The InterPlanetary File System (IPFS) is a decentralized peer-to-peer (P2P) storage built on Kademlia, a Distributed Hash Table (DHT) structure commonly used in P2P systems and known for its proved scalability. However, DHTs are susceptible to Sybil attacks, where a single entity controls multiple malicious nodes. Recent studies have shown that IPFS is also affected by a passive content eclipse attack, leveraging Sybil nodes, in which adversaries hide received indexed information from other peers, making the content appear unavailable. However, the latest mitigation strategy coupling an attack detection based on statistical tests and a wider publication strategy upon detection was able to circumvent it.In this work, we present a new active attack in which malicious nodes return semantically correct but intentionally false data. The attack leverages strategic Sybil placement to evade the detection mechanisms of the latest mitigation and exploits an early termination behavior in Kubo, the main implementation of IPFS. Our approach is capable of fully eclipsing content on the real IPFS network. When evaluated against the mitigation, it successfully denies access to the target content in 80% of lookup attempts.To address this vulnerability, we propose a new mitigation called SR-DHT-Store, which enables efficient, Sybil-resistant content publication without relying on attack detection. Instead, it uses systematic and precise use of region-based queries based on a dynamically computed XOR distance to the target ID. When combined with other defense mechanisms, SR-DHT-Store fully mitigates passive and active Sybil attacks at a lower overhead while supporting an incremental deployment.

The rapid advancement of immersive multimedia applications, such as cloud gaming, necessitates streaming technologies that deliver both low-latency and high-bitrate to ensure a seamless Quality of Experience (QoE). Conventional transport protocols like TCP and UDP often fail to simultaneously meet these demands, with challenges such as bufferbloat exacerbating latency or loss events that disrupt real-time experience in case of congestion. To address these limitations, this study evaluates the packet wash mechanism introduced in the Big Packet Protocol (BPP) and made possible by Scalable Video Coding (SVC), tailored for real-time applications like cloud gaming. The packet wash mechanism can discard on-the-fly higher-quality payload layers in network buffers during congestion events, preventing gameplay interruptions without requiring server-side negotiation or re-encoding. This network-based approach minimizes the effects of congestion compared to traditional bitrate adaptation methods. Experimental results for 2K game streaming demonstrate that the packet wash mechanism preserves visual quality with negligible degradation during sudden bandwidth drops.

Latency-sensitive multimedia applications, such as cloud gaming, require advanced streaming solutions that provide both low latency and high visual quality to ensure a seamless user experience. Conventional transport protocols often struggle under sudden bandwidth fluctuations, resulting in latency spikes, packet loss, and ultimately gameplay interruptions. To address these limitations, this work explores the capabilities of the Big Packet Protocol (BPP) packet wash mechanism combined with Region of Interest (ROI) coding by Scalable Video Coding (SVC) for 2K video games to satisfy the Quality of Experience (QoE) under network congestion. BPP packet wash dynamically discards non-critical enhancement layer chunks at the network edge during congestion, ensuring a critical Quality of Service (QoS)-preserving remediation before the application's Control Congestion Algorithm (CCA) comes into play to adapt the bitrate. Comparative experiments for various coding strategies after applying packet wash show that ROI SVC can handle bandwidth drops more efficiently, up to 52% reduction, while still maintaining uninterrupted gameplay and satisfactory visual quality in the most critical regions of the game, according to QoE evaluation involving real users. These results indicate that packet wash with ROI SVC provides an effective solution for real-time interactive multimedia streaming, such as cloud gaming.

Network Function Virtualization (NFV) is now well known for making network services deployable in a virtual environment, for instance in data-centers. On another hand, the programability of functions has come down to the network forwarding equipment itself, such as programmable switches, using the Programming Protocol-independent Packet Processors (P4) solution. Each of the two programmable concepts has its own advantages and drawbacks and micro-services should be preferably developed in one or the other solution depending on their constraints and requirements. In this paper, our objective is to combine both approaches. We propose to leverage Segment Routing (SR) to define a solution allowing to chain the micro-services to be executed at both levels. This signaling protocol is integrated within network equipment but not within a NFV infrastructure. To overcome it, we design an intermediary proxy between the P4 nodes and the VNFs. This proxy is in charge of managing the SR labels and their association with the related VNF. The demonstrator we have developed proves the feasibility of the approach and opens the way towards a composition of network services taking the best of the two levels of programmable networks.

