Hui Tang Lin

A cross-layer design for TCP end-to-end performance improvement in multi-hop wireless networks

This paper presents a cross-layer approach for improving TCP performance in IEEE 802.11 wireless channels. The proposed protocol, designated as TCP-CL, is essentially an extension of the original IEEE 802.11 standard and the TCP protocol. By making slight modifications to the legacy IEEE 802.11 MAC and TCP protocols, TCP-CL provides a significant improvement in the performance of TCP in multi-hop wireless environments. The performance of TCP-CL is compared with that of standard TCP-Reno schemes in terms of the achieved effective throughput. The numerical results reveal that TCP-CL achieves a significant improvement in the TCP transmission performance over multi-hop wireless networks.

An Integrated WiMAX/WiFi Architecture with QoS Consistency over Broadband Wireless Networks

WiMAX and WiFi have emerged as promising broadband access solutions for the latest generation of wireless MANs and LANs, respectively. Their complementary features enable the use of WiMAX as a backhaul service to connect multiple dispersed WiFi hotspots to the Internet. This study proposes an integrated architecture utilizing a novel WiMAX/WiFi Access Point (W2-AP) device to effectively combine the WiMAX and WiFi technologies. In the proposed architecture, the protocol operation of the WiFi hotspots is the same as that of the WiMAX system. As a result, the WiFi network can support connection-oriented transmissions and QoS in a similar fashion to the WiMAX system, and thus a considerable improvement in the delay performance is obtained. The numerical results obtained using a Qualnet simulator confirm both the effectiveness and the efficiency of the proposed architecture.

Malware Virtualization-Resistant Behavior Detection

Many researchers monitor malicious software (malware) behavior using Virtual Machines (VM) to protect the underlying operating system. For virtual machines, the malware monitor process exists at the same layer as the real system so the monitor can get detailed behavior information without being discovered. There are some Anti-VM techniques employed by malware authors to ward off collection, analysis and reverse engineering of their malicious programs. Therefore, malware researchers may obtain inaccurate analysis from VM aware programs. This paper presents a solution to detect Anti-VM techniques. We collect behavioral information from malware and use an enhanced behavior distance algorithm to calculate the difference between real and virtual environments to distinguish if the malware has Anti-VM capability. Our experiments show this algorithm works well. This idea can improve malware analysis results and reduce malware misdetection.

Adaptive Network Coding for Broadband Wireless Access Networks

Broadband wireless access (BWA) networks, such as LTE and WiMAX, are inherently lossy due to wireless medium unreliability. Although the Hybrid Automatic Repeat reQuest (HARQ) error-control method recovers from packet loss, it has low transmission efficiency and is unsuitable for delay-sensitive applications. Alternatively, network coding techniques improve the throughput of wireless networks, but incur significant overhead and ignore network constraints such as Medium Access Control (MAC) layer transmission opportunities and physical (PHY) layer channel conditions. The present study provides analysis of Random Network Coding (RNC) and Systematic Network Coding (SNC) decoding probabilities. Based on the analytical results, SNC is selected for developing an adaptive network coding scheme designated as Frame-by-frame Adaptive Systematic Network Coding (FASNC). According to network constraints per frame, FASNC dynamically utilizes either Modified Systematic Network Coding (M-SNC) or Mixed Generation Coding (MGC). An analytical model is developed for evaluating the mean decoding delay and mean goodput of the proposed FASNC scheme. The results derived using this model agree with those obtained from computer simulations. Simulations show that FASNC results in both lower decoding delay and reduced buffer requirements compared to MRNC and N-in-1 ReTX, while also yielding higher goodput than HARQ, MRNC, and N-in-1 ReTX.

A Novel WDM EPON Architecture with Wavelength Spatial Reuse in High-Speed Access Networks

This study proposes a novel WDM EPON system based upon an AWG, in which multiple wavelengths are established in both the upstream and the downstream fibers. The use of the AWG device enables the WDM EPON architecture to support wavelength spatial reuse and allows the ONUs to communicate directly with one another rather than through the OLT. The proposed WDM EPON scheme takes account of the requirement for backward compatibility with the 802.3ah MPCP and investigates the associated DBA algorithm used to arbitrate the access of each individual ONU over the WDM layer.

