@inproceedings {Bae2015, title = {Cache Oblivious Scheduling of Shared Workloads}, booktitle = {31st IEEE International Conference on Data Engineering (ICDE)}, year = {2015}, month = {05/2015}, publisher = {IEEE}, organization = {IEEE}, address = {Seoul, Korea}, abstract = {

Shared workload optimization is feasible if the set of tasks to be executed is known in advance, as is the case in updating a set of materialized views or executing an extract-transform-load workflow. In this paper, we consider dataintensive shared workloads with precedence constraints arising from data dependencies, i.e., before executing some task, other tasks may have to run first and generate some data needed by the next task(s). While there has been previous work on identifying common subexpressions in shared workloads and task re-ordering to enable shared scans, in this paper we go a step further and solve the problem of scheduling shared data-intensive workloads in a cache-oblivious way. Our solution relies on a novel formulation of precedence constrained scheduling with the additional constraint that once a data item is in the cache, all tasks that require this data item should execute as soon as possible thereafter. The intuition behind this formulation is that the longer a data item remains in the cache, the more likely it is to be evicted regardless of the cache size. We give an optimal ordering algorithm using A* search over the space of possible orderings, and we propose efficient and effective heuristics that obtain nearly-optimal results in much less time. We present experimental results on real-life data warehouse workloads and the TCP-DS benchmark to validate our claims.

}, author = {Arian B{\"a}r and Lukasz Golab and Stefan Ruehrup and Mirko Schiavone and Pedro Casas} } @article {D61, title = {Demonstration Plan}, number = {D6.1}, year = {2015}, month = {01/2015}, type = {Public Deliverable}, issn = {D6.1}, author = {Pedro Casas and Edion Tego and Francesco Matera and Maurizio Dusi and A. Bakay and Balazs Szabo and G. Rozsa and Stefano Traverso and Ilias Leontiadis and L. Baltrunas and Yan Grunenberger and Andrea Fregosi and A. Kahveci and Eike Kowallik and G. Mattellini and C. Meregalli and Stefano Raffaglio and M. Russo and Andrea Sannino and M. Scarpino} } @inproceedings {TrKu15, title = {Enabling Internet-Wide Deployment of Explicit Congestion Notification}, booktitle = {Proceedings of the 2015 Passive and Active Measurement Conference}, year = {2015}, month = {03/2015}, address = {New York}, abstract = {

\ac{ECN} is an TCP/IP extension to signal network congestion without packet loss, which has barely seen deployment though it was standardized and implemented more than a decade ago. On-going activities in research and standardization aim to make the usage of \ac{ECN} more beneficial. This measurement study provides an update on deployment status and newly assesses the marginal risk of enabling \ac{ECN} negotiation by default on client end-systems. Additionally, we dig deeper into causes of connectivity and negotiation issues linked to \ac{ECN}. We find that about five websites per thousand suffer additional connection setup latency when fallback per RFC 3168 is correctly implemented; we provide a patch for Linux to properly perform this fallback. Moreover, we detect and explore a number of cases in which \ac{ECN} brokenness is clearly path-dependent, i.e. on middleboxes beyond the access or content provider network. Further analysis of these cases can guide their elimination, further reducing the risk of enabling \ac{ECN} by default.

}, author = {Brian Trammell and Mirja K{\"u}hlewind and Damiano Boppart and Iain Learmonth and Gorry Fairhurst and Richard Scheffenegger} } @inproceedings {TrKuPAM15, title = {Enabling Internet-Wide Deployment of Explicit Congestion Notification}, booktitle = {Proceedings of the 2015 Passive and Active Measurement Conference}, year = {2015}, month = {Mar}, address = {New York}, url = {http://ecn.ethz.ch/ecn-pam15.pdf}, author = {Brian Trammell and Mirja K{\"u}hlewind and Damiano Boppart and Iain Learmonth and Gorry Fairhurst and Richard Scheffenegger} } @inproceedings {DR:INFOCOM-15a, title = {A Fistful of Pings: Accurate and Lightweight Anycast Enumeration and Geolocation}, booktitle = {IEEE INFOCOM}, year = {2015}, month = {04/2015}, abstract = {

Use of IP-layer anycast has increased in the last few years: once relegated to DNS root and top-level domain servers, anycast is now commonly used to assist distribution of general purpose content by CDN providers. Yet, the measurement techniques for discovering anycast replicas have been designed around DNS, limiting their usefulness to this particular service. This raises the need for protocol agnostic methodologies, that should additionally be as lightweight as possible in order to scale up anycast service discovery. This is precisely the aim of this paper, which proposes a new method for exhaustive and accurate enumeration and city-level geolocation of anycast instances, requiring only a handful of latency measurements from a set of known vantage points. Our method exploits an iterative workflow that enumerates (an optimization problem) and geolocates (a classification problem) anycast replicas. We thoroughly validate our methodology on available ground truth (several DNS root servers), using multiple measurement infrastructures (PlanetLab, RIPE), obtaining extremely accurate results (even with simple algorithms, that we compare with the global optimum), that we make available to the scientific community. Compared to the state of the art work that appeared in INFOCOM 2013 and IMC 2013, our technique (i) is not bound to a specific protocol, (ii) requires 1000 times fewer vantage points, not only (iii) achieves over 50\% recall but also (iv) accurately identifies the city-level geolocation for over 78\% of the enumerated servers, with (v) a mean geolocation error of 361 km for all enumerated servers.

}, url = {http://www.enst.fr/~drossi/paper/rossi15infocom.pdf}, author = {Cicalese, Danilo and Joumblatt, Diana and Rossi, Dario and Buob, Marc-Olivier and Auge, Jordan and Friedman, Timur} } @inproceedings {Dim2015, title = {Identifying the Root Cause of Video Streaming Issues on Mobile Devices}, booktitle = {CoNext}, year = {2015}, author = {G. Dimopoulos and I. Leontiadis and P. Barlet-Ros and K. Papagiannaki and P. Steenkiste} } @inproceedings {DR:TRAC-15, title = {Impact of Carrier-Grade NAT on Web Browsing}, booktitle = { 6th International Workshop on TRaffic Analysis and Characterization (TRAC) - The paper won the BEST PAPER award}, year = {2015}, month = {08/2015}, publisher = {IEEE}, organization = {IEEE}, address = {Dobrovnik, Croatia}, abstract = {

Public IPv4 addresses are a scarce resource. While IPv6 adoption is lagging, Network Address Translation (NAT) technologies have been deployed over the last years to alleviate IPv4 exiguity and their high rental cost. In particular, Carrier- Grade NAT (CGN) is a well known solution to mask a whole ISP network behind a limited amount of public IP addresses, significantly reducing expenses. Despite its economical benefits, CGN can introduce connectiv- ity issues which have sprouted a considerable effort in research, development and standardization. However, to the best of our knowledge, little effort has been dedicated to investigate the impact that CGN deployment may have on users{\textquoteright} traffic. This paper fills the gap. We leverage passive measurements from an ISP network deploying CGN and, by means of the Jensen- Shannon divergence, we contrast several performance metrics considering customers being offered public or private addresses. In particular, we gauge the impact of CGN presence on users{\textquoteright} web browsing experience. Our results testify that CGN is a mature and stable technology as, if properly deployed, it does not harm users{\textquoteright} web browsing experience. Indeed, while our analysis lets emerge expected stochastic differences of certain indexes (e.g., the difference in the path hop count), the measurements related to the quality of users{\textquoteright} browsing are otherwise unperturbed. Interestingly, we also observe that CGN protects customers from unsolicited, often malicious, traffic.