Some kinds of application traffic, such as Cloud Gaming (CG), are particularly demanding for a network to transport because they require at the same time a low-latency and a high-bitrate. Quality of Experience (QoE) can quickly deteriorate when the network Quality of Service (QoS) is not met regarding bandwidth and delay requirements. In particular, the competition with some capacity seeking flows may induce a high queuing latency on the bottleneck (buffer-bloat phenomenon). In this paper, we evaluate two network level solutions that allow CG traffic to be processed in specific queues, but exhibit different operational constraints. The first solution uses a class-based queuing policy (Hierarchical Token Buckets, HTB), which requires prior traffic classification and some traffic engineering. The second solution leverages the new Low Latency, Low Loss & Scalable Throughput (L4S) architecture and the DualPI2 Active Queue Management (AQM), but it needs the application support. We perform extensive measurements on an experimental CG platform that integrates the L4S-compliant SCReAM CCA and that we made to evaluate both approaches regarding their QoS enforcement capability and fairness against different competing flows that are driven by TCP CUBIC or BBRv2. We show that both solutions succeed to preserve the QoS of CG traffic.

The current domain name system (DNS) relies on specific organizations such as the Internet Corporation for Assigned Names and Numbers for its administration. Therefore, misconfigurations or arbitrary deployments by these organizations may have a negative impact on the Internet. Handshake, which is a blockchain-based DNS service, can offer an alternative and extended system to the current DNS by managing the root zone on the blockchain without relying on specific organizations. This paper addresses the following research question: Can Handshake replace the current DNS in the future? At the time of this writing, this is the first detailed analysis of Handshake, with a particular focus on undesirable activities and security issues observable from the blockchain data. By discussing concerns regarding malicious usage of domain names, such as domain squatting, with the usage cost data, the paper demonstrates that there is a significant possibility of domain name abuse with lower cost in general. Furthermore, by discussing system redundancy as part of the blockchain-based DNS, it shows that there is a likelihood for lower redundancy of authoritative DNS servers. In response to the research question, the paper concludes that Handshake cannot and should not replace the current DNS in the future without resolving these issues through the introduction of security measures for general users.

The Distributed Hash Table (DHT) architecture is known to be a very efficient way to implement peer-to-peer (P2P) computer networks. However, the scientific literature also proved that DHT functioning in P2P networks can be easily disrupted by a single entity controlling many peers, known as the Sybil Attack. Various defensive mechanisms are known to prevent such attacks, or at least hinder them. The current study evaluates the resiliency of the InterPlanetary File System (IPFS) P2P network to a legacy Sybil Attack. We show that, surprisingly, IPFS does not implement basic defense mechanisms, allowing the most simple attack from a single computer to easily take the control of any DHT entry. A practical use of this attack is to almost entirely deny access to a given content on the network. Thus we provide some recommendations to quickly remediate this vulnerability.

Blockchains face many challenges in time, among which the ever-growing storage needs for blockchains’ data. In particular, Ethereum is quickly approaching the 1 TB storage limit for a node, what may significantly reduce the candidates able to run an Ethereum fullnode. In this paper, we propose a new synchronization and storage strategy for Ethereum that takes full advantage of the Distributed Hash Table implemented in all clients but left unused. By digging into the history of Ethereum’s synchronization and storage strategies, we justify why such distribution of storage duties among peers makes much sense today. We implemented our solution in the official Ethereum client Geth and validated its smooth operation on a private Ethereum instance. Our solution can save around 60% of the storage of a node (360 GB) which represents a total of 12 PB of data at the network scale, while being fully backward compatible with current clients.

