Existing website fingerprinting and traffic classification solutions do not work well when the evaluation context changes, as their performances often heavily rely on context-specific assumptions. To clarify this problem, we take three prior solutions presented for different but similar traffic classification and website fingerprinting tasks, and apply each solution's model to another solution's dataset. We pinpoint dataset-specific and model-specific properties that lead each of them to overperform in their specific evaluation context. As a realistic evaluation context that takes practical labeling constraints into account, we design an evaluation framework using two recent real-world TLS traffic datasets from large-scale networks. The framework simulates a futuristic scenario in which SNIs are hidden in some networks but not in others, and the classifier's goal is to predict destination services in one network's traffic, having been trained on a labelled dataset collected from a different network. Our framework has the distinction of including real-world distribution shift, while excluding concept drift. We show that, even when abundant labeled data is available, the best solutions' performances under distribution shift are between 30

Some kinds of application traffic, such as Cloud Gaming (CG), are particularly demanding for a network to transport because they require at the same time a low-latency and a high-bitrate. Quality of Experience (QoE) can quickly deteriorate when the network Quality of Service (QoS) is not met regarding bandwidth and delay requirements. In particular, the competition with some capacity seeking flows may induce a high queuing latency on the bottleneck (buffer-bloat phenomenon). In this paper, we evaluate two network level solutions that allow CG traffic to be processed in specific queues, but exhibit different operational constraints. The first solution uses a class-based queuing policy (Hierarchical Token Buckets, HTB), which requires prior traffic classification and some traffic engineering. The second solution leverages the new Low Latency, Low Loss & Scalable Throughput (L4S) architecture and the DualPI2 Active Queue Management (AQM), but it needs the application support. We perform extensive measurements on an experimental CG platform that integrates the L4S-compliant SCReAM CCA and that we made to evaluate both approaches regarding their QoS enforcement capability and fairness against different competing flows that are driven by TCP CUBIC or BBRv2. We show that both solutions succeed to preserve the QoS of CG traffic.

Deep learning (DL) has been successfully applied to encrypted network traffic classification in experimental settings. However, in production use, it has been shown that a DL classifier's performance inevitably decays over time. Re-training the model on newer datasets has been shown to only partially improve its performance. Manually re-tuning the model architecture to meet the performance expectations on newer datasets is time-consuming and requires domain expertise. We propose AutoML4ETC, a novel tool to automatically design efficient and high-performing neural architectures for encrypted traffic classification. We define a novel, powerful search space tailored specifically for the early classification of encrypted traffic using packet header bytes. We show that with different search strategies over our search space, AutoML4ETC generates neural architectures that outperform the state-of-the-art encrypted traffic classifiers on several datasets, including public benchmark datasets and real-world TLS and QUIC traffic collected from the Orange mobile network. In addition to being more accurate, AutoML4ETC's architectures are significantly more efficient and lighter in terms of the number of parameters. Finally, we make AutoML4ETC publicly available for future research.

With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now, among others, to attract players. However, for all end-users to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcomes of a comprehensive measurement study performed on the four aforementioned CG platforms, configuring different synthetic network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the traffic of these CG platforms under degraded network conditions and infer their adaptive behaviour. We also present how the four CG platforms behave when used under real cellular network conditions, captured on the Orange network in January 2022. Our findings show that the four platforms exhibit different adaptation behaviours. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

Over the past twenty years, a plethora of methods have been proposed for encrypted traffic classification (ETC), while the Server name indication (SNI) is deemed to solve the problem of classification for TLS traffic. However, SNI-based classification has its pitfalls and the SNI will likely be pushed into the encrypted tunnel in the future. In this work, we envision a futuristic scenario in which encrypted SNI is the norm and labeled traffic flows are scarce. In such settings, we tackle the problem of traffic classification at ISP level using few-shot learning. By means of six real-world ISP-level datasets collected between 2019 and 2021 and two publicly available client-side datasets, we study the performance of a few-shot learner on TLS data, including its cross-dataset generalizability. We further investigate the effect of the number of required labeled samples on the learner's performance. Our experiments show that the dataset-specificity of deep learners carries over to few-shot meta-learning, and calls for addressing the problem of generalizability for deep learning architectures.

