Machine Learning is the study of methods for programming computers to learn. Computers are applied to a wide range of tasks, and for most of these it is relatively easy for programmers to design and implement the necessary software. However, there are many tasks for which this is difficult or impossible. These can be divided into four general categories. First, there are problems for which there exist no human experts. For example, in modern automated manufacturing facilities, there is a need to predict machine failures before they occur by analyzing sensor readings. Because the machines are new, there are no human experts who can be interviewed by a programmer to provide the knowledge necessary to build a computer system. A machine learning system can study recorded data and subsequent machine failures and learn prediction rules. Second, there are problems where human experts exist, but where they are unable to explain their expertise. This is the case in many perceptual tasks, such as speech recognition, hand-writing recognition, and natural language understanding. Virtually all humans exhibit expert-level abilities on these tasks, but none of them can describe the detailed steps that they follow as they perform them. Fortunately, humans can provide machines with examples of the inputs and correct outputs for these tasks, so machine learning algorithms can learn to map the inputs to the outputs. Third, there are problems where phenomena are changing rapidly. In finance, for example, people would like to predict the future behavior of the stock market, of consumer purchases, or of exchange rates. These behaviors change frequently, so that even if a programmer could construct a good predictive computer program, it would need to be rewritten frequently. A learning program can relieve the programmer of this burden by constantly modifying and tuning a set of learned prediction rules. Fourth, there are applications that need to be customized for each computer user separately. Consider, for example, a program to filter unwanted electronic mail messages. Different users will need different filters. It is unreasonable to expect each user to program his or her own rules, and it is infeasible to provide every user with a software engineer to keep the rules up-to-date. A machine learning system can learn which mail messages the user rejects and maintain the filtering rules automatically. Machine learning addresses many of the same research questions as the fields of statistics, data mining, and psychology, but with differences of emphasis. Statistics focuses on understanding the phenomena that have generated the data, often with the goal of testing different hypotheses about those phenomena. Data mining seeks to find patterns in the data that are understandable by people. Psychological studies of human learning aspire to understand the mechanisms underlying the various learning behaviors exhibited by people (concept learning, skill acquisition, strategy change, etc.).

Machine learning

Data Mining Practical Machine Learning Tools and Techniques

The modern science of networks has brought significant advances to our understanding of complex systems. One of the most relevant features of graphs representing real systems is community structure, or clustering, i. e. the organization of vertices in clusters, with many edges joining vertices of the same cluster and comparatively few edges joining vertices of different clusters. Such clusters, or communities, can be considered as fairly independent compartments of a graph, playing a similar role like, e. g., the tissues or the organs in the human body. Detecting communities is of great importance in sociology, biology and computer science, disciplines where systems are often represented as graphs. This problem is very hard and not yet satisfactorily solved, despite the huge effort of a large interdisciplinary community of scientists working on it over the past few years. We will attempt a thorough exposition of the topic, from the definition of the main elements of the problem, to the presentation of most methods developed, with a special focus on techniques designed by statistical physicists, from the discussion of crucial issues like the significance of clustering and how methods should be tested and compared against each other, to the description of applications to real networks.

/pdf/community-detection-in-graphs-34rogm3r6p.pdf

Community detection in graphs

Statistics for Spatial Data.

As the Internet infrastructure evolves to include quality of service (QoS), a lot of work has been done on how to allocate network resources to satisfy the QoS requirements of IP flows. Less attention is being paid to mapping the network QoS specifications, e.g., network delay and loss rate, to the (perceived) end-to-end performance of user applications, e.g., the latency of retrieving a Web page. We study the impact of the network QoS on the perceived end-to-end performance of user applications. We first propose a generic testbed using a combination of simulation and emulation techniques. It can be used to evaluate the end-to-end performance of user applications in different network environments. Next, we use this testbed to study the effect of network QoS metrics on the perceptual quality of various user applications. We focus on estimating the latency of Web retrieval under given packet delay and loss rate and derive an accurate and efficient TCP short connection performance model.