With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now, among others, to attract players. However, for all end-users to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcomes of a comprehensive measurement study performed on the four aforementioned CG platforms, configuring different synthetic network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the traffic of these CG platforms under degraded network conditions and infer their adaptive behaviour. We also present how the four CG platforms behave when used under real cellular network conditions, captured on the Orange network in January 2022. Our findings show that the four platforms exhibit different adaptation behaviours. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

Cloud Gaming (CG) has been gaining a lot of interest and major actors have entered this market such as Google, Nvidia, Sony or Microsoft. They operate CG platforms that attract an increasing number of players worldwide. This type of traffic is highly demanding for network infrastructures because it requests simultaneously high bandwidth, low delay and no traffic degradation (interruptions or jitter) to ensure a good end-user’s QoE. To improve the delivery of low-latency applications, new Active Queue Management architectures like L4S (Low Latency, Low Loss, Scalable Throughput) are proposed. Currently, traffic is routed to a low-latency queue only based on the presence of the Explicit Congestion Notification bit (ECN) in the IP header, but this is too restrictive and can be easily manipulated. Instead, we aim at analyzing and detecting CG traffic based on its inherent characteristics, to forward the packets in the low-latency queue. This paper presents our models to efficiently detect CG traffic based on flow-level features among other highbitrate applications transported over UDP. The evaluation proves that our model based on decision trees achieves very good results (98.5% accuracy) and can be realistically deployed as a Virtualized Network Function at the edge, handling more than 10Gb/s of medium-sized flows on a low-end server. Our network captures and source code are open to ensure reproducible results.

Low-Iatency (LL) applications, such as the increasingly popular cloud gaming (CG) services, have stringent latency requirements. Recent network technologies such as L4S (Low Latency Low Loss Scalable throughput) propose to optimize the transport of LL traffic and require efficient ways to identify it. A previous work proposed a supervised machine learning model to identify CG traffic but it suffers from limited processing rate due to a pure software approach and a lack of generalization. In this paper, we propose a hybrid P4/NFV architecture, where a hardware Tofino based P4 implementation of the feature extraction functionality is deployed in the data plane and a unsupervised model is used to improve classification results. Our solution has a better processing rate while maintaining an excellent identification accuracy thanks to model adaptations to cope with P4 limitations and can be deployed at ISP level to reliably identify the CG traffic at line rate.

Public blockchains, like Ethereum, rely on an underlying peer-to-peer (P2P) network to disseminate transactions and blocks between nodes. With the rise of blockchain applications and cryptocurrencies values, they have become critical infrastructures which still lack comprehensive studies. In this paper, we propose to investigate the reliability of the Ethereum P2P network. We developed our own dependable crawler to collect information about the peers composing the network. Our data analysis regarding the geographical distribution of peers and the churn rate shows good network properties while the network can exhibit a sudden and major increase in size and peers are highly concentrated on a few ASes. In a second time, we investigate suspicious patterns that can denote a Sybil attack. We find that many nodes hold numerous identities in the network and could become a threat. To mitigate future Sybil attacks, we propose an architecture to detect suspicious nodes and revoke them. It is based on a monitoring system, a smart contract to propagate the information and an external revocation tool to help clients remove their connections to suspicious peers. Our experiment on Ethereum’s Test network proved that our solution is effective.

General-purpose computing on graphics processing units (GPGPU) is a promising way to speed up computationally intensive network functions, such as performing real-time traffic classification based on machine learning. Recent studies have focused on integrated graphics units and various performance optimizations to address bottlenecks such as latency. However, these approaches tend to produce architecture-specific binaries and lack the orchestration of functions. A complementary effort would be a GPGPU architecture based on standard and open components, which allows the creation of interoperable and orchestrable network functions.This study describes and evaluates such open architecture based on the cross-platform Vulkan API, in which we execute hand-written SPIR-V code as a network function. We also demonstrate a multi-node orchestration approach for our proposed architecture using Kubernetes. We validate our architecture by executing SPIR-V code performing traffic classification with random forest inference. We test this application both on discrete and integrated graphics cards and on x86 and ARM. We find that in all cases the GPUs are faster than the baseline Cython code.

The Bitcoin peer-to-peer network ensures the consensus between the different nodes responsible for the propagation of the blocks containing the validated bitcoin transactions. The quality and safety of this network are therefore particularly essential. In this work, we present a study of the public nodes that form the backbone of the Bitcoin p2p network. We analyze the results of our measurement campaign that was made following a well-defined and reproducible methodology. In particular we analyze several criteria that can affect the network resilience: distribution and security assessment of the clients' versions, churn, detection of Sybil nodes, dynamicity and popularity of peers. We also investigate the countermeasures deployed to prevent an accurate inference of the network topology and show their effectiveness.

