Anomaly-Based Intrusion Detection Systems (IDSs) have been extensively studied for their ability to detect zero-day attacks by establishing a baseline of normal behavior from benign traffic and flagging deviations as potential threats. However, they often suffer from higher false positive rates compared to signature-based IDSs. Unlike image data, raw network traffic lacks directly useful features and requires additional processing to capture meaningful patterns. Simple traffic statistics (e.g., connection duration, packet inter-arrival time) often fail to represent the complex relationships necessary for accurate detection, making feature engineering essential. We propose a geometric feature learning method to optimize feature extraction. Specifically, we employ contrastive feature learning to build a representation space where benign traffic forms a compact cluster, and then apply H-Score feature learning to further enhance intra-class compactness and inter-class separability, thereby improving anomaly detection performance. Beyond the NSL-KDD and N-BaIoT datasets, we further validate our approach on more advanced and realistic benchmarks, including CIC-IDS-2017, TON-IoT, and UNSW-NB15, demonstrating strong generalizability. To address privacy concerns and enable collaborative learning across distributed environments, we extend our centralized design to a federated learning (FL) setting, preserving user privacy while leveraging the collective knowledge of diverse IoT devices. Finally, we deploy the proposed IDS on a Raspberry Pi 4 to showcase its efficiency and suitability for resource-constrained IoT scenarios.

Current cybersecurity research is constrained by the general scarcity of large, realistic, labeled network traffic datasets. To address said scarcity, this paper introduces Sentinel: a multi-enterprise scientific instrument developed to support data-driven cybersecurity research. Sentinel provides researchers access to virtual computing infrastructure and petabytes of data collected over several years from network sensors at two large, disjoint educational institutions - the University of Virginia and Virginia Tech. The network dataset is supplemented by multi-modal malware activity logs generated by attack recreation exercises which realistically integrate ground truth into collected edge sensor data. To mitigate risks associated with providing access to enterprise network sensor logs, Sentinel uses a combination of a code-to-data policy, data usage agreements, and pattern-preserving anonymization. Sentinel has been used as part of a government-funded effort to investigate new machine learning algorithms, cybersecurity forensics, and data retention techniques.

Research and development of techniques which detect or remediate malicious network activity require access to diverse, realistic, contemporary data sets containing labeled malicious connections. In the absence of such data, said techniques cannot be meaningfully trained, tested, and evaluated. Synthetically produced data containing fabricated or merged network traffic is of limited value as it is easily distinguishable from real traffic by even simple machine learning (ML) algorithms. Real network data is preferable, but while ubiquitous is broadly both sensitive and lacking in ground truth labels, limiting its utility for ML research. This paper presents a multi-faceted approach to generating a data set of labeled malicious connections embedded within anonymized network traffic collected from large production networks. Real-world malware is defanged and introduced to simulated, secured nodes within those networks to generate realistic traffic while maintaining sufficient isolation to protect real data and infrastructure. Network sensor data, including this embedded malware traffic, is collected at a network edge and anonymized for research use. Network traffic was collected and produced in accordance with the aforementioned methods at two major educational institutions. The result is a highly realistic, long term, multiinstitution data set with embedded data labels spanning over 1.5 trillion connections and over a petabyte of sensor log data. The usability of this data set is demonstrated by its utility to our artificial intelligence and machine learning (AI/ML) research program.

Over the past decade, accelerator-based supercomputers have grown from 0% to 42% performance share on the TOP500. Ideally, GPU-accelerated code on such systems should be "write once, run anywhere," regardless of the GPU device (or for that matter, any parallel device, e.g., CPU or FPGA). In practice, however, portability can be significantly more limited due to the sheer volume of code implemented in non-portable languages. For example, the tremendous success of CUDA, as evidenced by the vast cornucopia of CUDA-accelerated applications, makes it infeasible to manually rewrite all these applications to achieve portability. Consequently, we achieve portability by using our automated CUDA-to-OpenCL source-to-source translator called CU2CL. To demonstrate the state of the practice, we use CU2CL to automatically translate three medium-to-large, CUDA-optimized codes to OpenCL, thus enabling the codes to run on other GPU-accelerated systems (as well as CPU- or FPGA-based systems). These automatically translated codes deliver performance portability, including as much as three-fold performance improvement, on a GPU device not supported by CUDA.

