@article {Teg2015a, title = {SLA verification and certification, Traffic Monitoring and Analysis}, year = {2015}, type = {Poster}, author = {Edion Tego and Elena Mammi and Ariana Rufini and Francesco Matera} } @inproceedings {Hou2015, title = {A Study of the Impact of DNS Resolvers on Performance Using a Causal Approach}, booktitle = {Internet Teletraffic Congress}, year = {2015}, month = {08/2015}, address = {Ghent, Belgium}, abstract = {For a user to access any resource on the Internet, it is necessary to first locate a server hosting the requested resource. The Domain Name System service (DNS) represents the first step in this process, translating a human readable name, the resource host name, into an IP address. With the expansion of Content Distribution Networks (CDNs), the DNS service has seen its importance increase. In a CDN, objects are replicated on different servers to decrease the distance from the client to a server hosting the object that needs to be accessed. The DNS service should improve user experience by directing its demand to the optimal CDN server. While most of the Internet Service Providers (ISPs) offer a DNS service to their customers, it is now common to see clients using a public DNS service instead. This choice may have an impact on Web browsing performance. In this paper we study the impact of choosing one DNS server instead of another and we compare the performance of a large European ISP DNS service with the one of a public DNS service, Google DNS. We propose a causal approach to expose the structural dependencies of the different parameters impacted by the DNS service used and we show how to model these dependencies with a Bayesian network. This model allows us to explain and quantify the benefits obtained by clients using their ISP DNS service and to propose a solution to further improve their performance.}, keywords = {DNS, reasoner}, author = {Hadrien Hours and Ernst Biersack and Patrick Loiseau and Alessandro Finamore and Marco Mellia} } @inproceedings {Col2014, title = {Scalable accurate consolidation of passively measured statistical data}, booktitle = {Passive and Active Measurement (PAM), Extended Abstract}, year = {2014}, month = {March}, address = {Los Angeles, USA}, abstract = {

Passive probes continuously collect a significant amount of traffic vol- ume, and autonomously generate statistics on a large number of metrics. A common statistical output of passive probe is represented by probability mass functions (pmf). The need for consolidation of several pmfs arises in two contexts, namely: (i) whenever a central point collects and aggregates measurement of multiple disjoint vantage points, and (ii) whenever a local measurement processed at a single vantage point needs to be distributed over multiple cores of the same physical probe, in order to cope with growing link capacity. Taking an experimental approach, we study both cases assessing the impact of different consolidation strategies, obtaining general design and tuning guidelines.

}, url = {http://perso.telecom-paristech.fr/~drossi/paper/rossi14pam-a.pdf}, author = {S. Colabrese and D Rossi and Marco Mellia} } @article {grimaudoTNSM2014, title = {SeLeCT: Self-Learning Classifier for Internet Traffic}, journal = {IEEE Transactions on Network and Service Management}, volume = {11}, year = {2014}, month = {06/2014}, chapter = {144}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. The most popular\ current solutions - Deep Packet Inspection (DPI) and statistical\ classification, deeply rely on the availability of a training set.\ Besides the cumbersome need to regularly update the signatures,\ their visibility is limited to classes the classifier has been trained\ for. Unsupervised algorithms have been envisioned as a viable\ alternative to automatically identify classes of traffic. However,\ the accuracy achieved so far does not allow to use them for traffic\ classification in practical scenario.

To address the above issues, we propose SeLeCT, a Self-Learning Classifier for Internet Traffic. It uses unsupervised algorithms along with an adaptive seeding approach to automatically\ let classes of traffic emerge, being identified and labeled. Unlike\ traditional classifiers, it requires neither a-priori knowledge of\ signatures nor a training set to extract the signatures. Instead,\ SeLeCT automatically groups flows into pure (or homogeneous)\ clusters using simple statistical features. SeLeCT simplifies label\ assignment (which is still based on some manual intervention) so\ that proper class labels can be easily discovered. Furthermore,\ SeLeCT uses an iterative seeding approach to boost its ability to\ cope with new protocols and applications.

We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ excellent precision and recall, with overall accuracy close to 98\%.\ Unlike state-of-art classifiers, the biggest advantage of SeLeCT\ is its ability to discover new protocols and applications in an\ almost automated fashion.

