Chase Cotton

The NEBULA Future Internet Architecture

The NEBULA Future Internet Architecture (FIA) project is focused on a future network that enables the vision of cloud computing [8,12] to be realized. With computation and storage moving to data centers, networking to these data centers must be several orders of magnitude more resilient for some applications to trust cloud computing and enable their move to the cloud.

Routers for the Cloud: Can the Internet Achieve 5-Nines Availability?

Todays Internet often suffers transient outages, but as increasingly critical services migrate to the cloud, much higher levels of Internet availability will be necessary.

A brief overview of the NEBULA future internet architecture

Nebula is a proposal for a Future Internet Architecture. It is based on the assumptions that: (1) cloud computing will comprise an increasing fraction of the application workload offered to an Internet, and (2) that access to cloud computing resources will demand new architectural features from a network. Features that we have identified include dependability, security, flexibility and extensibility, the entirety of which constitute resilience. Nebula provides resilient networking services using ultrareliable routers, an extensible control plane and use of multiple paths upon which arbitrary policies may be enforced. We report on a prototype system, Zodiac, that incorporates these latter two features.

A routing based resource registry

A proven distributed systems technology, Link-State routing, nominally used as an IGP (Interior Gateway Protocol) in large public and enterprise networks, is fundamentally a distributed database technology. In the SIS-IS system, this capability is used to implement a distributed process registry for high availability distributed systems (e.g. elastic cloud applications). The characteristics and performance of SIS-IS are compared to an alternate architecture which derives its distributed database function from a Distributed Hash Table (DHT) database.

Identifying and detecting applications within TLS traffic

Internet traffic is increasingly becoming encrypted, making the forensic analysis of packet content yield diminishing returns. Much traffic (web, email, chat, VoIP, etc.) is now protected using the cryptographic protocol known as Transport Layer Security (TLS). In 2014, Google encouraged increased TLS usage by favoring HTTPS in its search (SEO) rankings1. As a result, by 2016, approximately 30 percent of the top page search results on Google used HTTPS (SSL/TLS)1. While the largest fraction of traffic is now video (e.g. Netflix, YouTube), these communications too now use TLS2. Traditional traffic analysis leverages port numbers, domain names, certificate fields, and the available cryptographic suites. TLS fingerprinting3 for traffic classification4 has recently been used, but this is still insufficient to expose suspicious communication. In the absence of actual payload content, additional information such as the inter-packet arrival times, flow direction, TCP headers, and frequencies can be leveraged to estimate the application and data protected with SSL/TLS. For example, researchers leveraged supervised machine learning and a set of features such as previously suggested (packet arrival times, length, etc.) and achieved a 96% accuracy when predicting the 3-tuple of <Operating System, Browser, Application< of various SSL/TLS applications5. Our novel technique leverages data mining techniques and the TLS record size frequencies. We then leverage Multinomial Naïve Bayes and the K-means algorithm to respectively classify TLS sessions to a website and cluster the TLS sessions. We have achieved an accuracy of 90.5% in Multinomial Naïve Bayes Classification of websites and a V-measure of 89.9% and a Silhouette Coefficient of 54.6% in K-means clustering of TLS Sessions according to websites.

Next generation resilient redundant router

The need in the commercial Internet to continually improve unit capital costs coupled with the increased reliability needed to carry all service types drives carrier architectures toward ever larger routers deployed in non-redundant configurations. This requires advancements in High Availability (HA) Non-Stop operation of these systems. We propose and implement a distributed architecture for these next generation core routers by implementing N-Modular Redundancy for control process software. The system employs an eventually consistent framework based on a Distributed Hash Table database. The overall goal is a system capable of non-stop routing, meaning that a router can still process both control and data messages, even after multiple software and hardware failures. Details on the architecture are provided and an estimation of scalability, overhead, and fault recovery time is presented.