INFOCOM 2018 论文列表

Recent observations have shown that most of the attacks are fruits of collaboration among attackers. In this work we have developed a coalition formation game to model the collusive behavior among attackers. The novelty of this work is that we are the first to investigate the coalition formation dynamics among attackers with different efficiency. Most of the related works have modeled the attacker as a single entity. We define a new parameter called friction to represent the unwillingness of an attacker to collude. We have shown that the proportion of attackers in the Maximum Average Payoff Coalition (MAPC) decreases with efficiency. We have also shown that as the friction increases, size and heterogeneity of MAPC decrease. We show, using text analysis on a hacker web forum chat data, that the hacker collaboration network shows a strong small-world characteristics. We identify the leaders in these coalitions. The cluster compositions of the hacker collaboration network agree with our model. We also develop method to estimate the friction parameters for the attackers to decide optimal coalition to join. As this model provides insight into coalition formation among attackers, e.g., leaders, composition, and homogeneity, this model will be helpful to develop better defender strategies.

High-Ievel programming and programmable data paths are two key capabilities of software-defined networking (SDN). A fundamental problem linking these two capabilities is whether a given high-level SDN program can be realized onto a given low-level SDN datapath structure. Considering all high-level programs that can be realized onto a given datapath as the programming capacity of the datapath, we refer to this problem as the SDN data path programming capacity problem. In this paper, we conduct the first study on the SDN datapath programming capacity problem, in the general setting of high-level, datapath oblivious, algorithmic SDN programs and state-of-art multi-table SDN data path pipelines. In particular, considering datapath-oblivious SDN programs as computations and datapath pipelines as computation capabilities, we introduce a novel framework called SDN characterization junctions, to map both SDN programs and datapaths into a unifying space, deriving the first rigorous result on SDN datapath programming capacity. We not only prove our results but also conduct realistic evaluations to demonstrate the tightness of our analysis.

802.11ax introduces OFDMA to WiFi. It thus enables multiplexing users/user groups in the frequency domain. WiFi networks usually operate in a multipath environment which generates a frequency selective channel. Hence, the capacity of a user/user group changes over different subcarriers. A good scheduling and resource allocation scheme can maximize the sum rate by allocating users and user groups on subcarriers based on their CSI and other system considerations. In this paper we investigate how to optimally assign users and user groups to subcarriers with the goal of maximizing the user sum rate in the context of 802.11ax. We introduce a novel divide and conquer based algorithm which we prove to be optimal under the assumption that a user can be assigned to more than one resource unit (RU) which consists of one ore more subcarriers. This serves as a tight upper bound on the actual problem where users/user groups can be assigned to a single RU only per the 802.11ax standard. We then introduce two practical algorithms for the actual problem, a greedy one and a recursive one which jointly splits the bandwidth into RUs and schedules users on them. Extensive simulations comparing the performance of the aforementioned algorithms establish that our practical schemes achieve very good performance in all studied scenarios.

Information Centric Networking (ICN) has been regarded as an ideal architecture for the next-generation network to handle users' increasing demand for content delivery with in-network cache. While making better use of network resources and providing better delivery service, an effective access control mechanism is needed due to wide dissemination of contents. However, in the existing solutions, making cache-enabled routers or content providers authenticate users' requests causes high computation overhead and unnecessary delay. Also, straightforward utilization of advanced encryption algorithms increases the opportunities for DoS attacks. Besides, privacy protection and service accountability are rarely taken into account in this scenario. In this paper, we propose a secure, efficient, and accountable access control framework, called SEAF, for ICN, in which authentication is performed at the network edge to block unauthorized requests at the very beginning. We adopt group signature to achieve anonymous authentication, and use hash chain technique to greatly reduce the overhead when users make continuous requests for the same file. Furthermore, the content providers can affirm the service amount received from the network and extract feedback information from the signatures and hash chains. By formal security analysis and the comparison with related works, we show that SEAF achieves the expected security goals and possesses more useful features. The experimental results also demonstrate that our design is efficient for routers and content providers, and introduces only slight delay for users' content retrieval.