}, url = {http://www.enst.fr/~drossi/paper/rossi15trac.pdf}, author = {Bocchi, Enrico and Safari, Ali and Traverso, Stefano and Finamore, Alessandro and Di Gennaro, Valeria and Mellia, Marco and Munafo, Maurizio and Rossi, Dario} } @inproceedings {DR:INFOCOM-15b, title = {A Lightweight Anycast Enumeration and Geolocation}, booktitle = {IEEE INFOCOM, Demo Session}, year = {2015}, address = {Hong Kong, China}, abstract = {

Several Internet services such as CDNs, DNS name servers, and sinkholes use IP-layer anycast to reduce user response times and increase robustness with respect to network failures and denial of service attacks. However, current geolocation tools fail with anycast IP addresses. In our recent work [1], we remedy to this by developing an anycast detection, enumeration, and geolocation technique based on a set of delay measurements from a handful of geographically distributed vantage points. The technique (i) detects if an IP is anycast, (ii) enumerates replicas by finding the maximum set of non-overlapping disks (i.e., areas centered around vantage points), and (iii) geolocates the replicas by solving a classification problem and assigning the server location to the most likely city. We propose to demo this technique. In particular, we visually show how to detect an anycast IP, enumerate its replicas, and geolocate them on a map. The demo allows to browse previously geolocated services, as well as to explore new targets on demand.

}, url = {http://www.enst.fr/~drossi/paper/rossi15infocom-b.pdf}, author = {Cicalese, Danilo and Joumblatt, Diana and Rossi, Dario and Buob, Marc-Olivier and Auge, Jordan and Friedman, Timur} } @inproceedings {bar2015m, title = {MTRAC - Discovering M2M Devices in Cellular Networks from Coarse-grained Measurements}, booktitle = {IEEE International Conference on Communications (ICC)}, year = {2015}, author = {Arian B{\"a}r and Philippe Svoboda and Pedro Casas} } @inproceedings {Nay2015, title = {multi-context TLS (mcTLS): Enabling Secure In-Network Functionality in TLS}, booktitle = {2015 ACM SIGCOMM Conference (SIGCOMM {\textquoteright}15)}, year = {2015}, publisher = {ACM}, organization = {ACM}, address = {London}, abstract = {

Transport Layer Security (TLS), is the de facto protocol supporting secure HTTP (HTTPS), and is being discussed as the default transport protocol for HTTP2.0. It has seen wide adoption and is currently carrying a significant fraction of the overall HTTP traffic (Facebook, Google and Twitter use it by default). However, TLS makes the fundamental assumption that all functionality resides solely at the endpoints, and is thus unable to utilize the many in-network services that optimize network resource usage, improve user experience, and protect clients and servers from security threats. Re-introducing such in-network functionality into secure TLS sessions today is done through hacks, in many cases weakening overall security.

In this paper we introduce multi-context TLS (mcTLS) which enhances TLS by allowing middleboxes to be fully supported participants in TLS sessions. mcTLS breaks the "all-or-nothing" security model by allowing endpoints and content providers to explicitly introduce middleboxes in secure end-to-end sessions, while deciding whether they should have read or write access, and to which specific parts of the content. mcTLS enables transparency and control for both clients and servers.

We evaluate a prototype mcTLS implementation in both controlled and "live" experiments, showing that the benefits offered have minimal overhead.More importantly, we show that mcTLS can be incrementally deployed and requires small changes to clients, servers, and middleboxes, for a large number of use cases.

}, author = {David Naylor and Kyle Schomp and Matteo Varvello and Ilias Leontiadis and Jeremy Blackburn and Diego Lopez and Konstantina Papagiannaki and Pablo Rodriguez and Peter Steenkiste} } @article {7096995, title = {Personal Cloud Storage Benchmarks and Comparison}, journal = {Cloud Computing, IEEE Transactions on}, volume = {PP}, year = {2015}, pages = {1-1}, abstract = {The large amount of space offered by personal cloud storage services (e.g., Dropbox and OneDrive), together with the possibility of synchronizing devices seamlessly, keep attracting customers to the cloud. Despite the high public interest, little information about system design and actual implications on performance is available when selecting a cloud storage service. Systematic benchmarks to assist in comparing services and understanding the effects of design choices are still lacking. This paper proposes a methodology to understand and benchmark personal cloud storage services. Our methodology unveils their architecture and capabilities. Moreover, by means of repeatable and customizable tests, it allows the measurement of performance metrics under different workloads. The effectiveness of the methodology is shown in a case study in which 11 services are compared under the same conditions. Our case study reveals interesting differences in design choices. Their implications are assessed in a series of benchmarks. Results show no clear winner, with all services having potential for improving performance. In some scenarios, the synchronization of the same files can take 20 times longer. In other cases, we observe a wastage of twice as much network capacity, questioning the design of some services. Our methodology and results are thus useful both as benchmarks and as guidelines for system design.}, keywords = {Benchmark testing, Cloud computing, Cloud storage, Computers, Google, Measurements, Performance, Servers, Synchronization}, issn = {2168-7161}, doi = {10.1109/TCC.2015.2427191}, author = {Enrico Bocchi and Idilio Drago and Marco Mellia} } @inproceedings {Boc2015, title = {Personal Cloud Storage: Usage, Performance and Impact of Terminals }, booktitle = {4th IEEE International Conference on Cloud Networking (IEEE CloudNet 2015)}, year = {2015}, month = {10/2015}, publisher = {IEEE}, organization = {IEEE}, address = {Niagara Falls, Canada}, abstract = {

Personal cloud storage services such as Dropbox and OneDrive are popular among Internet users. They help in sharing content and backing up data by relying on the cloud to store files. The rise of mobile terminals and the presence of new providers question whether the usage of cloud storage is evolving. This knowledge is essential to understand the workload these services need to handle, their performance, and implications. In this paper we present a comprehensive characterization of personal cloud storage services. Relying on traces collected for one month in an operational network, we show that users of each service present distinct behaviors. Dropbox is now threatened by competitors, with OneDrive and Google Drive reaching large market shares. However, the popularity of the latter services seems to be driven by their integration into Windows and Android. Indeed, around 50\% of their users do not produce any workload. Considering performance, providers show distinct trade-offs, with bottlenecks that hardly allow users to fully exploit their access line bandwidth. Finally, usage of cloud services is now ordinary among mobile users, thanks to the automatic backup of pictures and media files.