As the computational capabilities of a supercomputer transition from petaflops to exaflops, more compute processes work concurrently to accomplish tasks, requiring more communication. This results in using an increasing number of software and hardware components, which in turn, increases the probability of abnormal events and failures. We present a solution that improves resilience against transient events in network communication. We observe that the coupling of the session and transport semantics in implementations inhibits recovery from transient failures. Our proposal, a session-layer intermediary (SLIM), serves as a shim layer on top of the interconnect's interface and enables separation of session and transport semantics. We use Open MPI as a case study where SLIM exposes an interface to the Byte Transfer Layer framework. This approach manages transient faults with the underlying transport, by trapping and resolving them and thus not allowing them to cascade into failed MPI primitives. Preliminary results show that the introduction of SLIM delivers resilience and does so without incurring any performance impact, either in latency or throughput. In future, we plan to include other interconnects, such as OpenIB, and enable tolerance for transient network failures.

Increasingly, communication requires more from the network stack, e.g., seamless handoff and synchronization of state between multiple participants. Due to the lack of support for desired functionality, networking libraries are created to fill the void. This leads to considerable duplication of effort and complicates cross-platform development. Furthermore, the means for extending legacy protocol stacks is largely exhausted (e.g., the TCP options space in the SYN message is mostly allocated), making the addition of future extensions much more challenging. In this paper, we tease apart elements of session management that are currently conflated with the transport semantics in TCP and highlight the need for sessions in contemporary communications. Next, we propose session, flow, and endpoint abstractions that lead to a clearer description of advanced communication models. This effort results in an extensible session-layer intermediary (SLIM) that leverages the above abstractions to support the additional functionality needed by modern applications, such as mobility, communication between two or more participants, and dynamic reconfiguration. SLIM's approach also provides the means for future extensibility of the network stack in a backward-compatible way, thus enabling incremental adoption.

Installing a cloud infrastructure is an involved undertaking. Even more so if one desires the Apache VCL, itself a cloud platform, running on top. This paper discusses one approach to automating the installation of both OpenStack and VCL. Particular emphasis is placed on accommodating both small-scale test deployments and full scale production environments. The modular approach taken here first automates the installation of OpenStack, then the installation of the Apache VCL, and finally the integration of the two. The approach taken is applicable to the installation of any large software system composed of complex subsystems.

Increasingly, communication requires more from the network stack. Due to missing functionality, we see a proliferation of networking libraries that attempt to fill the void (e.g., iOS to OSX Handoff and Google Cast SDK). This leads to considerable duplication of effort. Further, the provisions for extending legacy protocol stacks is largely exhausted (e.g., TCP options space is mostly allocated) making the addition of future extensions much more challenging. We present SLIM, an extensible session-layer intermediary that extracts the duplicate functionality from modern networking libraries and provides the means for future extensibility to the network stack. SLIM enables mobility, multiparty communication, and dynamic reconfiguration of the network stack in a straightforward and elegant way. SLIM includes an out-of-band signaling channel, which not only enables reconfiguration, but also allows for incremental evolution of the stack. To start, we tease out elements of session management which are currently conflated with transport semantics in TCP. Doing so highlights the need for sessions in contemporary use cases. Next, we propose session, flow and endpoint abstractions that allow application developers to describe communication between any number of participants. The abstractions apply to individual or a group communication allowing them to be managed as one. We describe the abstractions and evaluate them in terms of typical communication patterns. We demonstrate the abstractions via a prototype implementation of SLIM.