With the recent technological evolutions in networks and increased deployment of multi-tier clouds, cloud gaming (CG) is gaining renewed interest and is expected to become a major Internet service in the upcoming years. Many companies have launched powerful platforms such as Google Stadia, Nvidia GeForce Now, Microsoft xCloud, Sony PlayStation Now among others, to attract players. However, for all end-users to fully enjoy their gaming sessions over the wide range of network access qualities, CG platforms must adapt their traffic. In this paper, we present the outcome of real-life measurements performed between April and July 2021 on the four aforementioned CG platforms, configuring different network constraints like packet loss, throughput decrease, latency increase and jitter variation to observe the behavior of these CG platforms under extreme network conditions. Our findings show that the four platforms exhibit different adaptation behaviors. Moreover, many cases result in a degraded QoS, leaving room for further improvements at both application and/or network levels.

The Bitcoin blockchain is managed by an underlying peer-to-peer network. This network is responsible for the propagation of transactions carried out by users via the blocks (which contain the validated transactions), and to ensure consensus between the different nodes. The quality and safety of this network are therefore particularly essential. In this work, we present an open dataset on the peers composing the Bitcoin P2P Network that was made following a well defined and reproducible methodology. We also provide a first analysis of the dataset on three criteria: the number of public nodes and their client version and geographical distribution.

Traffic monitoring is essential for network management tasks that ensure security and QoS. However, the continuous increase of HTTPS traffic undermines the effectiveness of current service-level monitoring that can only rely on unreliable parameters from the TLS handshake (X.509 certificate, SNI) or must decrypt the traffic. We propose a new machine learning-based method to identify HTTPS services without decryption. By extracting statistical features on TLS handshake packets and on a small number of application data packets, we can identify HTTPS services very early in the session. Extensive experiments performed over a significant and open dataset show that our method offers a good accuracy and a prototype implementation confirms that the early identification of HTTPS services is satisfied.

Encrypted HTTP/2 (h2) has been worldwide adopted since its official release in 2015. The major services over Internet use it to protect the user privacy against traffic interception. However, under the guise of privacy, one can hide the abnormal or even illegal use of a service. It has been demonstrated that machine learning algorithms combined with a proper set of features are still able to identify the incriminated traffic even when it is encrypted with h2. However, it can also be used to track normal service use and so endanger privacy of Internet users. Independently of the final objective, it is extremely important for a security practitioner to understand the efficiency of such a technique and its limit. No existing research has been achieved to assess how generic is it to be directly applicable to any service or website and how long an acceptable accuracy can be maintained. This paper addresses these challenges by defining an experimental methodology applied on more than 3000 different websites and also over four months continuously. The results highlight that an off-the-shelf machine-learning method to classify h2 traffic is applicable to many websites but a weekly training may be needed to keep the model accurate.

HTTPS is quickly rising alongside the need of Internet users to benefit from security and privacy when accessing the Web, and it becomes the predominant application protocol on the Internet. This migration towards a secure Web using HTTPS comes with important challenges related to the management of HTTPS traffic to guarantee basic network properties such as security, QoS, reliability, etc. But encryption undermines the effectiveness of standard monitoring techniques and makes it difficult for ISPs and network administrators to properly identify and manage the services behind HTTPS traffic. This survey details the techniques used to monitor HTTPS traffic, from the most basic level of protocol identification (TLS, HTTPS), to the finest identification of precise services. We show that protocol identification is well mastered while more precise levels keep being challenging despite recent advances. We also describe practical solutions that lead us to discuss the trade-off between security and privacy and the research directions to guarantee both of them.

Nowadays, most of Web services are accessed through HTTPS. While preserving user privacy is important, it is also mandatory to monitor and detect specific users' actions, for instance, according to a security policy. This paper presents a solution to monitor HTTP/2 traffic over TLS. It highly differs from HTTP/1.1 over TLS traffic what makes existing monitoring techniques obsolete. Our solution, H2Classifier, aims at detecting if a user performs an action that has been previously defined over a monitored Web service, but without using any decryption. It is thus only based on passive traffic analysis and relies on random forest classifier. A challenge is to extract representative values of the loaded content associated to a Web page, which is actually customized based on the user action. Extensive evaluations with five top used Web services demonstrate the viability of our technique with an accuracy between 94% and 99%.