@article {D61, title = {Demonstration Plan}, number = {D6.1}, year = {2015}, month = {01/2015}, type = {Public Deliverable}, issn = {D6.1}, author = {Pedro Casas and Edion Tego and Francesco Matera and Maurizio Dusi and A. Bakay and Balazs Szabo and G. Rozsa and Stefano Traverso and Ilias Leontiadis and L. Baltrunas and Yan Grunenberger and Andrea Fregosi and A. Kahveci and Eike Kowallik and G. Mattellini and C. Meregalli and Stefano Raffaglio and M. Russo and Andrea Sannino and M. Scarpino} } @inproceedings {TrKu15, title = {Enabling Internet-Wide Deployment of Explicit Congestion Notification}, booktitle = {Proceedings of the 2015 Passive and Active Measurement Conference}, year = {2015}, month = {03/2015}, address = {New York}, abstract = {

\ac{ECN} is an TCP/IP extension to signal network congestion without packet loss, which has barely seen deployment though it was standardized and implemented more than a decade ago. On-going activities in research and standardization aim to make the usage of \ac{ECN} more beneficial. This measurement study provides an update on deployment status and newly assesses the marginal risk of enabling \ac{ECN} negotiation by default on client end-systems. Additionally, we dig deeper into causes of connectivity and negotiation issues linked to \ac{ECN}. We find that about five websites per thousand suffer additional connection setup latency when fallback per RFC 3168 is correctly implemented; we provide a patch for Linux to properly perform this fallback. Moreover, we detect and explore a number of cases in which \ac{ECN} brokenness is clearly path-dependent, i.e. on middleboxes beyond the access or content provider network. Further analysis of these cases can guide their elimination, further reducing the risk of enabling \ac{ECN} by default.

}, author = {Brian Trammell and Mirja K{\"u}hlewind and Damiano Boppart and Iain Learmonth and Gorry Fairhurst and Richard Scheffenegger} } @inproceedings {TrKuPAM15, title = {Enabling Internet-Wide Deployment of Explicit Congestion Notification}, booktitle = {Proceedings of the 2015 Passive and Active Measurement Conference}, year = {2015}, month = {Mar}, address = {New York}, url = {http://ecn.ethz.ch/ecn-pam15.pdf}, author = {Brian Trammell and Mirja K{\"u}hlewind and Damiano Boppart and Iain Learmonth and Gorry Fairhurst and Richard Scheffenegger} } @inproceedings {Tra2015, title = {A New Transport Encapsulation for Middlebox Cooperation}, booktitle = {Proceedings of the 2015 IEEE Conference on Standards for Communications and Networking}, year = {2015}, month = {Oct}, address = {Tokyo, Japan}, author = {Brian Trammell and Mirja Kuehlewind and Elio Gubser and Joe Hildebrand} } @inproceedings {Tra2015a, title = {Observing Internet Path Transparency to Support Protocol Engineering}, booktitle = {Proceedings of the first IRTF/ISOC Workshop on Research and Applications of Internet Measurements (RAIM)}, year = {2015}, month = {Oct}, address = {Yokohama, Japan}, author = {Brian Trammell and Mirja K{\"u}hlewind} } @inproceedings {Kut2015, title = {Weighted Similarity Estimation in Data Streams}, booktitle = {CIKM}, year = {2015}, month = {10/2015}, publisher = {ACM}, organization = {ACM}, abstract = {

Similarity computation between pairs of objects is often a bottleneck in many applications that have to deal with massive volumes of data. Motivated by applications such as collaborative filtering in large-scale recommender systems, and influence probabilities learning in social networks, we present new randomized algorithms for the estimation of weighted similarity in data streams.

Previous works have addressed the problem of learning binary similarity measures in a streaming setting. To the best of our knowledge, the algorithms proposed here are the first that specifically address the estimation of weighted similarity in data streams. The algorithms need only one pass over the data, making them ideally suited to handling massive data streams in real time.

We obtain precise theoretical bounds on the approximation error and complexity of the algorithms. The results of evaluating our algorithms on two real-life datasets validate the theoretical findings and demonstrate the applicability of the proposed algorithms.