}, keywords = {Cloud storage, Monitoring}, url = {http://www.ieee-cloudnet.org/program.html}, author = {Enrico Bocchi and Idilio Drago and Marco Mellia} } @inproceedings {Hou2015, title = {A Study of the Impact of DNS Resolvers on Performance Using a Causal Approach}, booktitle = {Internet Teletraffic Congress}, year = {2015}, month = {08/2015}, address = {Ghent, Belgium}, abstract = {For a user to access any resource on the Internet, it is necessary to first locate a server hosting the requested resource. The Domain Name System service (DNS) represents the first step in this process, translating a human readable name, the resource host name, into an IP address. With the expansion of Content Distribution Networks (CDNs), the DNS service has seen its importance increase. In a CDN, objects are replicated on different servers to decrease the distance from the client to a server hosting the object that needs to be accessed. The DNS service should improve user experience by directing its demand to the optimal CDN server. While most of the Internet Service Providers (ISPs) offer a DNS service to their customers, it is now common to see clients using a public DNS service instead. This choice may have an impact on Web browsing performance. In this paper we study the impact of choosing one DNS server instead of another and we compare the performance of a large European ISP DNS service with the one of a public DNS service, Google DNS. We propose a causal approach to expose the structural dependencies of the different parameters impacted by the DNS service used and we show how to model these dependencies with a Bayesian network. This model allows us to explain and quantify the benefits obtained by clients using their ISP DNS service and to propose a solution to further improve their performance.}, keywords = {DNS, reasoner}, author = {Hadrien Hours and Ernst Biersack and Patrick Loiseau and Alessandro Finamore and Marco Mellia} } @article {Dus2014a, title = {Algorithm and Scheduler Design and Implementation}, year = {2014}, month = {09/2014}, keywords = {algorithm design, job scheduler, mPlane software, repository tools}, isbn = {D3.3}, issn = {D3.3}, author = {Maurizio Dusi and Saverio Niccolini and Sofia Nikitaki and Daniele Apiletti and Elena Baralis and Alessandro Finamore and Luigi Grimaudo and Stefano Traverso and Francesco Matera and Edion Tego and V, Guchev and Zied Ben Houidi and Pietro Michiardi and Marco Milanesio and YiXi Gong and Dario Rossi and Ilias Leontiadis and G, Dimopoulos and Tivadar Szemethy and A, Bakay and Arian B{\"a}r and Pedro Casas and Alessandro D{\textquoteright}Alconzo and Pierdomenico Fiadino} } @inproceedings {Cas2014d, title = {On the Analysis of QoE-based Performance Degradation in YouTube Traffic}, booktitle = {10th International Conference on Network and Service Management, CNSM 2014}, year = {2014}, month = {11/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Rio de Janeiro, Brazil}, abstract = {

YouTube is the most popular service in today{\textquoteright}s Internet. Google relies on its massive Content Delivery Network (CDN) to push YouTube videos as close as possible to the end-users to improve their Quality of Experience (QoE), as well as to pursue its own optimization goals. Adopting space and time variant traffic delivery policies, Google servers handle users{\textquoteright} requests from multiple geo-distributed locations at different times. Such traffic delivery policies can have a relevant impact on the traffic routed through the Internet Service Providers (ISPs) providing the access, but most importantly, they can have negative effects on the end-user QoE. In this paper we shed light on the problem of diagnosing QoE-based performance degradation events in YouTube{\textquoteright}s traffic. Through the analysis of one month of YouTube flow traces collected at the network of a large European ISP, we particularly identify and drill down a Google{\textquoteright}s CDN server selection policy negatively impacting the watching experience of YouTube users during several days at peak-load times. The analysis combines both the user-side perspective and the CDN perspective of the end-to-end YouTube delivery service to diagnose the problem. On the one hand, we rely on the monitoring of YouTube QoE-based Key Performance Indicators (KPIs) to detect performance degradation events affecting the end-customers. On the other hand, we analyze the temporal behavior of the Google CDN traffic delivery policies, by tracking the activity of the Google servers providing the videos. The analysis is supported by time-series analysis, entropy-based approaches, and clustering techniques to flag the aforementioned anomaly. The main contributions of the paper are threefold: firstly, we provide a large-scale characterization of the YouTube service in terms of traffic characteristics and provisioning behavior of the Google CDN servers. Secondly, we introduce simple yet effective QoE-based KPIs to monitor YouTube videos from the end-user perspective. Finally and most important, we analyze and provide evidence of the occurrence of QoE-based YouTube anomalies induced by CDN server selection policies, which are somehow normally hidden from the common knowledge of the end-user. This is a main issue for ISPs, who see their reputation degrade when such events occur, even if Google is the culprit.

}, keywords = {clustering, Content Delivery Networks, Empirical Entropy, Performance Degradation, Quality of Experience, YouTube}, author = {Pedro Casas and Alessandro D{\textquoteright}Alconzo and Pierdomenico Fiadino and Arian B{\"a}r and Alessandro Finamore} } @inproceedings {Boc2014, title = {Cloud Storage Service Benchmarking: Methodologies and Experimentations}, booktitle = {3rd IEEE International Conference on Cloud Networking (IEEE CloudNet 2014)}, year = {2014}, month = {10/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Luxembourg}, abstract = {

Data storage is one of today{\textquoteright}s fundamental services with companies, universities and research centers having the need of storing large amounts of data every day. Cloud storage services are emerging as strong alternative to local storage, allowing customers to save costs of buying and maintaining expensive hardware. Several solutions are available on the market, the most famous being Amazon S3. However it is rather difficult to access information about each service architecture, performance, and pricing. To shed light on storage services from the customer perspective, we propose a benchmarking methodology, apply it to four popular offers (Amazon S3, Amazon Glacier, Windows Azure Blob and Rackspace Cloud Files), and compare their performance. Each service is analysed as a black box and benchmarked through crafted workloads. We take the perspective of a customer located in Europe, looking for possible service providers and the optimal data center where to deploy its applications. At last, we complement the analysis by comparing the actual and forecast costs faced when using each service.

