as the cloud. In addition, we present implementations of this new management interface through both user-space drivers (DPDK) and kernel-space drivers. Furthermore, for our user-space driver approach, we develop an innovative framework so that users can leverage existing legacy tools to manage SR-IOV devices. We demonstrate how an SR-IOV hypervisor can be deployed into a cloud environment, often containing a myriad of network devices and dynamic VM configurations, which can then be controlled via the management interface.
The volume of traffic generated by modern Distributed Denial-of-Service (DDoS) attacks suggests that centralized defenses are not the most effective approach to counter these attacks. An alternative to reduce the burden of detection and mitigation is to combine centralized defense systems, creating a global and cooperative protection system. However, existing approaches suffer from the complexity of deployment and operation across different systems. Blockchains appear in this scenario as an alternative to simplify the exchange of information in a cooperative defense. This work evaluates in both local and global experimentations the performance of the blockchain system proposed in [8] concerning the latency to perform the signaling of blacklisted addresses.
Quality of Service provisioning in today’s overlay networks includes computing routes that simultaneously guarantee multiple QoS metrics like bandwidth, delay, jitter, and packet-loss rate. Lagrange relaxation-based aggregated cost (LARAC) algorithm is among the best centralized algorithms for finding a near optimal solution to the constrained shortest path (CSP) problem for the additive metrics. To take advantage of the LARAC algorithm, we transform the non-linear QoS routing problem into a linear integer programming problem by converting all constraints to additive. We then develop a multi-constrained version of the LARAC algorithm and use sub-gradient optimization to converge to a near optimal solution. As LARAC algorithm needs to solve the routing optimization problem separately for every source and destination pair, this significantly increases the total time complexity. We, therefore, modify the LARAC algorithm to destination-based QoS routing, LADEQ, to reduce the number of routing optimization problems solved. This also reduces the size of the forwarding tables. A trace-driven evaluation shows that as the network size is increased, the time taken by our algorithm, LADEQ, was significantly smaller than the state-of-the-art multi-constrained shortest path (MCSP) algorithms applied to all source and destination pairs.
5G introduces new paradigms that enable communication networks to become more flexible and handle a wide variety of network services from various vertical domains. Small cell deployment exploiting virtualization techniques as envisaged by 5G, allows enhanced mobile edge computing capabilities, thus enabling flexible network service deployment and slicing support near the end user. This paper presents a cloud-enabled small cell architecture for 5G networks developed within the 5G-ESSENCE project. The paper also presents the implementation and deployment of an Ethernet Virtual Connection service over a 5G-enabled infrastructure.
1 Network measurement and monitoring are instrumental to network operations, planning and troubleshooting. However, increasing line rates (100+Gbps), changing measurement targets and metrics, privacy concerns, and policy differences across multiple R&E network domains have introduced tremendous challenges in operating such high-speed heterogeneous networks, understanding the traffic patterns, providing for resource optimization, and locating and resolving network issues. There is strong demand for a flexible, high-performance measurement instrument that can empower network operators to achieve the versatile objectives of effective network management and resource provisioning. In this demonstration, we present AMIS: Advanced Measurement Instrument and Services to achieve programmable, flow-granularity and event-driven network measurement, sustain scalable line rates, to meet evolving measurement objectives and to derive knowledge for network advancement.
Aim: We seek to assess the performance of time delay neural networks (TDNN), one of the topologies designed for time series prediction, to characterize spectrum occupancy in multiple time horizons in Land Mobile Radio bands. This could lead to dynamic spectrum allocation methods to address potential spectrum shortages facing Internet of Things (IoT) deployments. Background: ANNs are a popular choice for spectrum prediction. Traditionally, ARIMA models have been at the forefront of forecasting and prediction but ANNs that learn from time series have demonstrated good performance using both simulated datasets and real-life data collected in the cellular bands. Methodology: We use three prediction models, a baseline which simply delays the time series, a seasonal ARIMA model and a TDNN. We test their performance on an hourly dataset in LMR bands collected in Ottawa, Canada between the dates of October 2016 and April 2017. Results: We demonstrate that TDNN yields improvements over seasonal ARIMA models in predicting short time horizons. Conclusions: The TDNN based prediction models that are designed to work with time series data provide a better alternative for accurately predicting spectrum occupancy in bands that exhibit similar characteristics to LMR channels, especially as the forecast horizon gets longer.
Current methods for planning wireless networks rely on a mixture of on-site measurements and predictive modeling. Unfortunately, such methods can be expensive and time-consuming when it comes to planning for venues of large dimension, or those with a vast number of wireless devices. In this short paper, we focus on an important aspect of scalable network planning: estimating the number of source devices (e. g., access points, base stations) needed to meet traffic demands. We propose a coarse-grained approach that models aggregate demands and interference sources. Minimizing the number of source devices is shown to be NP-complete. However, our coarsegrained approach permits an integer linear program that solves for the optimum while remaining tractable; an approximation result is also derived. Preliminary experiments using QualNet and Ekahau support our approach.
Alarm logs are a valuable source of information and play a crucial role in network management. Network devices such as backbone routers or 3G/4G base stations generate verbose and detailed logs that network managers process to detect problems and identify their root causes. Manual analysis of such logs is extremely time-consuming because of the extensive amount of data. Therefore, finding suitable automatic methods to process logs is an important problem in the network analysis area.In this paper, we target the automatic extraction of situations, i.e., sequences of events occurring close in time and space which identify common and recurring patterns. We adopt an unsupervised machine learning approach to automatically mine logs and provide information and correlations in network failures. We face a real use case processing more than 2 million alarms generated by 2 months of TIM Network Operations Center in Northern Italy. Most of the features are categorical and call for specific methodologies to process them. We choose rule mining of frequent items. We focus on event logs and apply rule mining methods to extract temporal-spatial correlations and co-occurrences, i.e., situations. To ease the analyst work, we highlight the most important rules and offer visualization techniques in both spatial and temporal dimensions. Results have been verified to be helpful to recognize common situations and identify possible future anomalies.
In this paper we propose a comprehensive technique to reduce the operational expenses (OPEX) of virtual network systems, which comprises the cost of using resources, the cost of requesting the underlying infrastructure to make changes to the allocated resources, and the cost of dropping network traffic and hence disrupting the service. We demonstrate that it is feasible to reduce OPEX by optimizing resource assignation without relying on thresholds, neither for determining the amount of resources to be assigned nor to assess the correct operation of the control system. Instead, our proposal relies solely on the context definition (day of week, time of day, current resource amount, etc.) and the events reported by external detectors. Finally, we quantify the benefit of considering such events when taking management decisions and how they are useful to step further towards the optimum assignation of Virtual Network Function (VNF) instances to accomplish the demands of the overall system.