}, author = {Konstantin Kutzkov and Mohamed Ahmed and Sofia Nikitaki} } @article {D42, title = {Design of the Reasoner}, number = {D4.2}, year = {2014}, month = {06/2014}, type = {report}, keywords = {design, private deliverable, reasoner, WP4}, issn = {D4.2}, author = {Pedro Casas and Alessandro D{\textquoteright}Alconzo and Maurizio Dusi and Sofia Nikitaki and Mohamed Ahmed and Stefano Traverso and Marco Mellia and Daniele Apiletti and Luigi Grimaudo and Elena Baralis and Dario Rossi and D. Joumblatt and Alessandro Capello and M. D{\textquoteright}Ambrosio and Fabrizio Invernizzi and M. Ullio and Andrea Fregosi and Eike Kowallik and Stefano Raffaglio and Andrea Sannino and Marco Milanesio and Edion Tego and Francesco Matera and Tivadar Szemethy and Balazs Szabo and L. N{\'e}meth and Zied Ben Houidi and G. Dimopoulos and Ilias Leontiadis and Yan Grunenberger and L. Baltrunas and Michael Faath and Rolf Winter and Dimitri Papadimitriou} } @inproceedings {Tra2014b, title = {Exploiting Hybrid Measurements for Network Troubleshooting}, booktitle = {IEEE Networks}, year = {2014}, month = {09/2014}, publisher = {IEEE}, organization = {IEEE}, address = {Funchal, PT}, abstract = {Network measurements are a fundamental pillar to understand network performance and perform root cause analysis in case of problems. Traditionally, either active or passive measurements are considered. While active measurements allow to know exactly the workload injected by the application into the network, the passive measurements can offer a more detailed view of transport and network layer impacts. In this paper, we present a hybrid approach in which active throughput measurements are regularly run while a passive measurement tool monitors the generated packets. This allows us to correlate the application layer measurements obtained by the active tool with the more detailed view offered by the passive monitor. The proposed methodology has been implemented following the mPlane reference architecture, tools have been installed in the Fastweb network, and we collect measurements for more than three months. We report then a subset of results that show the benefits obtained when correlating active and passive measurements. Among results, we pinpoint cases of congestion, of ADSL misconfiguration, and of modem issues that impair throughput obtained by the users.}, keywords = {Hybrid measurements, measurement analysis, WP2}, author = {Stefano Traverso and Edion Tego and Eike Kowallik and Stefano Raffaglio and Andrea Fregosi and Marco Mellia and Francesco Matera} } @inproceedings {Leo2014, title = {From Cells to Streets: Estimating Mobile Paths with Cellular-Side Data}, booktitle = {CoNEXT}, year = {2014}, publisher = {ACM}, organization = {ACM}, address = {Sydney, Australia}, author = {Ilias Leontiadis and Antonio Lima and Haewoon Kwak and Rade Stanojevic and David Wetherall and Konstantina Papagiannaki} } @article {rfc7119, title = {Operation of the IP Flow Information Export (IPFIX) Protocol on IPFIX Mediators (RFC 7119)}, year = {2014}, month = {02/2014}, abstract = {
This document specifies the operation of the IP Flow Information Export (IPFIX) protocol specific to IPFIX Mediators, including Template and Observation Point management, timing considerations, and other Mediator-specific concerns.
}, url = {http://www.ietf.org/rfc/rfc7119.txt}, author = {B. Claise and A. Kobayashi and B. Trammell} } @article {grimaudoTNSM2014, title = {SeLeCT: Self-Learning Classifier for Internet Traffic}, journal = {IEEE Transactions on Network and Service Management}, volume = {11}, year = {2014}, month = {06/2014}, chapter = {144}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. The most popular\ current solutions - Deep Packet Inspection (DPI) and statistical\ classification, deeply rely on the availability of a training set.\ Besides the cumbersome need to regularly update the signatures,\ their visibility is limited to classes the classifier has been trained\ for. Unsupervised algorithms have been envisioned as a viable\ alternative to automatically identify classes of traffic. However,\ the accuracy achieved so far does not allow to use them for traffic\ classification in practical scenario.

To address the above issues, we propose SeLeCT, a Self-Learning Classifier for Internet Traffic. It uses unsupervised algorithms along with an adaptive seeding approach to automatically\ let classes of traffic emerge, being identified and labeled. Unlike\ traditional classifiers, it requires neither a-priori knowledge of\ signatures nor a training set to extract the signatures. Instead,\ SeLeCT automatically groups flows into pure (or homogeneous)\ clusters using simple statistical features. SeLeCT simplifies label\ assignment (which is still based on some manual intervention) so\ that proper class labels can be easily discovered. Furthermore,\ SeLeCT uses an iterative seeding approach to boost its ability to\ cope with new protocols and applications.

We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ excellent precision and recall, with overall accuracy close to 98\%.\ Unlike state-of-art classifiers, the biggest advantage of SeLeCT\ is its ability to discover new protocols and applications in an\ almost automated fashion.

