Artur Ziviani

Detecting Skype flows in Web traffic

Network managers face nowadays a challenging problem to detect traffic from Skype, a very popular application for VoIP communications. If no restrictive firewalls are adopted, Skype uses UDP as its preferred transport protocol, but it is known that due to its high capacity of adaptation, Skype can operate behind many firewalls and network proxies without user configuration. Behind restrictive firewalls, Skype uses Web TCP ports (80 or 443) as a fallback mechanism to delude firewalls and other network elements. This strategy renders Skype traffic disguised as Web traffic quite difficult to detect by network operators. In this paper, we propose a method to efficiently detect Skype flows hidden among Web traffic. We validate our proposal using real-world experimental data gathered at a commercial Internet service provider (ISP) and an academic institution. Our experimental results show a performance of around 90% detection rate of disguised Skype flows with a false positive rate of only 2%, whereas a 100% detection rate of Skype flows in Web traffic is achieved with a false positive rate limited to only 5%. We also evaluate the feasibility of our proposal in a real-time Skype detection scenario.

An AS-level overlay network for IP traceback

Distributed denial of service attacks currently represent a serious threat to the appropriate operation of Internet services. To deal with this threat, we propose an overlay network that provides an IP-traceback scheme at the level of autonomous systems. Our proposed autonomous system-level IP-traceback system contrasts with previous works because it does not require a priori knowledge of the network topology and allows single-packet traceback and incremental deployment. Our first contribution is a new extension to the Border Gateway Protocol update-message community attribute that enables information to be passed across autonomous systems that are not necessarily involved in the overlay network. The second contribution is a new sequence-marking process to remove ambiguities in the traceback path. Two different strategies for incremental system deployment are investigated and evaluated. We show that strategic placement of the system on highly connected autonomous systems produces relevant results for IP traceback even if the system operates on only a few autonomous systems. The main conclusion is that the proposed system is suitable for large-scale networks such as the Internet because it provides efficient traceback and allows incremental deployment.

Detecting VoIP calls hidden in web traffic

Peer-to-peer (P2P) voice over IP (VoIP) applications (e.g. Skype or Google Talk) commonly use Web TCP ports (80 or 443) as a fallback mechanism to delude restrictive firewalls. This strategy renders this kind of traffic quite difficult to be detected by network managers. To deal with this issue, we propose and evaluate a method to detect VoIP calls hidden in Web traffic. We validate our proposal considering both Skype and Google Talk generated traffic by using real-world experimental data gathered at a commercial Internet Service Provider (ISP) and an academic institution. Our experimental results demonstrate that our proposed method achieves a performance of around 90% detection rate of VoIP calls hidden in Web traffic with a false positive rate of only 2%, whereas a 100% detection rate is achieved with a false positive rate limited to only 5%. We also evaluate the feasibility of applying our proposal in real-time detection scenarios.

On Metrics to Distinguish Skype Flows from HTTP Traffic

Skype is a Voice over IP (VoIP) Internet application that is gaining huge popularity in recent years. A key point to Skype popularity is its capability to dynamically adapt itself to operate behind firewalls or network proxies. A common way adopted by Skype to delude these network devices is to use port 80, normally expected to comprise HTTP traffic. In this paper, we propose metrics and investigate statistical tests intended to clearly distinguish Skype flows from HTTP traffic. We validate our study using real-world experimental datasets gathered at a commercial Internet Service Provider (ISP). Our experimental results suggest that the proposed methodology may be seen as a promising building block towards a system to detect general protocol anomalies in HTTP traffic.

Practical aspects of mobility in wireless self-organizing networks [Guest Editorial]

Wireless and mobile computing have advanced significantly in the last decade. In particular, we now face the challenge to spontaneously establish wireless self-organizing networks, such as ad hoc, disruption-tolerant, sensor, and wireless mesh networks. These spontaneous self-organizing networks have been the focus of intensive research activity in recent years. Spontaneous networks arise from the cooperation of mobile devices in an ad hoc fashion requiring no previous infrastructure in place. A key point to couple research and real-life applications in this context is to understand how mobility (of devices, users, and applications) impacts practical networking aspects.

Intra-domain IP traceback using OSPF

Denial of service (DoS) attacks are a serious threat to the appropriate operation of services within network domains. In this paper, we propose a system that creates an overlay network to provide intra-domain IP traceback to deal with this threat. The Main contribution of our proposal with respect to previous work is its ability to provide partial and progressive deployment of the traceback system throughout a monitored network domain. We build the overlay network using the OSPF routing protocol through the creation of an IP Traceback Opaque LSA (Link State Advertisement). We also investigate and evaluate the performance of partial and progressive deployment of the proposed system, showing its suitability even for large network domains.

Towards potential-based clustering for wireless sensor networks

Wireless Sensor Networks (WSNs) are expected to operate in an autonomous fashion, thus being capable of selfassembly and continuous self-organization in an efficient, reliable, and scalable manner during their network lifetime. In general, clustering in wireless sensor networks provides advantages such as scalability, improved robustness, and efficient power consumption. Although previous clustering approaches, such as [2, 4] show some interesting behavior, they overlook a fundamental parameter that has a strong impact on system performance: the cluster size. An alternative solution to form bounded-size clusters with low message overhead and low cluster overlap is through budget-based clustering [1]. In budget-based clustering algorithms, an initiator node (the cluster-head) is assigned an initial budget. The cluster-head starts then to distribute the budget among its neighbors, which in turn do the same until the budget is exhausted. This approach allows cluster growth to be based on local decisions rather than involving the clustering initiator at each round, thus limiting the message overhead. By controlling the allocated budget for cluster formation, one is able to control the upper bound on the cluster size. Krishnan and Starobinski [1] propose two algorithms for budget-based clustering: rapid and persistent algorithms. In the rapid algorithm, the initiator node A is assigned a budget βA, of which it accounts for itself and distributes βA − 1 to its neighbors. These neighbors do the same until the budget is exhausted. Each node that receives a message sends an acknowledgement to the initiator. If a node receives a budget that it cannot propagate because there

Looking Around First: Localized Potential-Based Clustering in Spontaneous Networks

We propose a new budget-based clustering algorithm for self-organizing networks. The basic idea behind our solution is that nodes first sense the environment using inherent Hello packets before starting forming clusters. In contrast with previous solutions that blindly distribute the budget to nearby nodes, our potential-based clustering algorithm applies a proportional budget distribution based on the connectivity degree of the nodes. This approach matches the principle that nodes in real networks are not uniformly distributed. Our simulation results show that the proposed approach outperforms previous ones.

An AS-level IP traceback system

Distributed Denial of Service (DDoS) attacks represent a serious threat to the appropriate operation of Internet services. To deal with this threat, we propose an IP traceback system (IPTS) intended to be deployed at the level of Autonomous Systems (ASes). Our IPTS requires a priori no knowledge of the network topology while allowing single-packet trace-back and incremental deployment.

FLAME: Flexible Lightweight Active Measurement Environment

We propose a platform for the rapid prototyping of active measurement tools to collect network characteristics. The proposed platform provides its users with basic active measurement primitives upon which sophisticated active measurement tools can be prototyped quickly, practically, and efficiently through scripts in the Lua scripting language. We validate the platform as well as show its flexibility and accuracy through experiments on a local testbed and also on Planet-lab.