We present a parameterizable methodology for profiling Internet traffic flows at a variety of granularities. Our methodology differs from many previous studies that have concentrated on end-point definitions of flows in terms of state derived from observing the explicit opening and closing of TCP connections. Instead, our model defines flows based on traffic satisfying various temporal and spatial locality conditions, as observed at internal points of the network. This approach to flow characterization helps address some central problems in networking based on the Internet model. Among them are route caching, resource reservation at multiple service levels, usage based accounting, and the integration of IP traffic over an ATM fabric. We first define the parameter space and then concentrate on metrics characterizing both individual flows as well as the aggregate flow profile. We consider various granularities of the definition of a flow, such as by destination network, host-pair, or host and port quadruple. We include some measurements based on case studies we undertook, which yield significant insights into some aspects of Internet traffic, including demonstrating (i) the brevity of a significant fraction of IP flows at a variety of traffic aggregation granularities, (ii) that the number of host-pair IP flows is not significantly larger than the number of destination network flows, and (iii) that schemes for caching traffic information could significantly benefit from using application information. >

A parameterizable methodology for Internet traffic flow profiling

An algorithm for fusing the alerts produced by multiple heterogeneous intrusion detection systems is presented. The algorithm runs in real-time, combining the alerts into scenarios; each is composed of a sequence of alerts produced by a single actor or organization. The software is capable of discovering scenarios even if stealthy attack methods, such as forged IP addresses or long attack latencies, are employed. The algorithm generates scenarios by estimating the probability that a new alert belongs to a given scenario. Alerts are then added to the most likely candidate scenario. Two alternative probability estimation techniques are compared to an algorithm that builds scenarios using a set of rules. Both probability estimate approaches make use of training data to learn the appropriate probability measures. Our algorithm can determine the scenario membership of a new alert in time proportional to the number of candidate scenarios.

Fusing A Heterogeneous Alert Stream Into Scenarios

We explore various network layer concepts that play a crucial role in the design of mobile networking systems. We show that mobility is essentially an address translation problem and is best resolved at the network layer. We describe services that must be supported at the network layer to carry out the task of address translation. Using these service primitives as building blocks, we describe a network-layer architecture which enables smooth integration of mobile end systems within the existing Internet. A summary of some of the key mobile IP proposals is presented, and it is shown that each proposal can be viewed as a special case of the architecture outlined in this article.

/pdf/network-layer-mobility-an-architecture-and-survey-3ce7zoo08n.pdf

Network layer mobility: an architecture and survey

The rapid increase in web usage has led to dramatically increased loads on the network infrastructure and on individual web servers. To ameliorate these mounting burdens, there has been much recent interest in web caching architectures and algorithms. Web caching reduces network load, server load, and the latency of responses. However, web caching has the disadvantage that the pages returned to clients by caches may be stale, in that they may not be consistent with the version currently on the server. In this paper we describe a scalable web cache consistency architecture that provides fairly tight bounds on the staleness of pages. Our architecture borrows heavily from the literature, and can best be described as an invalidation approach made scalable by using a caching hierarchy and application-level multicast routing to convey the invalidations. We evaluate this design with calculations and simulations, and compare it to several other approaches.

A scalable Web cache consistency architecture

We present the architecture for data collection for the NSFNET backbone and diiculties with using the collected statistics for long-term network forecasting of certain traac aspects. We describe relevant aspects of the NSFNET backbone architecture and the instrumentation for statistics collection. We then present long-term NSFNET data to elucidate long-term trends in both the reachability of Internet components via the NSFNET as well as the growing cross-section of traac. We focus on the diiculties of forecasting and planning in an infrastructure whose protocol architecture and instrumentation for data collection was not designed to support such objectives.

Tracking long-term growth of the NSFNET

Simple mechanisms for introducing hierarchy into the interdomain routing system, making it practical to route a truly large Internet, are described. It is shown that addresses need to be assigned along network topological lines to maximise the reduction in routing overhead. Simplifying the mechanisms for changing hot addresses makes it possible to renumber a network so that it has a topologically significant address when the site changes position within the routing system. These proposals make it possible to significantly increase the utilization of addresses and extend the time the Internet can use the Internet Protocol (IP) Version 4. >

Y. Rekhter

Papers

Improving the routing and addressing of IP