We present ONIS, a new scanning technique that can perform network measurements such as: inferring TCP/IP-based trust relationships off-path, stealthily port scanning a target without using the scanner's IP address, detecting off-path packet drops between two international hosts. These tasks typically rely on a core technique called the idle scan, which is a special kind of port scan that appears to come from a third machine called a zombie. The scanner learns the target's status from the zombie by using its TCP/IP side channels. Unfortunately, the idle scan assumes that the zombie has IP identifiers (IPIDs) which exhibit the now-discouraged behavior of being globally incrementing. The use of this kind of IPID counter is becoming increasingly rare in practice. Our technique, unlike the idle scan, is based on a much more advanced IPID generation scheme, that of the prevalent Linux kernel. Although Linux's IPID generation scheme is specifically intended to reduce information flow, we show that using Linux machines as zombies in an indirect scan is still possible. ONIS has 87% accuracy, which is comparable to nmap's implementation of the idle scan at 86%. ONIS's much broader choice of zombies will enable it to be a widely used technique which can fulfill various network measurement tasks.

In a sybil attack, an adversary creates a large number of fake identities/nodes and have them join the system. Computational puzzles have long been investigated as a possible sybil defense: If a node fails to solve the puzzle in a timely fashion, it will no longer be accepted by other nodes. However, it is still possible for a malicious node to behave in such a way that it is accepted by some honest nodes but not other honest nodes. This results in different honest nodes having different views on which set of nodes should form the system. Such view divergence, unfortunately, breaks the overarching assumption required by many existing security protocols. Partly spurred by the growing popularity of Bitcoin, researchers have recently formalized the above view divergence problem and proposed interesting solutions (which we call view reconciliation protocols). For example, in CRYPTO 2015, Andrychowicz and Dziembowski proposed a view reconciliation protocol with Θ(N) time complexity, with N being the number of honest nodes in the system. All existing view reconciliation protocols so far have a similar Θ(N) time complexity. As this paper's main contribution, we propose a novel view reconciliation protocol with a time complexity of only Θ([ln N/ln ln N]). To achieve such an exponential improvement, we aggressively exploit randomization.

Millimeter wave (mmWave) communications are an essential component of 5G-and-beyond ultra-dense Gbit/s wireless networks, but also pose significant challenges related to the communication environment. Especially beam-training and tracking, device association, and fast handovers for highly directional mmWave links may potentially incur a high overhead. At the same time, such mechanisms would benefit greatly from accurate knowledge about the environment and device locations that can be provided through simultaneous localization and mapping (SLAM) algorithms. In this paper we tackle the above issues by proposing CLAM, a distributed mmWave SLAM algorithm that works with no initial information about the network deployment or the environment, and achieves low computational complexity thanks to a fundamental reformulation of the angle-differences-of-arrival mm Wave anchor location estimation problem. All information required by CLAM is collected by a mmWave device thanks to beam training and tracking mechanisms inherent to mm Wave networks, at no additional overhead. Our results show that CLAM achieves submeter accuracy in the great majority of cases. These results are validated via an extensive experimental measurement campaign carried out with 60-GHz mmWave hardware.

The trends of the increasing middleboxes make the middle network more and more complex. Today, many middleboxes work on application layer and offer significant network services by the plain-text traffic, such as firewalling, intrusion detecting and application layer gateways. At the same time, more and more network applications are encrypting their data transmission to protect security and privacy. It is becoming a critical task and hot topic to continue providing application-layer middlebox services in the encrypted Internet, however, the state of the art is far from being able to be deployed in the real network. In this paper, we propose a practical architecture, named PlainBox, to enable session key sharing between the communication client and the middleboxes in the network path. It employs Attribute-Based Encryption (ABE) in the key sharing protocol to support multiple chaining middleboxes efficiently and securely. We develop a prototype system and apply it to popular security protocols such as TLS and SSH. We have tested our prototype system in a lab testbed as well as real-world websites. Our result shows PlainBox introduces very little overhead and the performance is practically deployable.

The Internet in Africa is evolving rapidly, yet remains significantly behind other regions in terms of performance and ubiquity of access. This clearly has negative consequences for the residents of Africa, but also has implications for organisations designing future networked technologies that might see deployment in the region. This paper presents a measurement campaign methodology to explore the current state of the African Internet. Using vantage points across the continent, we perform the first large-scale mapping of inter-country delays in Africa. Our analysis reveals a number of clusters, where countries have built up low delay interconnectivity, dispelling the myth that intra-communications in Africa are universally poor. Unfortunately, this does not extend to the remainder of the continent, which typically suffers from excessively high delays, often exceeding 300ms. We find that in many cases it is faster to reach European or North American networks that those in other regions of Africa. By mapping the internetwork topology, we identify a number of shortcomings in the infrastructure, most notably an excessive reliance on intercontinental transit providers.