According to collected results, all services show eventual weaknesses related to some workload, with no all-round eligible winner, e.g., some offers providing excellent or poor performance when exchanging large or small files. For all services, it is of paramount importance to accurately select the data center to where deploy the applications, with throughput that varies by factors from 2x to 10x. The methodology (and tools implementing it) here presented is instrumental for potential customers to identify the most suitable offer for their needs.\ 

}, keywords = {Amazon S3, Benchmarking, Cloud storage, Performance measurement, Web services, Windows Azure}, author = {Enrico Bocchi and Marco Mellia and Sofiane Sarni} } @article {D43, title = { Cross-check of Analysis Modules and Reasoner Interactions}, number = {D4.3}, year = {2014}, month = {10/2014}, type = {Deliverable}, keywords = {reasoner, WP4}, author = {Umberto Manferdini and Stefano Traverso and Marco Mellia and Edion Tego and Francesco Matera and Zied Ben Houidi and Marco Milanesio and Pietro Michiardi and Dario Rossi and D. Cicalese and D. Joumblatt and Jordan Aug{\'e} and Maurizio Dusi and Sofia Nikitaki and Mohamed Ahmed and Ilias Leontiadis and L. Baltrunas and M. Varvello and Pedro Casas and Alessandro D{\textquoteright}Alconzo and Benoit Donnet and W. Du and Guy Leduc and Y. Liao and Alessandro Capello and Fabrizio Invernizzi} } @inproceedings {Bae2014, title = {DBStream: an Online Aggregation, Filtering and Processing System for Network Traffic Monitoring}, booktitle = {TRAC}, year = {2014}, month = {08/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Nicosia, Cyprus}, author = {Arian Baer and Pedro Casas and Lukasz Golab and Alessandro Finamore} } @article {D42, title = {Design of the Reasoner}, number = {D4.2}, year = {2014}, month = {06/2014}, type = {report}, keywords = {design, private deliverable, reasoner, WP4}, issn = {D4.2}, author = {Pedro Casas and Alessandro D{\textquoteright}Alconzo and Maurizio Dusi and Sofia Nikitaki and Mohamed Ahmed and Stefano Traverso and Marco Mellia and Daniele Apiletti and Luigi Grimaudo and Elena Baralis and Dario Rossi and D. Joumblatt and Alessandro Capello and M. D{\textquoteright}Ambrosio and Fabrizio Invernizzi and M. Ullio and Andrea Fregosi and Eike Kowallik and Stefano Raffaglio and Andrea Sannino and Marco Milanesio and Edion Tego and Francesco Matera and Tivadar Szemethy and Balazs Szabo and L. N{\'e}meth and Zied Ben Houidi and G. Dimopoulos and Ilias Leontiadis and Yan Grunenberger and L. Baltrunas and Michael Faath and Rolf Winter and Dimitri Papadimitriou} } @inproceedings {Fia2014, title = {On the Detection of Network Traffic Anomalies in Content Delivery Network Services}, booktitle = {ITC26}, year = {2014}, month = {09/2014}, address = {Karlskrona, Sweden}, author = {Pierdomenico Fiadino and Alessandro D{\textquoteright}Alconzo and Arian B{\"a}r and Alessandro Finamore and Pedro Casas} } @inproceedings {Cas2014a, title = {Distributed active measurement of Internet queuing delays}, booktitle = {Passive and Active Measurement (PAM), Extended Abstract}, year = {2014}, month = {March}, address = {Los Angeles, USA}, abstract = {

Despite growing link capacities, over-dimensioned buffers are still causing, in the Internet of the second decade of the third millenium, hosts to suffer from severe queuing delays (or bufferbloat). While maximum bufferbloat possibly exceeds few seconds, it is far less clear how often this maximum is hit in practice. This paper reports on our ongoing work to build a spatial and temporal map of Internet bufferbloat, describing a system based on distributed agents running on PlanetLab that aims at providing a quantitative answer to the above question.

}, url = {http://www.enst.fr/~drossi/paper/rossi14pam-b.pdf}, author = {P. Casoria and D Rossi and Jordan Aug{\'e} and Marc-Oliver Buob and T. Friedman and A. Pescape} } @article {Ber2014, title = {A Distributed Architecture for the Monitoring of Clouds and CDNs: Applications to Amazon AWS}, journal = {IEEE Transactions on Network and Service Management}, volume = {In press}, year = {2014}, abstract = {

Clouds and CDNs are systems that tend to separate the content being requested by users from the physical servers capable of serving it. From the network point of view, monitoring and optimizing performance for the traffic they generate is a challenging task, given the same resource can be located in multiple places, which can in turn change at any time. The first step in understanding Cloud and CDN systems is thus the engineering of a monitoring platform. In this paper, we propose a novel solution which combines passive and active measurements, and whose workflow has been tailored to specifically characterize the traffic generated by Cloud and CDN infrastructures. We validate our platform by performing a longitudinal characterization of the very well known Cloud and CDN infrastructure provider Amazon Web Services (AWS). By observing the traffic generated by more than 50,000 Internet users of an Italian ISP, we explore the EC2, S3 and CloudFront AWS services, unveiling their infrastructure, the pervasiveness of web-services they host, and their traffic allocation policies as seen from our vantage points. Most importantly, we observe their evolution over a two- year long period. The solution provided in this paper can be of interest for i) developers aiming at building measurement tools for Cloud Infrastructure Providers, ii) developers interested in failure and anomaly detection systems, and iii) third-party SLA certificators who can design systems to independently monitor performance. At last, we believe the results about AWS presented in this paper are interesting as they are among the first to unveil properties of AWS as seen from the operator point of view.

}, keywords = {Amazon, AWS, CDNs, Clouds}, author = {Ignacio Bermudez and Stefano Traverso and Marco Mellia and Maurizio Munafo{\textquoteright}} } @inproceedings {Ben2014, title = {Gold mining in a River of Internet Content Traffic}, booktitle = {6th International Workshop on Traffic Monitoring and Analysis, TMA}, year = {2014}, month = {04/2014}, publisher = {Springer}, organization = {Springer}, address = {London}, abstract = {With the advent of Over-The-Top content providers (OTTs), Internet Service Providers (ISPs) saw their portfolio of services shrink to the low margin role of data transporters. In order to counter this effect, some ISPs started to follow big OTTs like Facebook and Google in trying to turn their data into a valuable asset. In this paper, we explore the questions of what meaningful information can be extracted from network data, and what interesting insights it can provide. To this end, we tackle the first challenge of detecting {\textquotedblleft}user-URLs{\textquotedblright}, i.e., those links that were clicked by users as opposed to those objects automatically downloaded by browsers and applications. We devise algorithms to pinpoint such URLs, and validate them on manually collected ground truth traces. We then apply them on a three-day long traffic trace spanning more than 19,000 residential users that generated around 190 million HTTP transactions. We find that only 1.6\% of these observed URLs were actually clicked by users. As a first application for our methods, we answer the question of which platforms participate most in promoting the Internet content. Surprisingly, we find that, despite its notoriety, only 11\% of the user URL visits are coming from Google Search. }, keywords = {Content mining, HTTP Traffic, URL extraction}, author = {Zied Ben-Houidi and Giuseppe Scavo and Samir Ghamri-Doudane and Alessandro Finamore and Stefano Traverso and Marco Mellia} } @inproceedings {Tra2014, title = {Inline Data Integrity Signals for Passive Measurement}, booktitle = {Sixth International Workshop on Traffic Monitoring and Analysis (TMA 2014)}, year = {2014}, month = {04/2014}, abstract = {

In passive network measurement, the quality of an observed traffic stream is obviously crucial to the quality of the results. Some sources of error (e.g., packet loss at a capture device) are well understood, others less so. In this work, we describe the inline data integrity measurement provided by the QoF TCP-aware flow meter. By instrumenting the data structures QoF uses for detecting lost and retransmitted TCP segments, we can provide an in-band, per-flow estimate of observation loss: segments which were received by the recipient but not observed by the flow meter. We evaluate this mechanism against controlled, induced error, and apply it to two data sets used in previous work.

