Alden W. Jackson

Smart packets: applying active networks to network management

This article introduces Smart Packets and describes the smart Packets architecture, the packet formats, the language and its design goals, and security considerations. Smart Packets is an Active Networks project focusing on applying active networks technology to network management and monitoring. Messages in active networks are programs that are executed at nodes on the path to one or more target hosts. Smart Packets programs are written in a tightly encoded, safe language specifically designed to support network management and avoid dangerous constructs and accesses. Smart Packets improves the management of large complex networks by (1) moving management decision points closer to the node being managed, (2) targeting specific aspects of the node for information rather than exhaustive collection via polling, and (3) abstracting the management concepts to language constructs, allowing nimble network control.

Active network monitoring and control: the SENCOMM architecture and implementation

We present the architecture, design, and implementation of SENCOMM (smart environment for network control, monitoring and management). SENCOMM uses active network technology to comprise a management execution environment (SMEE), which coexists with other execution environments (EEs). Management applications, called smart probes, run in the SMEE. A probe and its data are mobile executable code that are delivered to the active node within an active network encapsulation protocol (ANEP) datagram. Our architecture is designed to actively control, monitor, and manage both conventional and active networks, and be incrementally deployed in existing networks. We present a set of goals, a design philosophy, and a set of basic requirements for controlling, monitoring, and managing networks using the active network technology. We discuss the operation and components of SENCOMM:. the management EE, a protocol, smart probes, and loadable libraries. We discuss the implementation issues uncovered in integrating SENCOMM into a selected EE and the decisions made to resolve them.

SLINGbot: A System for Live Investigation of Next Generation Botnets

There is an urgent need for a pro-active approach to botnet detection and mitigation that will enable computer network defenders to characterize emerging and future botnet threats and design effective defense techniques before these threats materialize. To this end, we have developed a System for Live Investigation of Next Generation bots (SLINGbot). SLINGbot is an extensible, composable bot framework that enables researchers to construct benign bots for the purposes of generating and characterizing botnet Command and Control (C2) traffic. This enables researchers to simulate current and potential future botnet traffic, characterize it, and design effective defense techniques. In this paper, we describe the SLINGbot system and how it can be used for the pro-active development of botnet defenses.

Rebound: Decoy routing on asymmetric routes via error messages

Decoy routing is a powerful circumvention mechanism intended to provide secure communications that cannot be monitored, detected, or disrupted by a third party who controls the users network infrastructure. Current decoy routing protocols have weaknesses, however: they either make the unrealistic assumption that routes through the network are symmetric (i.e., the router implementing the decoy routing protocol must see all of the traffic, in both directions, from each connection it modifies), or their protocol requires modifying the route taken by packets in connections that use the protocol, and these route changes are detectable by a third party. We present Rebound, a decoy routing protocol that tolerates asymmetric routes without modifying the route taken by any packet that passes through the decoy router, making it more difficult to detect or disrupt than previous decoy routing protocols.

Dynamic provisioning system for bandwidth-scalable core optical network

We describe the architecture of PHAROS (Petabit Highly-Agile Robust Optical System), developed under the DARPA CORONET program. PHAROS provides traffic engineering, resource management and signaling solutions for highly-agile, large-capacity core optical networks. PHAROS technology facilitates rapid configuration of network resources to address dynamic traffic needs in future global military and commercial communications, such as localized surges in capacity requirements that result from military operations. PHAROS technology also scales to support bandwidth-intensive, network-centric, collaborative and distributed computing applications, and accommodates the continued growth of video and biometric data services.

Improved capacity utilization via agile wavelength provisioning and protection sharing in global core optical metworks

DARPAs CORONET PHAROS (Petabit Highly-Agile Robust Optical System) provides traffic engineering algorithms and signaling solutions for highly-agile, large-capacity core optical networks. PHAROS technology will facilitate rapid configuration of network resources to address dynamic traffic needs in future global communications, such as localized surges in capacity requirements that result from flash-crowds and smooth recovery from multiple concurrent network faults. PHAROS technology is designed to scale to support bandwidth-intensive collaborative and distributed computing applications, and accommodates the continued growth of video services.