The Low-Latency Low-Loss Scalable throughput (L4S) architecture has recently been proposed to reduce the network latency of low-latency services and to allow their flows to coexist with classic ones in the same domain. This coexistence implies monitoring and security challenges. However current monitoring methods, primarily based-on sampling and polling, exhibit performance and granularity limitations. This paper describes the challenges for monitoring LL services and details our solution when introducing a fine-grained and real-time monitoring capability in our P4-based L4S implementation using In-band Network Telemetry. The initial experimental evaluation shows that our solution is able to monitor the metrics of an L4S switch with very few networking and processing overhead and without disturbing the L4S behaviour.

Deep learning models have shown to achieve high performance in encrypted traffic classification. However, when it comes to production use, multiple factors challenge the performance of these models. The emergence of new protocols, especially at the application layer, as well as updates to previous protocols affect the patterns in input data, making the model's previously learned patterns obsolete. Furthermore, proposed model architectures for encrypted traffic classification are usually tested on datasets collected in controlled settings, which makes the reported performances unreliable for production use. In this paper, we study how the performances of two high-performing state-of-the-art encrypted traffic classifiers change on multiple real-world datasets collected over the course of two years from a major ISP's network. We investigate the changes in traffic data patterns highlighting the extent to which these changes, also known as data drift, impact the performance of the two models in service-level as well as application-level classification. We propose best practices for architecture adaptations to improve the accuracy of the model in the face of data drift. We show that our best practices are generalizable to other encryption protocols and different levels of labeling granularity.

Traffic classification is essential in network management for a wide range of operations. Recently, it has become increasingly challenging with the widespread adoption of encryption in the Internet, for example, as a de facto in HTTP/2 and QUIC protocols. In the current state of encrypted traffic classification using deep learning (DL), we identify fundamental issues in the way it is typically approached. For instance, although complex DL models with millions of parameters are being used, these models implement a relatively simple logic based on certain header fields of the TLS handshake, limiting model robustness to future versions of encrypted protocols. Furthermore, encrypted traffic is often treated as any other raw input for DL, while crucial domain-specific considerations are commonly ignored. In this paper, we design a novel feature engineering approach used for encrypted Web protocols, and develop a neural network architecture based on stacked long short-term memory layers and convolutional neural networks. We evaluate our approach on a real-world Web traffic dataset from a major Internet service provider and mobile network operator. We achieve an accuracy of 95% in service classification with less raw traffic and a smaller number of parameters, outperforming a state-of-the-art method by nearly 50% fewer false classifications. We show that our DL model generalizes for different classification objectives and encrypted Web protocols. We also evaluate our approach on a public QUIC dataset with finer application-level granularity in labeling, achieving an overall accuracy of 99%.

Deep learning models have shown to achieve high performance in encrypted traffic classification. However, when it comes to production use, multiple factors challenge the performance of these models. The emergence of new network traffic protocols, especially at the application-layer, as well as updates to previous protocols affect the patterns in input data, making the model's previously learned patterns obsolete. Furthermore, proposed model architectures are usually tested on datasets collected in controlled settings, which makes the reported performances unreliable for production use. In this paper, we study how the performances of two high-performing traffic classifiers change on multiple real-world datasets collected over the course of two years. We investigate the changes in traffic data patterns showing the extent to which these changes reduce the performance of the two models. Furthermore, we propose architectural adaptations to a flow time-series based traffic classifier, showing that they improve accuracy by 4.8%.

Traffic classification is essential in network management for operations ranging from capacity planning, performance monitoring, volumetry, and resource provisioning, to anomaly detection and security. Recently, it has become increasingly challenging with the widespread adoption of encryption in the Internet, e.g., as a de-facto in HTTP/2 and QUIC protocols. In the current state of encrypted traffic classification using Deep Learning (DL), we identify fundamental issues in the way it is typically approached. For instance, although complex DL models with millions of parameters are being used, these models implement a relatively simple logic based on certain header fields of the TLS handshake, limiting model robustness to future versions of encrypted protocols. Furthermore, encrypted traffic is often treated as any other raw input for DL, while crucial domain-specific considerations exist that are commonly ignored. In this paper, we design a novel feature engineering approach that generalizes well for encrypted web protocols, and develop a neural network architecture based on Stacked Long Short-Term Memory (LSTM) layers and Convolutional Neural Networks (CNN) that works very well with our feature design. We evaluate our approach on a real-world traffic dataset from a major ISP and Mobile Network Operator. We achieve an accuracy of 95% in service classification with less raw traffic and smaller number of parameters, out-performing a state-of-the-art method by nearly 50% fewer false classifications. We show that our DL model generalizes for different classification objectives and encrypted web protocols. We also evaluate our approach on a public QUIC dataset with finer and application-level granularity in labeling, achieving an overall accuracy of 99%.