The bandwidth utilization in traditional TCP protocols (e.g., TCP New Reno) suffers over high-latency and high-bandwidth links due to the inherent characteristics of TCP congestion control. Conventional methods of improving throughput cannot be applied per se for streaming applications. The challenge is exacerbated by “big data” applications such as with the Long Wavelength Array data that is generated at a rate of up to 4 terabytes per hour. To improve bandwidth utilization, we introduce layer-4 relay(s) that enable the pipelining of TCP connections. That is, a traditional end-to-end connection is split into independent streams, each with shorter latencies, that are then concatenated (or cascaded) together to form an equivalent end-to-end TCP connection. This addresses the root cause by decreasing the latency over which the congestion-control protocol operates. To understand when relays are beneficial, we present an analytical model, empirical data and its analyses, to validate our argument and to characterize the impact of latency and available bandwidth on throughput. We also provide insight into how relays may be setup to achieve better bandwidth utilization.

The proliferation of heterogeneous computing systems has led to increased interest in parallel architectures and their associated programming models. One of the most promising models for heterogeneous computing is the accelerator model, and one of the most cost-effective, high-performance accelerators currently available is the general-purpose, graphics processing unit (GPU). Two similar programming environments have been proposed for GPUs: CUDA and OpenCL. While there are more lines of code already written in CUDA, OpenCL is an open standard that supports a broader. Hence, there is significant interest in automatic translation from CUDA to OpenCL. The contributions of this work are three-fold: (1) an extensive characterization of the subtle challenges of translation, (2) CU2CL (CUDA to OpenCL) - an implementation of a translator, and (3) an evaluation of CU2CL with respect to coverage of CUDA, translation performance, and performance of the translated applications.

Current technologies that support live migration require that the virtual machine (VM) retain its IP network address. As a consequence, VM migration is oftentimes restricted to movement within an IP subnet or entails interrupted network connectivity to allow the VM to migrate. Thus, migrating VMs beyond subnets becomes a significant challenge for the purposes of load balancing, moving computation close to data sources, or connectivity recovery during natural disasters. Conventional approaches use tunneling, routing, and layer-2 expansion methods to extend the network to geographically disparate locations, thereby transforming the problem of migration between subnets to migration within a subnet. These approaches, however, increase complexity and involve considerable human involvement. The contribution of our paper is to address the aforementioned shortcomings by enabling VM migration across subnets and doing so with uninterrupted network connectivity. We make the case that decoupling IP addresses from the notion of transport endpoints is the key to solving a host of problems, including seamless VM migration and mobility. We demonstrate that VMs can be migrated seamlessly between different subnets - without losing network state - by presenting a backward-compatible prototype implementation and a case study.

Saturating high capacity and high latency paths is a challenge with vanilla TCP implementations. This is primarily due to congestion-control algorithms which adapt window sizes when acknowledgements are received. With large latencies, the congestion-control algorithms have to wait longer to respond to network conditions (e.g., congestion), and thus result in less aggregate throughput. We argue that throughput can be improved if we reduce the impact of large end-to-end latencies by introducing layer-4 relays along the path. Such relays would enable a cascade of TCP connections, each with lower latency, resulting in better aggregate throughput. This would directly benefit typical applications as well as BIG DATA applications in distributed HPC. We present empirical results supporting our hypothesis.

The use of accelerators in high-performance computing is increasing. The most commonly used accelerator is the graphics processing unit (GPU) because of its low cost and massively parallel performance. The two most common programming environments for GPU accelerators are CUDA and OpenCL. While CUDA runs natively only on NVIDIA GPUs, OpenCL is an open standard that can run on a variety of hardware processing platforms, including NVIDIA GPUs, AMD GPUs, and Intel or AMD CPUs. Given the abundance of GPU applications written in CUDA, we seek to leverage this investment in CUDA and enable CUDA programs to "run anywhere" via a CUDA-to-OpenCL source-to-source translator. The resultant OpenCL versions permit the GPU-accelerated codes to run on a wider variety of processors that would not otherwise be possible. However, robust source-to-source translation from CUDA to OpenCL faces a myriad of challenges. As such, this paper identifies those challenges and presents a classification of CUDA language idioms that present practical impediments to automatic translation.