/pdf/understanding-end-to-end-performance-testbed-and-primary-osp0hhlehk.pdf

Understanding end-to-end performance: testbed and primary results

A system and method for detecting and diagnosing routing problems in a network in real-time by recording TCP flow information from at least one server to at least one prefix, and observing retransmission packets communicated from the at least one server to the at least one prefix. When a predetermined threshold for TCP flows to a prefix is reached, traceroutes may be triggered to a destination in the prefix, and the traceroutes analyzed to determine whether to issue an alarm for a routing failure. The system includes a real-time data collection engine for recording unidirectional TCP flow information, a real-time detection engine for observing the retransmission packets and issuing a warning upon a retransmission counter exceeding a predetermined threshold, and a real-time diagnosis engine for triggering at least one traceroute to a destination in the prefix that is randomly selected from TCP flows in retransmission states.

System and method for real-time diagnosis of routing problems

As the Internet infrastructure evolves to include Quality of Service (QoS), it is necessary to map application quality requi rements to network performance specifications in terms of delay and loss ra te. In this paper, we first propose a new testbed by using a combination of si mulation and emulation technics. Next, we use this testbed in studyin g the effect of network performance metrics on the perceptual quality of various applications to demonstrate the applicability of the testbed. We ex amine two typical applications on the basis the new testbed: the World Wide Weband the Internet Telephony. In our study of the World Wide Web, we derived a new TCP short connection model that computes the latency of Web r etrieval accurately and efficiently given only the packet delay and loss rate characteristics apriori. In the study of Internet telephony, we show that the packet delay variance is the dominant network characteristics which aff ect the perceptual quality. As a result, the service quality drops dramatically when the network offered load reaches80%. This can serve as a guideline for studies towards improving service quality of Internet telephony.

http://ecommons.cornell.edu/bitstream/1813/7408/1/99-1754.pdf

The Implication of Network Performance on Service Quality

This paper presents Virtual Aggregation, an architecture that attempts to tackle the Internet routing scalability problem. Our approach does not require any changes to router software and routing protocols and can be deployed by any ISP without the cooperation of other ISPs. Hence, Virtual Aggregation is a configuration-only solution. The key insight here is to use divide-and-conquer so that default-free zone routers don’t need to maintain the entire routing table. Instead, an ISP can modify its internal routing such that individual routers in its network only maintain a part of the routing table. We evaluate the application of Virtual Aggregation to a few tier-1 and tier-2 ISPs and show that it can reduce routing table size on individual routers by an order of magnitude while imposing almost no traffic stretch and very little increase in router load. We also deploy Virtual Aggregation across two different testbeds comprising of Cisco and Linux routers. Finally, we detail some shortcomings of the proposed design and discuss alternative designs that alleviate some of these. However, in spite of the limitations, we believe that the simplicity of the proposal and its possible short-term impact on routing scalability suggest that it is an alternative worth considering.

/pdf/a-dirty-slate-approach-to-routing-scalability-2dg7xsrsuj.pdf

A Dirty-Slate Approach to Routing Scalability

Prefix hijacking is known as one of the security threats on today’s Internet. A number of measurement based solutions have been proposed to detect prefix hijacking even ts. In this paper we take these solutions one step further by addres sing the problem of locating the attacker in each of the detected hijacking event. Being able to locate an attacker is critical for deciding at the earliest time the proper mitigation mechani sms to invoke to limit the impact of the attack and successfully stopping the attack. In this paper, we propose a robust scheme named LOCK, LOcating Countermeasure-capable hijacKers, for locating the prefix hijacker ASes based on distributed data-plane Internet measurements. LOCK locates each attacker AS by actively monitoring paths to the victim prefix from a small number of carefully selected monitors distributed on the Internet. More importantly, LOCK is robust against various countermeasures that the hijackers may employ. This is achieved by taking advantage of two observations: that the hijacker cannot manipulate the data-plane path before a packet reaches the hijacker, an d that the data-plane paths to victim prefix “converge” around the hijacker AS. We have deployed LOCK on a number of PlanetLab nodes and conducted several large scale measurem nts and experiments to evaluate the performance of LOCK against three sets of hijacking attacks: synthetic attacks, recons tructed previously known attacks, and controlled attacks on the Int ernet. Our evaluation results show that LOCK is able to pinpoint the prefix hijacker AS with an accuracy of over 90%.

/pdf/lock-locating-countermeasure-capable-prefix-hijackers-28wdwni5d8.pdf

Jia Wang

Papers

Understanding end-to-end performance: testbed and primary results

System and method for real-time diagnosis of routing problems

The Implication of Network Performance on Service Quality

A Dirty-Slate Approach to Routing Scalability

LOCK: Locating Countermeasure-Capable Prefix Hijackers