Amongst the appealing features of 5G, ultra low latency is perhaps the most attractive one, as it unleashes a wealth of disruptive services. However, meeting such a challenging goal requires a thorough understanding of latency in the 5G prevailing bottleneck, that is, the Base Station. For this purpose, we propose LatSeq, an open-source tool for fine-grained analysis of latency inside a software Base Station (BS), and implement it on the OpenAirInterface platform. LatSeq tackles each packet's sequence of successive delays across the layers of a Base Station, which reveals enlightening causal links. This paper discusses LatSeq's design choices and evaluates its fitness for purpose in a first baseline usage scenario. We demonstrate the low impact of LatSeq on the observed system, and the relevance of statistics based on individual packet tracing inside the base station.

With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now among others, to attract players. However, for all end-users to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcome of real-life measurements performed between April and July 2021 on the four aforementioned CG platforms, configuring different network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the behavior of these CG platforms under extreme network conditions. Our findings show that the four platforms exhibit different adaptation behaviors. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

Low-latency applications, such as cloud gaming or cloud robotics are very demanding in terms of network latency.The IETF defines the L4S (Low Latency Low Loss Scalable throughput) architecture, to enable the delivery of high-bitrate low-latency applications without degrading the quality of other services.To deploy and upgrade L4S in network equipment to follow the transport protocols entering an age of quick evolutions, P4 (Programming Protocol-Independent Packet Processor), a programmable data plane concept, can help since it facilitates the deployment of networking software.In this paper, we propose a P4-based L4S solution and the performed evaluation proves our system behaves as expected.Furthermore, to be largely deployed, L4S should also be efficient under real cellular network conditions, which can vary over time and where the main network bottlenecks are.However, our evaluation shows limitations of L4S in providing high throughput while ensuring low latency delivery with time varying network conditions.

The fifth generation of mobile networks, 5G, is expected to support a set of many requirements and use cases such as handling connectivity for a massive number of IoT (Internet of Things) devices. Authenticating IoT devices and controlling their access to the network plays a vital role in the security of these devices and of the whole cellular system. In current cellular networks, as well as in 3GPP specifications release 16 on 5G, the AAC (Authentication and Access Control) of IoT devices is done in the same manner as the AAC of MBB (Mobile Broadband) UE (User Equipment). Considering the expected growth of IoT devices, this will likely induce a very high load on the connectivity provider's CN (Core Network) and cause network failures. To manage the AAC of this massive number of devices, we propose an SSAAC (Slice Specific Authentication and Access Control) mechanism that makes use of the flexibility provided by virtualization technologies. This mechanism allows the authentication and access control of IoT devices to be delegated to the 3rd parties providing these devices, thereby decreasing the load of the connectivity provider's CN, while increasing the flexibility and modularity of the whole 5G network. We evaluate the feasibility of our proposal with the OAI (Open Air Interface) open-source platform. Next, we provide a security analysis of the proposal and highlight the security requirements to use with this proposal. We also evaluate the impact of this delegation approach on the network load considering the anticipated number of AAC signaling messages compared to the existing AAC mechanisms in cellular networks. According to these evaluations, our approach is feasible and it would provide cellular networks the opportunity to overcome the security shortcomings in their AAC mechanisms. It also considerably reduces the AAC signaling load on the connectivity provider's CN. (C) 2020 Elsevier B.V. All rights reserved.

The IoT (Internet of Things) is expected to encounter new business trends like wholesale wireless connectivity, due to the emergence of new user demands. These new business trends and demands will have a major effect on the entire IoT system and on the associated security needs. In this paper, we study the necessity of providing a new AC (access control) framework for IoT through a comparison of the AC architectures in the different communication technologies that are currently in operation for IoT. We consider cellular, Wi-Fi and LoRaWAN networks and their compatibility with the wholesale wireless connectivity concept.