}, keywords = {clustering, self-seeding, Traffic Classification, unsupervised machine learning}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @inproceedings {Api2013, title = {SEARUM: a cloud-based SErvice for Association RUle Mining}, booktitle = {The 11th IEEE International Symposium on Parallel and Distributed Processing with Applications (ISPA-13)}, year = {2013}, abstract = {

Large volumes of data are being produced by various modern applications at an ever increasing rate. These applications range from wireless sensors networks to social networks. The automatic analysis of such huge data volume is a challenging task since a large amount of interesting knowledge can be extracted. Association rule mining is an exploratory data analysis method able to discover interesting and hidden correlations among data. Since this data mining process is characterized by computationally intensive tasks, efficient distributed approaches are needed to increase its scalability. This paper proposes a novel cloud-based service, named SEARUM, to efficiently mine association rules on a distributed computing model. SEARUM consists of a series of distributed MapReduce jobs run in the cloud. Each job performs a different step in the association rule mining process. As a case study, the proposed approach has been applied to the network data scenario. The experimental validation, performed on two real network datasets, shows the effectiveness and the efficiency of\ SEARUM in mining association rules on a distributed computing model.

}, keywords = {association rule mining, cloud-based service, distributed computing model, network data analysis}, doi = {10.1109/TrustCom.2013.153}, author = {Daniele Apiletti and Elena Baralis and Tania Cerquitelli and Silvia Chiusano and Luigi Grimaudo} } @article {Pap2013c, title = {Selection of Existing Probes and Datasets}, number = {D2.1}, year = {2013}, month = {08/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, abstract = {The mPlane architecture has been designed to include the possibility to interface with existing systems and platforms. While most measurement platforms in existence target a very specific measurement use case (e.g., the discovery of the Internet{\textquoteright}s router-level topology, the continuous measurement of the RTT among host pairs, the exporting via SNMP of network state, etc.), there are platforms that have a large deployed base, with lot of data being at disposal, and/or continuously collecting data. It would be a waste of resources to merely reproduce this effort within mPlane. Instead, mPlane aims at directly interfacing with existing systems and re-using their capabilities and data to feed measurement results to the mPlane intelligence. This document lists selected existing systems that are important for mPlane either for theoretical, conceptual or practical reasons, and that are part of the background of mPlane partners. A sub-set of these systems will be eventually incorporated into mPlane by developing the necessary interfaces. Others could be integrated by the means of proxy probes, i.e., the conceptual component responsible for such interfacing. The main focus of this document is to elaborate the concept of proxy probes, enumerate the systems that will be possibly considered for interface (proxy probe) development, and to give high level descriptions of the proxy probe design for these systems. The following list enumerates the systems that the consortium has chosen to include: - QoF - a TCP-aware IPFIX flow meter  Cisco Ping and SLA Agents - commercial availability and basic network parameter agents  - Tracebox - a tool for middlebox detection and identification - Scamper - a sophisticated active probing tool - MERLIN - a router-level topology discovery tool - TopHat - a configurable measurement system on top of PlanetLab - Tstat - a passive network monitoring tool - BlockMon - a flexible network monitoring and analysis tool - MisuraInternet - a QoS measurement system - Firelog - a Firefox plugin to measure HTTP QoE - Pytomo - an end-host-based video OoE measurement tool - DATI - a high performance deep packet inspector - MobiPerf - a tool for monitoring smartphone performance}, keywords = {active probes, existing probes, passive probes, probes, proxy probes}, author = {Dimitri Papadimitriou and Dario Rossi and YiXi Gong and Brian Trammell and Marco Milanesio and Ernst Biersack and Rolf Winter and Francesco Matera and Maurizio Dusi and Balazs Szabo and Tivadar Szemethy and Alessandro Finamore and Marco Mellia and Alessandro Capello and Fabio Invernizzi and Omar Jabr and Ilias Leontiadis and Benoit Donnet} } @inproceedings {Gri2013, title = {Self-Learning Classifier for Internet Traffic}, booktitle = {The 5th IEEE International Traffic Monitoring and Analysis Workshop (TMA 2013)}, year = {2013}, abstract = {

