Hyong S. Kim

An empirical evaluation of entropy-based traffic anomaly detection

Entropy-based approaches for anomaly detection are appealing since they provide more fine-grained insights than traditional traffic volume analysis. While previous work has demonstrated the benefits of entropy-based anomaly detection, there has been little effort to comprehensively understand the detection power of using entropy-based analysis of multiple traffic distributions in conjunction with each other. We consider two classes of distributions: flow-header features (IP addresses, ports, and flow-sizes), and behavioral features (degree distributions measuring the number of distinct destination/source IPs that each host communicates with). We observe that the timeseries of entropy values of the address and port distributions are strongly correlated with each other and provide very similar anomaly detection capabilities. The behavioral and flow size distributions are less correlated and detect incidents that do not show up as anomalies in the port and address distributions. Further analysis using synthetically generated anomalies also suggests that the port and address distributions have limited utility in detecting scan and bandwidth flood anomalies. Based on our analysis, we discuss important implications for entropy-based anomaly detection.

QoS provisioning in cellular networks based on mobility prediction techniques

In cellular networks, QoS degradation or forced termination may occur when there are insufficient resources to accommodate handoff requests. One solution is to predict the trajectory of mobile terminals so as to perform resource reservations in advance. With the vision that future mobile devices are likely to be equipped with reasonably accurate positioning capability, we investigate how this new feature may be used for mobility predictions. We propose a mobility prediction technique that incorporates road topology information, and describe its use for dynamic resource reservation. Simulation results are presented to demonstrate the improvement in reservation efficiency compared with several other schemes.

Virtual path routing for survivable ATM networks

The advent of high-capacity optical fiber has increased the impact of a network failure in high-speed networks since a large volume of data can be lost even in a short outage. Self-healing algorithms have previosly been proposed to achieve fast restoration from a failure, but their success greatly depends on how traffic is distributed and how spare capacity is dimensioned over the network when a failure happens. Thus, in order to offer better network survivability, it is crucial that a network manager realizes a restorable traffic assignment in response to changing traffic demand and facility network configuration. The authors address the problem of virtual path routing for survivable asynchronous transfer mode (ATM) networks. An algorithm is developed to find a virtual path configuration and bandwidth assignment that minimizes the expected amount of lost flow upon restoration from a network failure. The concept of two-step restoration is introduced to achieve fast restoration as well as optimal reconfiguration. The problem can be formulated as a nonlinear, nonsmooth multicommodity flow problem with linear constraints. A modified flow deviation method is developed to obtain a near-optimal solution, where premature convergence to a nonsmooth point could be avoided by adjusting an optimization parameter. The result of the performance evaluation indicates that the proposed routing scheme can detect the links that are vulnerable to a failure under the current traffic demand pattern and adjust a flow so as to improve the network survivability level.

Performance of buffered banyan networks under nonuniform traffic patterns

An analytical method of evaluating the performance of the buffered banyan packet-switching network under nonuniform traffic patterns is presented. It is shown that nonuniform traffic can have a detrimental effect on the performance of the network. The analytical model is extended to evaluate the performance of multibuffer and parallel banyan networks. These modified networks are shown to have better throughput capacity and delay performance than the single-buffer banyan network. >

Optimal capacity and flow assignment for self-healing ATM networks based on line and end-to-end restoration

This paper addresses an optimal link capacity design problem for self-healing asynchronous transfer mode (ATM) networks based on two different restoration schemes: line restoration and end-to-end restoration. Given a projected traffic demand, capacity and flow assignment is jointly optimized to find an optimal capacity placement. The problem can be formulated as a large-scale linear programming. The basis matrix can be readily factorized into an LU form by taking advantage of its special structure, which results in a substantial reduction on the computation time of the revised simplex method. A row generation and deletion mechanism is developed to cope with the explosive number of constraints for the end-to-end restoration-based networks. In self-healing networks, end-to-end restoration schemes have been considered more advantageous than line restoration schemes because of a possible reduction of the redundant capacity to construct a fully restorable network. A comparative analysis is presented to clarify the benefit of end-to-end restoration schemes quantitatively in terms of the minimum resource installation cost. Several networks with diverse topological characteristics as well as multiple projected traffic demand patterns are employed in the experiments to see the effect of various network parameters. The results indicate that the network topology has a significant impact on the required resource installation cost for each restoration scheme. Contrary to a wide belief in the economic advantage of the end-to-end restoration scheme, this study reveals that the attainable gain could be marginal for a well-connected and/or unbalanced network.