}, author = {Brian Trammell and David Gugelmann and Nevil Brownlee} } @inproceedings {Bae2014a, title = {Large-Scale Network Traffic Monitoring with DBStream, a System for Rolling Big Data Analysis}, booktitle = {International Conference on Big Data, IEEE BigData}, year = {2014}, month = {11/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Washington D.C., USA}, abstract = {

The complexity of the Internet has rapidly increased, making it more important and challenging to design scalable network monitoring tools. Network monitoring typically requires rolling data analysis, i.e., continuously and incrementally updating (rolling-over) various reports and statistics over high-volume data streams. In this paper, we describe DBStream, which is an SQL-based system that explicitly supports incremental queries for rolling data analysis. We also present a performance comparison of DBStream with a parallel data processing engine (Spark), showing that, in some scenarios, a single DBStream node can outperform a cluster of ten Spark nodes on rolling network monitoring workloads. Although our performance evaluation is based on network monitoring data, our results can be generalized to other big data problems with high volume and velocity.

}, keywords = {Big Data Analysis, Data Stream Processing, network data analysis, System Performance}, author = {Arian B{\"a}r and Alessandro Finamore and Pedro Casas and Lukasz Golab and Marco Mellia} } @article {Tra, title = {mPlane: an Intelligent Measurement Plane for the Internet}, journal = {IEEE Communications Magazine, Special Issue on Monitoring and Troubleshooting Multi-domain Networks using Measurement Federations}, volume = {42}, year = {2014}, month = {05/2014}, author = {Brian Trammell and Pedro Casas and Dario Rossi and Arian B{\"a}r and Zied Ben-Houidi and Ilias Leontiadis and Tivadar Szemethy and Marco Mellia} } @inproceedings {Dus2014, title = {Reactive Logic in Software-Defined Networking: Measuring Flow-Table Requirements}, booktitle = {5th International Workshop on TRaffic Analysis and Characterization (TRAC)}, year = {2014}, month = {2014}, address = {Nicosia, Cyprus}, author = {Maurizio Dusi and Roberto Bifulco and Francesco Gringoli and Fabian Schneider} } @article {grimaudoTNSM2014, title = {SeLeCT: Self-Learning Classifier for Internet Traffic}, journal = {IEEE Transactions on Network and Service Management}, volume = {11}, year = {2014}, month = {06/2014}, chapter = {144}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. The most popular\ current solutions - Deep Packet Inspection (DPI) and statistical\ classification, deeply rely on the availability of a training set.\ Besides the cumbersome need to regularly update the signatures,\ their visibility is limited to classes the classifier has been trained\ for. Unsupervised algorithms have been envisioned as a viable\ alternative to automatically identify classes of traffic. However,\ the accuracy achieved so far does not allow to use them for traffic\ classification in practical scenario.

To address the above issues, we propose SeLeCT, a Self-Learning Classifier for Internet Traffic. It uses unsupervised algorithms along with an adaptive seeding approach to automatically\ let classes of traffic emerge, being identified and labeled. Unlike\ traditional classifiers, it requires neither a-priori knowledge of\ signatures nor a training set to extract the signatures. Instead,\ SeLeCT automatically groups flows into pure (or homogeneous)\ clusters using simple statistical features. SeLeCT simplifies label\ assignment (which is still based on some manual intervention) so\ that proper class labels can be easily discovered. Furthermore,\ SeLeCT uses an iterative seeding approach to boost its ability to\ cope with new protocols and applications.

We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ excellent precision and recall, with overall accuracy close to 98\%.\ Unlike state-of-art classifiers, the biggest advantage of SeLeCT\ is its ability to discover new protocols and applications in an\ almost automated fashion.

}, keywords = {clustering, self-seeding, Traffic Classification, unsupervised machine learning}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @inproceedings {Cas2014, title = {Understanding HTTP Traffic and CDN Behavior from the Eyes of a Mobile ISP}, booktitle = {Passive and Active Measurements Conference (PAM)}, year = {2014}, author = {Pedro Casas and Pierdomenico Fiadino and Arian B{\"a}r} } @inproceedings {DR:PAM-14c, title = {Violation of Interdomain Routing Assumptions}, booktitle = {Passive and Active Measurement (PAM)}, year = {2014}, month = {03/2014}, address = {Los Angeles, USA}, url = {http://www.enst.fr/~drossi/paper/rossi14pam-c.pdf}, author = {R. Mazloum and M.-O. Buob and J. Auge and B. Baynat and T. Friedman and D. Rossi} } @article {6975242, title = {When YouTube Does not Work - Analysis of QoE-Relevant Degradation in Google CDN Traffic}, journal = {Network and Service Management, IEEE Transactions on}, volume = {11}, year = {2014}, month = {Dec}, pages = {441-457}, keywords = {CDN distributed services, CDN server selection strategies, client-server systems, content delivery network, Content Delivery Networks, Degradation, dynamic approach, dynamic server selection strategies, end-user QoE, end-user quality of experience, European ISP, Google, Google CDN traffic, Google server selection strategies, IP networks, iterative structured process, load reduction, QoE-relevant anomaly characterization, QoE-relevant anomaly detection, QoE-relevant anomaly diagnosis, QoE-relevant degradation, Quality of Experience, Servers, social networking (online), statistical analysis, statistical analysis methodologies, Statistical Data Analysis, telecommunication traffic, Traffic Monitoring, Videos, watching experience improvement, YouTube, YouTube flow trace collection, YouTube QoE-relevant degradation, YouTube videos}, issn = {1932-4537}, doi = {10.1109/TNSM.2014.2377691}, author = {Casas, Pedro and D{\textquoteright}Alconzo, Alessandro and Fiadino, Pierdomenico and B{\"a}r, Arian and Finamore, Alessandro and Zseby, Tanja} } @inproceedings {A2014, title = {Who to Blame when YouTube is not Working? Detecting Anomalies in CDN Provisioned Services}, booktitle = {TRAC}, year = {2014}, month = {08/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Nicosia, Cyprus}, author = {Alessandro D{\textquoteright}Alconzo and Pedro Casas and Pierdomenico Fiadino and Arian B{\"a}r and Alessandro Finamore} } @inproceedings {Cas2014b, title = {YouTube All Around: Characterizing YouTube from Mobile and Fixed-line Network Vantage Points}, booktitle = {EuCNC}, year = {2014}, month = {06/2014}, address = {Bologna, IT}, author = {Pedro Casas and Pierdomenico Fiadino and Arian B{\"a}r and Alessandro D{\textquoteright}Alconzo and Alessandro Finamore and Marco Mellia} } @article {Mic2013, title = {Basic Network Data Analysis}, number = {D3.1}, year = {2013}, month = {05/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, abstract = {

This document describes the requirements, input, output for the algorithms needed to perform analytic tasks on a large amount of data, in the context of WP3. Starting from the use cases defined in WP1, we identify the algorithms needed to address the various scenario requirements. Operating on a large amount of data, these algorithms strive for parallel and scalable approaches; the designing and implementation of the algorithm itself can be a challenging research task since today very little is known concerning how to develop efficient and scalable algorithms that runs on parallel processing frameworks.
The algorithm in the storage layer are characterized by the fact that they operate on a large amount of data, and produce a concise representation of it, extracting features and aggregating it, so that the produced output is easier to handle and understand. Depending on the amount of data produced, on the scenario characteristics and on the time constraints, algorithms can require a real time (or near real time) or a batch processing.
For each algorithm and use case, the input data and the initial state, the computation to run and the output produced are described.