In this work, we examine the problem of adaptively uncovering network topology in an incomplete network, to support more accurate decision making in various real-world applications, such as modeling for reconnaissance attacks and network probing. While this problem has been partially studied, we provide a novel take on it by modeling it with a set of crawlers termed “bots” which can uncover independent portions of the network in parallel. Accordingly, we develop three adaptive algorithms, which make decisions based on previous observations due to incomplete information, namely AGP, a sequential method; FastAGP, a parallel algorithm; and ALSP, an extension of FastAGP uses local search to improve guarantees. These algorithms are proven to have 1/3, 1/7, and 1/ (5 + ϵ) approximation ratios, respectively. The key analysis of these algorithms is the connection between adaptive algorithms and an intersection of multiple partition matroids. We conclude with an evaluation of these algorithms to quantify the impact of both adaptivity and parallelism. We find that in practice, adaptive approaches perform significantly better, while FastAGP performs nearly as well as AGP in most cases despite operating in a massively parallel fashion. Finally, we show that a balance between the quantity and quality of bots is ideal for maximizing observation of the network.

A Service Function Chain (SFC) is an ordered sequence of network functions, such as load balancing, content filtering, and firewall. With the Network Function Virtualization (NFV) paradigm, network functions can be deployed as pieces of software on generic hardware, leading to a flexibility of network service composition. Along with its benefits, NFV brings several challenges to network operators, such as the placement of virtual network functions. In this paper, we study the problem of how to optimally place the network functions within the network in order to satisfy all the SFC requirements of the flows. Our optimization task is to minimize the total deployment cost. We show that the problem can be seen as an instance of the Set Cover Problem, even in the case of ordered sequences of network functions. It allows us to propose two logarithmic factor approximation algorithms which have the best possible asymptotic factor. Further, we devise an optimal algorithm for tree topologies. Finally, we evaluate the performances of our proposed algorithms through extensive simulations. We demonstrate that near-optimal solutions can be found with our approach.

A large population of users gets affected by sudden slowdown or shutdown of an enterprise application. System administrators and analysts spend considerable amount of time dealing with functional and performance bugs. These problems are particularly hard to detect and diagnose in most computer systems, since there is a huge amount of system generated supportability data (counters, logs etc.) that need to be analyzed. Most often, there isn't a very clear or obvious root cause. Timely identification of significant change in application behavior is very important to prevent negative impact on the service. In this paper, we present ADELE, an empirical, data-driven methodology for early detection of anomalies in data storage systems. The key feature of our solution is diligent selection of features from system logs and development of effective machine learning techniques for anomaly prediction. ADELE learns from system's own history to establish the baseline of normal behavior and gives accurate indications of the time period when something is amiss for a system. Validation on more than 4800 actual support cases shows~83% true positive rate and~12% false positive rate in identifying periods when the machine is not performing normally. We also establish the existence of problem “signatures” which help map customer problems to already seen issues in the field. ADELE's capability to predict early paves way for online failure prediction for customer systems.

The great potential of mobile crowdsourcing has started to attract attention of both industries and the research community. However, current commercial mobile crowdsourcing marketplaces are unsatisfactory because of the limited worker base and functionality. In this paper, we first revisit the foundation of performing mobile crowdsourcing on location-based social networks (LBSNs) through specially designed survey studies and comparison experiments involving hundreds of users. Our results reveal that active check-ins are good indicators of picking a right user to perform tasks, and LBSN could be an ideal platform for mobile crowdsourcing given proper services provided. We then propose both the centralized and decentralized design of MobiCrowd, a mobile crowdsourcing service built on LBSNs. Our evaluation, through trace-driven simulation and real-world experiments, demonstrates that the proposed schemes can effectively find workers for mobile crowdsourcing tasks associated with different venues by analyzing their location check-in histories.

Localization based on premeasured WiFi fingerprints is a popular method for indoor localization where satellite based positioning systems are unavailable. In these systems, privacy of the user's location is lost because the location is computed by the service provider. In INFOCOM'14, Li et al. presented PriWFL, a WiFi fingerprint localization system based on additively homomorphic Paillier encryption, that was claimed to protect both the users' location privacy and the service provider's database privacy. In this paper, we demonstrate a severe weakness in PriWFL that allows an attacker to compromise the service provider's database under a realistic attack model and also identify certain other problems in PriWFL that decrease its localization accuracy. Hence, we show that PriWFL does not solve the privacy problems of WiFi fingerprint localization. We also explore different solutions to implement secure privacy-preserving WiFi fingerprint localization and propose two schemes based on Paillier encryption which do not suffer from the weakness of PriWFL and offer the same localization accuracy as the privacy-violating schemes.