Network visibility is a critical part of traffic engineering, network management, and security. Recently, unsupervised algorithms have been envisioned as a viable alternative\ to automatically identify classes of traffic. However, the accuracy\ achieved so far does not allow to use them for traffic classification\ in practical scenario.
In this paper, we propose SeLeCT, a Self-Learning Classifier\ for Internet traffic. It uses unsupervised algorithms along with\ an adaptive learning approach to automatically let classes of\ traffic emerge, being identified and (easily) labeled. SeLeCT\ automatically groups flows into pure (or homogeneous) clusters\ using alternating simple clustering and filtering phases to remove\ outliers. SeLeCT uses an adaptive learning approach to boost its\ ability to spot new protocols and applications. Finally, SeLeCT\ also simplifies label assignment (which is still based on some\ manual intervention) so that proper class labels can be easily\ discovered.
We evaluate the performance of SeLeCT using traffic traces\ collected in different years from various ISPs located in 3\ different continents. Our experiments show that SeLeCT achieves\ overall accuracy close to 98\%. Unlike state-of-art classifiers, the\ biggest advantage of SeLeCT is its ability to help discovering\ new protocols and applications in an almost automated fashion.

}, doi = {10.1109/INFCOMW.2013.6562900}, author = {Luigi Grimaudo and Marco Mellia and Elena Baralis and Ram Keralapura} } @article {Ros2013a, title = {Specification of mPlane Access Control and Data Protection Mechanisms}, number = {D1.2}, year = {2013}, month = {08/2013}, institution = {mPlane Consortium}, type = {Public Deliverable}, address = {Torino}, abstract = {

This document primarily defines security specifications for the mPlane architecture (in terms of authentication, access control and safe communications), on the basis of what specified in the D1.1. Also, it provides a description of the measures that can be adopted in order to guarantee the privacy of the data gathered through the probes. This aspect of the mPlane infrastructure must not be neglected, since from a legal point of view the users{\textquoteright} right to privacy must be protected in any case. The techniques to be adopted are anonymization and aggregation, but utility of data decreases as the level of privacy increases, hence it is necessary to find a good trade-off. Two protocols are proposed for secure communications among components: TLS and SSH, which adopt respectively X.509 certificates and RSA keys for identity management. As the access control policy that will be adopted depends mostly on the mPlane administrators{\textquoteright} choices, this document provides a survey of several approaches. The cross-domain and the mobile scenarios are also analyzed, providing solutions that can guarantee access control, security and privacy.

}, keywords = {access control, anonymisation, authentication plane, privacy, security}, author = {Gianni De Rosa and Stefano Pentassuglia} } @article {Mar2013a, title = {Standardizing large-scale measurement platforms}, journal = {SIGCOMM Comput. Commun. Rev.}, volume = {43}, year = {2013}, pages = {58{\textendash}63}, keywords = {design, ietf, measurement platforms, standardization}, issn = {0146-4833}, doi = {10.1145/2479957.2479967}, url = {http://doi.acm.org/10.1145/2479957.2479967}, author = {Bagnulo Marcelo and Eardley Philip and Burbridge Trevor and Brian Trammell and Rolf Winter} } @inproceedings {Kue2013, title = {On the state of ECN and TCP Options on the Internet}, booktitle = {Passive and Active Measurement Conference (PAM)}, year = {2013}, month = {03/2013}, address = {Hong Kong}, abstract = {

Explicit Congestion Notification (ECN) is a TCP/IP extension that can avoid packet loss and thus improve network performance. Though standardized in 2001, it is barely used in today{\textquoteright}s Internet. This study, following on previous active measurement studies over the past decade, shows marked and continued increase in the deployment of ECN-capable servers, and usability of ECN on the majority of paths to such servers. We additionally present new measurements of ECN on IPv6, passive observation of actual ECN usage from flow data, and observations on other congestion-relevant TCP options (SACK, Timestamps and Window Scaling). We further present initial work on burst loss metrics for loss-based congestion control following from our findings.\ 

}, doi = {10.1007/978-3-642-36516-4_14}, author = {Mirja Kuehlewind and Sebastian Neuner and Brian Trammell} } @article {Dav2013, title = {Stream-monitoring with blockmon: convergence of network measurements and data analytics platforms}, journal = {SIGCOMM Comput. Commun. Rev.}, volume = {43}, year = {2013}, pages = {29{\textendash}36}, keywords = {data analysis, distributed computing, performance analysis}, issn = {0146-4833}, doi = {10.1145/2479957.2479962}, url = {http://doi.acm.org/10.1145/2479957.2479962}, author = {Simoncelli, Davide and Maurizio Dusi and Francesco Gringoli and Saverio Niccolini} }