}, keywords = {algorithms, big data, storage}, issn = {D3.1}, author = {Pietro Michiardi and Antonio Barbuzzi and Alessandro Finamore and Stefano Traverso and Daniele Apiletti and Elena Baralis and Tania Cerquitelli and Silvia Chiusano and Luigi Grimaudo and A. Rufini and Francesco Matera and A. Valentii and Maurizio Dusi and Mohamed Ahmed and Tivadar Szemethy and L. N{\'e}meth and R. Szalay and Ilias Leontiadis and Yan Grunenberger and P. Casas and Alessandro D{\textquoteright}Alconzo and A B{\"a}r and D Rossi and YiXi Gong} } @inproceedings {Dra2013, title = {Benchmarking Personal Cloud Storage}, booktitle = {Internet Measurement Conference - IMC}, year = {2013}, month = {10/2013}, publisher = {ACM}, organization = {ACM}, address = {Barcelona (ES)}, abstract = {

Personal cloud storage services are data-intensive applica- tions already producing a significant share of Internet traffic. Several solutions offered by different companies attract more and more people. However, little is known about each service capabilities, architecture and {\textendash} most of all {\textendash} performance implications of design choices. This paper presents a methodology to study cloud storage services. We apply our methodology to compare 5 popular offers, revealing different system architectures and capabilities. The implications on performance of different designs are assessed executing a series of benchmarks. Our results show no clear winner, with all services suffering from some limitations or having potential for improvement. In some scenarios, the upload of the same file set can take seven times more, wasting twice as much capacity. Our methodology and results are useful thus as both benchmark and guideline for system design.

}, keywords = {Active Measurements, Personal Cloud Storage}, doi = {10.1145/2504730.2504762}, url = {http://www.simpleweb.org/wiki/Cloud_benchmarks}, author = {Idilio Drago and Enrico Bocchi and Marco Mellia and Herman Slatman and Aiko Pras} } @article {Bar2013a, title = {Database Layer Design}, number = {D3.2}, year = {2013}, month = {11/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, keywords = {big data, databases, repositories, storage}, issn = {D3.2}, author = {A B{\"a}r and P. Casas and Alessandro D{\textquoteright}Alconzo and Alessandro Finamore and Antonio Barbuzzi and Maurizio Dusi and Gianni De Rosa and Tivadar Szemethy and Ilias Leontiadis and D Rossi and Jordan Aug{\'e} and Marc-Oliver Buob} } @article {Pap2013, title = {Design of Analysis Modules}, number = {D4.1}, year = {2013}, month = {11/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, keywords = {algorithms, analysis}, isbn = {D4.1}, issn = {D4.1}, author = {Dimitri Papadimitriou and Zied Ben-Houidi and Samir Ghamri-Doudane and D Rossi and M. Milanesio and P. Casas and Alessandro D{\textquoteright}Alconzo and Edion Tego and Francesco Matera and Maurizio Dusi and Tivadar Szemethy and L. M{\'a}th{\'e} and Alessandro Finamore and Stefano Traverso and Ilias Leontiadis and Yan Grunenberger and L. Baltrunas and Benoit Donnet and Guy Leduc and Y. Liao} } @inproceedings {Ber2013, title = {Exploring the Cloud from Passive Measurements: the Amazon AWS case}, booktitle = {The 32nd Annual IEEE International Conference on Computer Communications (INFOCOM{\textquoteright}2013)}, year = {2013}, address = {Turin, Italy}, abstract = {

Cloud Providers are nowadays the most popular way to quickly deploy new services on the Internet. Understanding mechanisms currently adopted in cloud design is fundamental to identify possible bottlenecks, to optimize performance, and to design more efficient platforms. This paper presents a characterization of Amazon{\textquoteright}s Web Services (AWS), the most prominent cloud provider that offers computing, storage, and content delivery platforms. Leveraging passive measurements collected from several vantage points in Italy for several months, we explore the EC2, S3 and CloudFront AWS services to unveil their infrastructure, the pervasiveness of content they host, and their traffic allocation policies. Measurements reveal that most of the content residing on EC2 and S3 is served by one single Amazon datacenter located in Virginia despite it appears to be the worst performing one for Italian users. This causes traffic to take long and expensive paths in the network. Since no automatic migration and load-balancing policies are offered by AWS among different locations, content is exposed to outages, as we were able to observe in our data. The CloudFront CDN, on the contrary, shows much better performance thanks to the effective cache selection policy that serves 98\% of the traffic from the nearest available cache. CloudFront exhibits also dynamic load-balancing policies, in contrast to the static allocation of instances on EC2 and S3. Information presented in this paper will be useful for developers aiming at entrusting AWS to deploy their contents, and for researchers willing to improve cloud design.

}, doi = {10.1109/INFCOM.2013.6566769}, author = {Ignacio Nicolas Bermudez and Stefano Traverso and Marco Mellia and Maurizio M Munafo{\textquoteright}} } @article {Cap2013, title = {First Data Collection Track Record}, number = {D5.1}, year = {2013}, month = {11/2013}, institution = {mPlane Consortium}, type = {Private Deliverable}, address = {Torino}, keywords = {data sets, integration, measurement systems, scenarios, use cases}, author = {Alessandro Capello and Fabrizio Invernizzi and Omar Jabr and Dimitri Papadimitriou and Dario Rossi and YiXi Gong and Brian Trammell and Marco Milanesio and Ernst Biersack and Rolf Winter and Francesco Matera and Arianna Rufini and Edion Tego and Maurizio Dusi and Balazs Szabo and Tivadar Szemethy and Alessandro Finamore and Marco Mellia and Ilias Leontiadis and Benoit Donnet} } @inproceedings {Fia2013, title = {HTTPTag: A Flexible On-line HTTP Classification System for Operational 3G Networks}, booktitle = {INFOCOM{\textquoteright}2013 Demo/Poster Session (INFOCOM{\textquoteright}2013 - Demo/Poster Session)}, year = {2013}, address = {Turin, Italy}, abstract = {

The popularity of web-based services and applications like YouTube and Facebook has taken HTTP back to the pole position on end-user traffic consumption. We present HTTPTag, a flexible on-line HTTP classification system based on pattern matching and tagging. HTTPTag recognizes on the fly and tracks the evolution of more than 280 applications running on top of HTTP in an operational 3G network, representing more than 70\% of the total HTTP traffic volume consumed by its customers. HTTPTag improves the network traffic visibility of an operator, performing tasks such as top-services ranking, long-term monitoring of applications popularity, and trend analysis among others.