}, keywords = {clustering, self-seeding, Traffic Classification, unsupervised machine learning}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @inproceedings {Gri2013, title = {Self-Learning Classifier for Internet Traffic}, booktitle = {The 5th IEEE International Traffic Monitoring and Analysis Workshop (TMA 2013)}, year = {2013}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. Recently, unsupervised algorithms have been envisioned as a viable alternative\ to automatically identify classes of traffic. However, the accuracy\ achieved so far does not allow to use them for traffic classification\ in practical scenario.
In this paper, we propose SeLeCT, a Self-Learning Classifier\ for Internet traffic. It uses unsupervised algorithms along with\ an adaptive learning approach to automatically let classes of\ traffic emerge, being identified and (easily) labeled. SeLeCT\ automatically groups flows into pure (or homogeneous) clusters\ using alternating simple clustering and filtering phases to remove\ outliers. SeLeCT uses an adaptive learning approach to boost its\ ability to spot new protocols and applications. Finally, SeLeCT\ also simplifies label assignment (which is still based on some\ manual intervention) so that proper class labels can be easily\ discovered.
We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ overall accuracy close to 98\%. Unlike state-of-art classifiers, the\ biggest advantage of SeLeCT is its ability to help discovering\ new protocols and applications in an almost automated fashion.

}, doi = {10.1109/INFCOMW.2013.6562900}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @inproceedings {Kue2013, title = {On the state of ECN and TCP Options on the Internet}, booktitle = {Passive and Active Measurement Conference (PAM)}, year = {2013}, month = {03/2013}, address = {Hong Kong}, abstract = {

Explicit Congestion Notification (ECN) is a TCP/IP extension that can avoid packet loss and thus improve network performance. Though standardized in 2001, it is barely used in today{\textquoteright}s Internet. This study, following on previous active measurement studies over the past decade, shows marked and continued increase in the deployment of ECN-capable servers, and usability of ECN on the majority of paths to such servers. We additionally present new measurements of ECN on IPv6, passive observation of actual ECN usage from flow data, and observations on other congestion-relevant TCP options (SACK, Timestamps and Window Scaling). We further present initial work on burst loss metrics for loss-based congestion control following from our findings.\ 

}, doi = {10.1007/978-3-642-36516-4_14}, author = {Mirja Kuehlewind and Sebastian Neuner and Brian Trammell} } @inproceedings {Ber2012, title = {DNS to the rescue: Discerning Content and Services in a Tangled Web}, booktitle = {Internet Measurement Conference 2012}, volume = {1}, year = {2012}, month = {11/2012}, pages = {413-426}, publisher = {ACM}, organization = {ACM}, edition = {ACM}, address = {Boston, MA}, abstract = {

A careful perusal of the Internet evolution reveals two major trends - explosion of cloud-based services and video stream- ing applications. In both of the above cases, the owner (e.g., CNN, YouTube, or Zynga) of the content and the organiza- tion serving it (e.g., Akamai, Limelight, or Amazon EC2) are decoupled, thus making it harder to understand the associ- ation between the content, owner, and the host where the content resides. This has created a tangled world wide web that is very hard to unwind, impairing ISPs{\textquoteright} and network administrators{\textquoteright} capabilities to control the traffic flowing in their networks.

In this paper, we present DN-Hunter, a system that lever- ages the information provided by DNS traffic to discern the tangle. Parsing through DNS queries, DN-Hunter tags traf- fic flows with the associated domain name. This association has several applications and reveals a large amount of use- ful information: (i) Provides a fine-grained traffic visibility even when the traffic is encrypted (i.e., TLS/SSL flows), thus enabling more effective policy controls, (ii) Identifies flows even before the flows begin, thus providing superior net- work management capabilities to administrators, (iii) Un- derstand and track (over time) different CDNs and cloud providers that host content for a particular resource, (iv) Discern all the services/content hosted by a given CDN or cloud provider in a particular geography and time interval, and (v) Provides insights into all applications/services run- ning on any given layer-4 port number.

We conduct extensive experimental analysis and show re- sults from real traffic traces (including FTTH and 4G ISPs) that support our hypothesis. Simply put, the information provided by DNS traffic is one of the key components re- quired for understanding the tangled web, and bringing the ability to effectively manage network traffic back to the op- erators.\ 

}, keywords = {DNS, mPlane, passive measurement, WP2}, isbn = {978-1-4503-1705-4}, doi = {10.1145/2398776.2398819}, url = {http://dl.acm.org/citation.cfm?id=2398776.2398819\&coll=DL\&dl=GUIDE\&CFID=225051145\&CFTOKEN=42401286}, author = {Ignacio Nicolas Bermudez and Marco Mellia and Maurizio M Munafo{\textquoteright} and Ram Keralapura and Antonio Nucci} }