FARE: An efficient integrated MAC protocol for differentiated services in WDM metro rings

This study investigates the fairness control, collision avoidance and QoS support issues of a particular WDM dual-ring network known as FT^2-TR^2. This system is an extended version of the original uni-directional FT-TR ring architecture, in which every node is equipped with a fixed-tuned transmitter and a tunable receiver on each ring. This study proposes a novel FAirness and REservation integrated protocol, designated FARE, which incorporates three mechanisms designed specifically to resolve the receiver collision problem, to achieve fairness among all of the network nodes, and to meet the tight delay requirements of multimedia applications. Simulation results are presented to demonstrate that FARE provides a high performance for real-time traffic while simultaneously providing significant performance improvements for best-effort traffic.

An improved ant colony system algorithm for solving the IP traceback problem

The difficulty in identifying the origin of an attack over the Internet is termed the IP traceback (IPTBK) problem. The probable origin of an attack is commonly investigated using some form of ant colony system (ACS) algorithms. However, such algorithms tend to converge to a local suboptimal solution, meaning that the perpetrator of the attack cannot be found. Therefore, the present study proposes a modified ACS scheme (denoted as ACS-IPTBK) that can identify the true attack path even without the entire network routing information. The ability of the ants to search all feasible attack paths was enhanced using a global heuristic mechanism in which the ant colony was partitioned into multiple subgroups, with each subgroup having its own pheromone updating rule. The performance of the ACS-IPTBK algorithm in reconstructing the attack path was investigated through a series of ns2 simulations by using network topologies generated by the Waxman model. The simulations focused specifically on the effects of the ACS model parameters and network characteristics on the performance of the ACS-IPTBK scheme in converging towards the true attack path. Finally, the robustness of the proposed scheme against spoofed IP attacks was investigated. The results showed that the proposed scheme has a slightly slower convergence speed than does the conventional ACS algorithm, but yields a more globally optimal solution for the attack path, particularly in large-scale network topologies.

Genetic-based real-time fast-flux service networks detection

A new DNS technique called Fast-Flux Service Network (FFSN) has been employed by bot herders to hide malicious activities and extend the lifetime of malicious root servers. Although various methods have been proposed for detecting FFSNs, these mechanisms have low detection accuracy and protracted detection time. This study presents a novel detection scheme, designated as the Genetic-based ReAl-time DEtection (GRADE) system, to identify FFSNs in real time. GRADE differentiates between FFSNs and benign services by employing two new characteristics: the entropy of domains of preceding nodes for all A records and the standard deviation of round trip time to all A records. By applying genetic algorithms, GRADE is able to find the best strategy to detect current FFSN trends. Empirical results show GRADE has very high detection accuracy (~98%) and gives results within a few seconds. It provides considerable improvement over existing reference schemes such Flux-Score [8], SSFD [13], and FFSD [14].

Design and Analysis of a WDM EPON for Supporting Private Networking and Differentiated Services

Although EPONs have been proposed as a means of overcoming the bandwidth bottleneck problem in local access networks, they may not be able to meet the ever-growing bandwidth demand from users in the near future. Accordingly, this study presents what we believe to be a novel wavelength-division-multiplexing (WDM) Ethernet passive optical network (EPON) system based on an arrayed-waveguide-grating (AWG) module to meet the rapidly increasing bandwidth demand anticipated in the future. The use of the AWG enables the proposed WDM EPON architecture to achieve wavelength spatial reuse and to provide an intercommunication capability between optical network units (ONUs). As a result, the architecture not only allows upstream access to the central office, but also facilitates a truly shared LAN capability among the end users. Furthermore, the proposed WDM EPON scheme takes account of the requirement for backward compatibility with the IEEE 802.3ah multipoint control protocol and incorporates a dynamic bandwidth allocation scheme and a quality-of-service provisioning mechanism to arbitrate the access of the individual ONUs over the WDM layer. An analytical framework is developed for evaluating the mean packet delay and mean queue length of the proposed WDM EPON system. The analytical results derived using this framework are found to be in good agreement with those obtained from computer simulations.

SPON: A slotted long-reach PON architecture for supporting internetworking capability

Long-reach optical access technologies have emerged as a promising solution for combining access and metro backhaul networks in a cost-effective manner. This study develops a Slotted PON (SPON) architecture based upon an AWG for long-reach optical access networks. The AWG enables the SPON to achieve wavelength spatial-reuse and to provide an internetworking capability amongst ONUs located within different local access networks. In addition, a Slotted MAC (SMAC) protocol is proposed to arbitrate the access of the individual ONUs over the DWDM layer. The simulation results show that the SPON architecture integrated with SMAC protocol enhances the bandwidth utilization within the network, and therefore achieve a significant reduction in the average packet delay.