}, keywords = {3G Networks, HTTP, Pattern Matching, Traffic Classification}, author = {Pierdomenico Fiadino and A B{\"a}r and P. Casas} } @inproceedings {Cas2013, title = {IP Mining: Extracting Knowledge from the Dynamics of the Internet Addressing Space (BEST PAPER AWARD)}, booktitle = {25th International Teletraffic Congress, ITC 25}, year = {2013}, abstract = {

Going back to the Internet of one decade ago, HTTP-based content and web services were provided by centralized or barely distributed servers. Single hosts providing exclusive services at fixed IP addresses was the standard approach. Current situation has drastically changed, and the mapping of IPs to different content and services is nowadays extremely dynamic. The adoption of large CDNs by major Internet players, the extended usage of transparent content caching, the explosion of Cloud-based services, and the decoupling between content providers and the hosting infrastructure have created a difficult to manage Internet landscape. Understanding such a complex scenario is paramount for network operators, both to control the traffic on their networks and to improve the quality experienced by their customers, specially when something goes wrong. Using a full week of HTTP traffic traces collected at the mobile broadband network of a major European ISP, this paper studies the associations between web services, the hosting organizations-ASes, and the content servers{\textquoteright} IPs. By mining correlations among these, we extract useful insights about the dynamics of the IP addressing space used by the top web services, and the way content providers and hosting organizations deliver their services to the mobile endusers. The extracted knowledge is applied on two specific use-cases, the former on hosting and service delivery characterization, the latter on automatic IP-based HTTP services classification.

}, keywords = {Content Delivery Networks, HTTP Traffic, IP Addressing Space, Traffic Classification and Analysis}, doi = {10.1109/ITC.2013.6662933}, author = {Pedro Casas and Pierdomenico Fiadino and Arian B{\"a}r} } @inproceedings {Bel2013, title = {On Netflix catalog dynamics and caching performance}, booktitle = {IEEE CAMAD}, year = {2013}, month = {09/2013}, abstract = {

Multimedia streaming applications have substantially changed the market policy of an increasing number of content providers that offer streaming services to the users. The need for effective video content delivery re-fueled interest for caching: since the Web-like workload of the 90s are not longer fit to describe the new Web of videos, in this work we investigate the suitability of the publicly available Netflix dataset for caching studies. Our analysis shows that, as the dataset continuously evolves (i) a steady state description is not statistically meaningful and (ii) despite the cache hit ratio decreases due to the growth of active movies in the catalog, simple caching replacement approaches are close to the optimum given the growing skew in the popularity distribution over the time. Additionally, we point out that, since the dataset reports logs of movie ratings, anomalies arise when ratings are considered to be movie views. At the same time, we show anomalies yield conservative caching results, that reinforces the soundness of our study.

}, url = {http://www.enst.fr/~drossi/paper/rossi13camad.pdf}, author = {Walter Bellante and Rosa Vilardi and D Rossi} } @article {Dus2013, title = {Plans for Using and Disseminating mPlane Knowledge}, number = {D7.2}, year = {2013}, month = {11/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, keywords = {dissemination, exploitation, open-source software, publications, standardization}, issn = {D7.2}, author = {Maurizio Dusi and Saverio Niccolini and Antonio Barbuzzi and M. Milanesio and Alessandro Finamore and Brian Trammell and Edion Tego and Francesco Matera and Tivadar Szemethy and Rolf Winter and Zied Ben-Houidi and Andrea Fregosi and Benoit Donnet and Fabrizio Invernizzi and Dimitri Papadimitriou and Ilias Leontiadis and Yan Grunenberger and P. Casas} } @inproceedings {Det2013, title = {Revealing Middlebox Interference with Tracebox}, booktitle = {ACM/USENIX Internet Measurement Conference (IMC)}, year = {2013}, month = {10/2013}, abstract = {

Middleboxes such as firewalls, NAT, proxies, or Deep Pack-et Inspection play an\ increasingly important role in various types of IP networks, including\ enterprise and cellular networks. Recent studies have shed the light on their\ impact on real traffic and the complexity of managing them. Network operators\ and researchers have few tools to understand the impact of those boxes on any
path. In this paper, we propose tracebox, an extension to the widely used\ traceroute tool, that is capable of detecting various types of middlebox\ interference over almost any path. \ tracebox sends IP packets containing TCP\ segments with different TTL values and analyses the packet encapsulated in the\ returned ICMP messages. Further, as recent routers quote, in the ICMP message,\ the entire IP packet that they received, tracebox is able to detect any\ modification performed by upstream middleboxes. In addition, tracebox can often\ pinpoint the network hop where the middlebox interference occurs. We evaluate\ tracebox with measurements performed on PlanetLab nodes. Our analysis reveals\ various types of middleboxes that were not expected on such an experimental\ testbed supposed to be connected to the Internet without any restriction.

}, keywords = {middlebox, network discovery, tracebox}, doi = {10.1145/2504730.2504757}, author = {Gregory Detal and Benjamin Hesmans and Olivier Bonaventure and Yves Vanaubel and Benoit Donnet} } @inproceedings {Api2013, title = {SEARUM: a cloud-based SErvice for Association RUle Mining}, booktitle = {The 11th IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA-13)}, year = {2013}, abstract = {

Large volumes of data are being produced by various modern applications at an ever increasing rate. These applications range from wireless sensors networks to social networks. The automatic analysis of such huge data volume is a challenging task since a large amount of interesting knowledge can be extracted. Association rule mining is an exploratory data analysis method able to discover interesting and hidden correlations among data. Since this data mining process is characterized by computationally intensive tasks, efficient distributed approaches are needed to increase its scalability. This paper proposes a novel cloud-based service, named SEARUM, to efficiently mine association rules on a distributed computing model. SEARUM consists of a series of distributed MapReduce jobs run in the cloud. Each job performs a different step in the association rule mining process. As a case study, the proposed approach has been applied to the network data scenario. The experimental validation, performed on two real network datasets, shows the effectiveness and the efficiency of\ SEARUM in mining association rules on a distributed computing model.