Transport protocols continuously evolve in order to meet the needs of users and new services. A recent significant example is Quick UDP Internet Connections (QUIC), an experimental protocol introduced by Google, that aims to replace two widely used transport and security protocols, namely Transmission Control Protocol (TCP) and Transport Layer Security (TLS). QUIC is implemented in user applications (rather than in the operating system's kernel) and is meant to be resistant to ossification and therefore more versatile. Because of its evolvable nature, QUIC introduces new challenges in managing fairness. In this paper, we focus on determining the influence of QUIC on the data rate of mobile users. We specifically analyze protocol fairness when TCP and QUIC flows coexist on the wireless link of a mobile network. During our fairness assessments, we identified the impact of the following QUIC implementation aspects: the emulation of multiple TCP connections, the limitation of the congestion windows size and the usage of the hybrid start (hystart). Results show these mechanisms have a strong influence on fairness when the loss rate is low on the mobile network. Indeed, a wrong setting of the default parameters of these mechanisms or the activation of the hystart option can affect the performance of the transport protocols and therefore also the fairness. Finally, the lack of standardization of the emulation of multiple TCP connection in QUIC makes us question more broadly how QUIC's design philosophy accommodates fairness.

—As user applications require always more throughput and less latency, new transport protocols such as Quick UDP Internet Connections (QUIC) are proposed. QUIC is currently deployed by Google and is targeted to replace both Transmission Control Protocol (TCP) and Transport Layer Security (TLS) for HyperText Transfer Protocol (HTTP) transport. The flexibility of QUIC, which is implemented in user-space, can however, notably influence the fairness in the sharing of network resources. In this work, we are interested in evaluating the behavior of TCP and QUIC when they coexist together in the network with the same Congestion Control Algorithm (CCA), namely CUBIC. We concretely quantify session level fairness between QUIC and TCP on a platform that injects real traffic over emulated network conditions. Results show that a configurable parameter in QUIC stacks: the number of TCP connections emulated by a single QUIC connection has a strong impact on fairness.

The fifth generation of mobile cellular networks (5G) is designed to support a set of new requirements and use cases, including connectivity for the IoT (Internet of Things). Due to the industry and the user's expectation of having connectivity embedded into IoT devices, the "wholesale wireless connectivity" concept is gaining more and more attention. According to this concept, connectivity providers sell connectivity to 3 rd parties, which in turn provide it to their own devices. However, this concept brings also new architecture and security requirements that are not fully addressed by the state of the art. Taking advantage of the flexibility provided by virtualization technologies (including network slicing), we propose in this paper a new 5G-SSAAC (5G Slice Specific Authentication and Access Control) mechanism that delegates authentication and access control of the devices to the 3 rd parties providing these devices, thereby decreasing the load of the connectivity provider's CN (core network), while increasing flexibility and modularity of the whole 5G network.

Firefox OS is an operating system for mobile devices. It is developed by Mozilla and is based on web technologies. Developed applications are therefore not tied to a given type of hardware. Mozilla works on standardisation of Web APIs, so that the device hardware could be accessed more easily. It also introduced its sign-in system for the Web and furthermore, it wants to redefine the way payments work for mobile applications. Firefox OS is not directly competing with Android and iOS, although it has some common target markets with Android. It could be an opportunity to weaken the iOS and Android duopoly. For now it targets users that don't have smartphones yet and is mostly used on low-end devices. The biggest challenge of Firefox OS is to assure a stable position in the mobile OS ecosystem and to get a large volume of users. Mozilla has an ambition to improve the web and make the web the platform. However developing the Firefox OS and ensuring its important place on the market is difficult because of technological and business limits that will be discussed in this chapter.

With IMS and WebRTC being both recognized as key technologies for communication services and as technological investments are ongoing there is a need to understand what each technology can do that the other cannot. This paper provides an extensive analysis allowing for a side by side comparison of IMS and WebRTC taking into account the respective standards but also how the technologies are implemented and the ability of their respective ecosystems to drive further evolutions. Keywords—IMS; WebRTC; Real-time communications