Upcoming mobile network technologies developed in the context of 5G and DSRC are expected to finally legitimize direct data transfers among vehicles as a standard communication paradigm. We investigate fundamental properties of the topology of vehicular networks built on top of these emerging vehicle-to-vehicle communication technologies. Our study yields multiple elements of originality: ( i) it addresses temporal connectivity, which has been poorly investigated despite a high relevance for vehicular network operations; (ii) it introduces exact but computationally efficient models of the temporal connectivity of vehicular networks; (iii) it evaluates the proposed models in urban settings that exhibit an unprecedented combination of dependability, scale and generality of vehicular mobility. This approach lets us unveil an apparent scale-and city-invariant law of temporal reachability in vehicular networks. Finally, we open our original scenarios to the research community, so as to ensure reproducibility of our results and foster further investigations of vehicular network performance.

With the advent of cloud container technology, enterprises develop applications through microservices, breaking monolithic software into a suite of small services whose instances run independently in containers. User requests are served by a series of microservices forming a chain, and the chains often share microservices. Existing load balancing strategies either incur significant networking overhead or ignore the competition for shared microservices across chains. Furthermore, typical load balancing solutions leverage a hybrid technique by combining HTTP with message queue to support microservice communications, bringing additional operational complexity. To address these challenges, we propose a chain-oriented load balancing algorithm (COLBA) based solely on message queues, which balances load based on microservice requirements of chains to minimize response time. We model the load balancing problem as a non-cooperative game, and leverage Nash bargaining to coordinate microservice allocation across chains. Employing convex optimization with rounding, we efficiently solve the problem that is proven NP-hard. Extensive trace-driven simulations demonstrate that COLBA reduces the overall average response time at least by 13% compared with existing load balancing strategies.

Benefited from recent breakthrough in wireless power transfer technology, the lifetime of wireless sensor networks (WSNs) can be prolonged significantly, generating the concept of wireless rechargeable sensor networks (WRSNs). While most recent works have been focusing on WRSNs with a single wireless charging vehicle (WCV), we investigate the issue of multiple WCVs' on-line collaborative charging schedules in this work. In our design, termed mTS, the network area is divided into subdomains for designated WCVs. Each WCV schedules its charging scheduling path by responding to the interdependency of temporal and spatial correlations from different charging requests. Higher priorities are given to sensor requests with a mixture of closer charging deadlines and closer distances. We further analyze the system performance with an M/M/n/mTS queueing model. Our further study through simulations revealed that our scheme excels in successful charging rate, sensor survival rate, and other related performance metrics. Our field experiments further confirmed these results and showed some further interesting findings on different charging hardware and methods.

Typical data analytics systems abstract jobs as directed acyclic graphs (DAGs). It is crucial to maximize throughput and speedup completions for DAG jobs in practice. Existing works propose clairvoyant schedulers optimizing these goals, however, they assume complete job information as a prior knowledge which limits their applicability. Instead, we remove the complete prior knowledge assumption and rely solely on a partial prior information, which is more practical. And we design a semi-clairvoyant task scheduler Cobra working within each job. Cobra adaptively adjusts its resource desires in a multiplicative-increase multiplicative-decrease (MIMD) manner according to nearly past resource utilizations and the current waiting tasks. On the other hand, Cobra seeks to satisfy task locality preferences by allowing each task to wait for some time that is bounded by a parameterized threshold. Surprisingly, even with the partial prior job information, we theoretically prove, Cobra, when working with the widely used fair job scheduler, is O(1)-competitive with respect to both makespan and average job response time. We experimentally validate that the performance promotion of Cobra in both real system deployment and trace-driven simulations.

We consider a general small-scale market for agent-to-agent resource sharing, in which each agent could either be a server (seller) or a client (buyer) in each time period. In every time period, a server has a certain amount of resources that any client could consume, and randomly gets matched with a client. Our target is to maximize the resource utilization in such an agent-to-agent market, where the agents are strategic. During each transaction, the server gets money and the client gets resources. Hence, trade ratio maximization implies efficiency maximization of our system. We model the proposed market system through a Mean Field Game approach and prove the existence of the Mean Field Equilibrium, which can achieve an almost 100% trade ratio. Finally, we carry out a simulation study motivated by an agent-to-agent computing market, and a case study on a proposed photovoltaic market, and show the designed market benefits both individuals and the system as a whole.