}, keywords = {association rule mining, cloud-based service, distributed computing model, network data analysis}, doi = {10.1109/TrustCom.2013.153}, author = {Daniele Apiletti and Elena Baralis and Tania Cerquitelli and Silvia Chiusano and Luigi Grimaudo} } @article {Pap2013c, title = {Selection of Existing Probes and Datasets}, number = {D2.1}, year = {2013}, month = {08/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, abstract = {The mPlane architecture has been designed to include the possibility to interface with existing systems and platforms. While most measurement platforms in existence target a very specific measurement use case (e.g., the discovery of the Internet{\textquoteright}s router-level topology, the continuous measurement of the RTT among host pairs, the exporting via SNMP of network state, etc.), there are platforms that have a large deployed base, with lot of data being at disposal, and/or continuously collecting data. It would be a waste of resources to merely reproduce this effort within mPlane. Instead, mPlane aims at directly interfacing with existing systems and re-using their capabilities and data to feed measurement results to the mPlane intelligence. This document lists selected existing systems that are important for mPlane either for theoretical, conceptual or practical reasons, and that are part of the background of mPlane partners. A sub-set of these systems will be eventually incorporated into mPlane by developing the necessary interfaces. Others could be integrated by the means of proxy probes, i.e., the conceptual component responsible for such interfacing. The main focus of this document is to elaborate the concept of proxy probes, enumerate the systems that will be possibly considered for interface (proxy probe) development, and to give high level descriptions of the proxy probe design for these systems. The following list enumerates the systems that the consortium has chosen to include: - QoF - a TCP-aware IPFIX flow meter  Cisco Ping and SLA Agents - commercial availability and basic network parameter agents  - Tracebox - a tool for middlebox detection and identification - Scamper - a sophisticated active probing tool - MERLIN - a router-level topology discovery tool - TopHat - a configurable measurement system on top of PlanetLab - Tstat - a passive network monitoring tool - BlockMon - a flexible network monitoring and analysis tool - MisuraInternet - a QoS measurement system - Firelog - a Firefox plugin to measure HTTP QoE - Pytomo - an end-host-based video OoE measurement tool - DATI - a high performance deep packet inspector - MobiPerf - a tool for monitoring smartphone performance}, keywords = {active probes, existing probes, passive probes, probes, proxy probes}, author = {Dimitri Papadimitriou and Dario Rossi and YiXi Gong and Brian Trammell and Marco Milanesio and Ernst Biersack and Rolf Winter and Francesco Matera and Maurizio Dusi and Balazs Szabo and Tivadar Szemethy and Alessandro Finamore and Marco Mellia and Alessandro Capello and Fabio Invernizzi and Omar Jabr and Ilias Leontiadis and Benoit Donnet} } @inproceedings {Gri2013, title = {Self-Learning Classifier for Internet Traffic}, booktitle = {The 5th IEEE International Traffic Monitoring and Analysis Workshop (TMA 2013)}, year = {2013}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. Recently, unsupervised algorithms have been envisioned as a viable alternative\ to automatically identify classes of traffic. However, the accuracy\ achieved so far does not allow to use them for traffic classification\ in practical scenario.
In this paper, we propose SeLeCT, a Self-Learning Classifier\ for Internet traffic. It uses unsupervised algorithms along with\ an adaptive learning approach to automatically let classes of\ traffic emerge, being identified and (easily) labeled. SeLeCT\ automatically groups flows into pure (or homogeneous) clusters\ using alternating simple clustering and filtering phases to remove\ outliers. SeLeCT uses an adaptive learning approach to boost its\ ability to spot new protocols and applications. Finally, SeLeCT\ also simplifies label assignment (which is still based on some\ manual intervention) so that proper class labels can be easily\ discovered.
We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ overall accuracy close to 98\%. Unlike state-of-art classifiers, the\ biggest advantage of SeLeCT is its ability to help discovering\ new protocols and applications in an almost automated fashion.

}, doi = {10.1109/INFCOMW.2013.6562900}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @article {Tra2013a, title = {Use Case Elaboration and Requirements Specification}, number = {D1.1}, year = {2013}, month = {01/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, abstract = {

The document defines the requirements for the mPlane architecture on the background of a set of scenarios explored by the consortium, a survey of existing comparable measurement systems and platforms and applicable standards therefore, and a set of architectural first principles drawn from the description of work and the consortium{\textquoteright}s experience.\ As mPlane is intended to be a fully flexible measurement platform, freely integrating existing probes and repositories with ones to be developed in the project, this document is primarily concerned with the definition of interfaces among mPlane components. While it does enumerate capabilities to be provided by these components, these are primarily intended to ensure the platform has the flexibility required to meet all the scenarios envisioned; the enumerations of measurements, metrics, data types, and other component capabilities are therefore not to be construed to limit the scope of work on components within the project to just those scenarios treated in this document; nor do the scenarios enumerated here define the capabilities to be demonstrated in the project{\textquoteright}s integrated trial.\ 

}, keywords = {architecture, measurement, platform, scenario, use case}, issn = {D1.1}, author = {Brian Trammell and Stephan Neuhaus and Francesco Matera and Ernst Biersack and Antonio Barbuzzi and Saverio Niccolini and Mohamed Ahmed and Maurizio Dusi and Tivadar Szemethy and Balazs Szabo and P. Casas and A B{\"a}r and Konstantina Papagiannaki and Yan Grunenberger and Ilias Leontiadis and Rolf Winter and Zied Ben-Houidi and Giovanna Carofiglio and Samir Ghamri-Doudane and Diego Perino and D Rossi} } @inproceedings {Ber2012, title = {DNS to the rescue: Discerning Content and Services in a Tangled Web}, booktitle = {Internet Measurement Conference 2012}, volume = {1}, year = {2012}, month = {11/2012}, pages = {413-426}, publisher = {ACM}, organization = {ACM}, edition = {ACM}, address = {Boston, MA}, abstract = {

A careful perusal of the Internet evolution reveals two major trends - explosion of cloud-based services and video stream- ing applications. In both of the above cases, the owner (e.g., CNN, YouTube, or Zynga) of the content and the organiza- tion serving it (e.g., Akamai, Limelight, or Amazon EC2) are decoupled, thus making it harder to understand the associ- ation between the content, owner, and the host where the content resides. This has created a tangled world wide web that is very hard to unwind, impairing ISPs{\textquoteright} and network administrators{\textquoteright} capabilities to control the traffic flowing in their networks.

In this paper, we present DN-Hunter, a system that lever- ages the information provided by DNS traffic to discern the tangle. Parsing through DNS queries, DN-Hunter tags traf- fic flows with the associated domain name. This association has several applications and reveals a large amount of use- ful information: (i) Provides a fine-grained traffic visibility even when the traffic is encrypted (i.e., TLS/SSL flows), thus enabling more effective policy controls, (ii) Identifies flows even before the flows begin, thus providing superior net- work management capabilities to administrators, (iii) Un- derstand and track (over time) different CDNs and cloud providers that host content for a particular resource, (iv) Discern all the services/content hosted by a given CDN or cloud provider in a particular geography and time interval, and (v) Provides insights into all applications/services run- ning on any given layer-4 port number.

We conduct extensive experimental analysis and show re- sults from real traffic traces (including FTTH and 4G ISPs) that support our hypothesis. Simply put, the information provided by DNS traffic is one of the key components re- quired for understanding the tangled web, and bringing the ability to effectively manage network traffic back to the op- erators.\ 

}, keywords = {DNS, mPlane, passive measurement, WP2}, isbn = {978-1-4503-1705-4}, doi = {10.1145/2398776.2398819}, url = {http://dl.acm.org/citation.cfm?id=2398776.2398819\&coll=DL\&dl=GUIDE\&CFID=225051145\&CFTOKEN=42401286}, author = {Ignacio Nicolas Bermudez and Marco Mellia and Maurizio M Munafo{\textquoteright} and Ram Keralapura and Antonio Nucci} }