The philosophy upon which the Internet was built places the intelligence close to the edge. As the Internet has matured, intermediate devices or middleboxes, such as firewalls or application gateways, have been introduced, thereby weakening the end-to-end nature of the network. As a result, applications must often modify their behavior to accommodate the middleboxes. This is is especially true in the case of transient failure of stateful devices. The failure of a middlebox causes it to lose the state it maintained, causing the failure of the associated TCP connections. Rather than assign the responsibility for recovery to applications, we incorporate a mechanism called an isolation boundary into TCP itself. The isolation boundary maintains a small amount of state across TCP connections, thus enabling reconnection. Furthermore, it does so without breaking backward compatibility with existing TCP. We present an implementation of the isolation boundary in the FreeBSD kernel and demonstrate its backward compatibility with TCP. We quantify the performance impact of the proposed mechanism on the establishment of new and resumed connections for both legacy and extended TCP stacks.

The use of graphics processing units (GPUs) in high-performance parallel computing continues to become more prevalent, often as part of a heterogeneous system. For years, CUDA has been the de facto programming environment for nearly all general-purpose GPU (GPGPU) applications. In spite of this, the framework is available only on NVIDIA GPUs, traditionally requiring reimplementation in other frameworks in order to utilize additional multi- or many-core devices. On the other hand, OpenCL provides an open and vendor-neutral programming environment and runtime system. With implementations available for CPUs, GPUs, and other types of accelerators, OpenCL therefore holds the promise of a "write once, run anywhere" ecosystem for heterogeneous computing. Given the many similarities between CUDA and OpenCL, manually porting a CUDA application to OpenCL is typically straightforward, albeit tedious and error-prone. In response to this issue, we created CU2CL, an automated CUDA-to-OpenCL source-to-source translator that possesses a novel design and clever reuse of the Clang compiler framework. Currently, the CU2CL translator covers the primary constructs found in CUDA runtime API, and we have successfully translated many applications from the CUDA SDK and Rodinia benchmark suite. The performance of the automatically translated applications via CU2CL is on par with their manually ported counterparts.

Multicore computers have become standard, and the number of cores per computer is rising rapidly. How does the new demand for understanding of parallel computing impact computer science education? In this paper, we examine several aspects of this question: (i) What parallelism body of knowledge do today's students need to learn? (ii) How might these concepts and practices be incorporated into the computer science curriculum? (iii) What resources will support computer science educators, including non-specialists, to teach parallel computing? (iv) What systemic obstacles impede this change, and how might they be overcome? We address these concerns as an initial framework for responding to the urgent challenge of injecting parallelism into computer science curricula

The ITER Superconducting Magnet Manufacturing Database, MMD, is not only a data archive, but also a common communication platform, on which contributors to magnet manufacturing collaborate and take coordinated actions. In-kind procurement is a feature of the ITER construction. The magnet system construction involves six Domestic Agencies (DAs) plus contractors in these DAs. The six DAs are EU, Japan, Russia, the USA, Korea and China. The magnet system consists of many components like TF coils and current feeders. The ITER Organization (IO) monitors and controls quality throughout the manufacturing process. This is fundamental because the IO takes responsibility for the ITER machine even though not all large components can be tested under nominal conditions before their acceptance. For many contributors though (who have different cultures, quality assurance systems and languages), quality monitoring and control (QA/QC) represent big challenges. MMD is the web-based application that gives all contributors access to the IO server computer according to deflned privileges. Users can upload and consult updated manufacturing processes, associated drawings, procedures, inspection reports, etc.; more over, they can communicate internationally and visualize identical, updated and systematically stored datasets. The data stored in the database will be available in future site assembling and operation phases. Technically, the database is an application of ICP (ITER Collaborative Platform). ICP is a software framework for implementing database-driven applications for the ITER project. It provides a standardized web browser interface and data storage. This paper presents the design and functionality of MMD.