Dynamic bandwidth reservation in cellular networks using road topology based mobility predictions

In cellular networks, an important call-level quality-of-service (QoS) issue is how to limit the probability of forced termination during handoffs. One solution is to predict the trajectory of mobile terminals so as to perform bandwidth reservation in advance. With the vision that future mobile devices are likely equipped with reasonably accurate positioning capability, we propose a novel mobility prediction technique that incorporates both mobile positioning information and road topology knowledge. We then develop an adaptive bandwidth reservation scheme that dynamically adjusts the reservation at each base station according to both incoming and outgoing hand-off predictions generated using our mobility prediction technique. We evaluate the performance of the scheme via simulations, along with six other schemes for comparison purposes. Results agree with intuition that schemes which incorporate more knowledge are able to achieve better reservation efficiency. Our scheme is shown to achieve the best efficiency among all realizable schemes simulated.

A self-routing multistage switching network for broadband ISDN

A switching network that approaches a maximum throughput of 100% as buffering is increased is proposed. This self-routing switching network consists of simple 2*2 switching elements, distributors, and buffers located between stages and in the output ports. The proposed switching requires a speedup factor of two. The structure and the operation of the switching network are described, and its performance is analyzed. The switch has log/sub 2/N stages that move packets in a store-and-forward fashion, incurring a latency of log/sub 2/N time periods. The performance analysis of the switch under uniform traffic pattern shows that the additional delay is small, and a maximum throughput of 100% is achieved as buffering is increased. >

Is co-scheduling too expensive for SMP VMs?

Symmetric multiprocessing (SMP) virtual machines (VMs) allow users to take advantage of a multiprocessor infrastructure. Despite the advantage, SMP VMs can cause synchronization latency to increase significantly, depending on task scheduling. In this paper, we show that even if a SMP VM runs non-concurrent applications, the synchronization latency problem can still occur due to synchronization in the VM kernel. Our experiments show that both of the widely used open source hypervisors, Xen and KVM, with the default schedulers are susceptible to the synchronization latency problem. To remediate this problem, previous works propose a co-scheduling solution where virtual CPUs (vCPUs) of a SMP VM are scheduled simultaneously. However, the co-scheduling approach can cause CPU fragmentation that reduces CPU utilization, priority inversion that degrades I/O performance, and execution delay, leading to deployment impediment. We propose a balance scheduling algorithm which simply balances vCPU siblings on different physical CPUs without forcing the vCPUs to be scheduled simultaneously. Balance scheduling can achieve similar or (up to 8%) better application performance than co-scheduling without the co-scheduling drawbacks, thereby benefiting various SMP VMs. The evaluation is thoroughly conducted against both concurrent and non-concurrent applications with CPU-bound, I/O-bound, and network-bound workloads in KVM. For empirical comparison, we also implement the co-scheduling algorithm on top of KVMs Completely Fair Scheduler (CFS). Compared to the synchronization-unaware CFS, balance scheduling can significantly improve application performance in a SMP VM (e.g. reduce the average TPC-W response time by up to 85%).

Comparative study on restoration schemes of survivable ATM networks

In self-healing networks, end-to-end restoration schemes have been considered more advantageous than line restoration schemes because of a possible cost reduction of the total capacity to construct a fully restorable network. This paper clarifies the benefit of end-to-end restoration schemes quantitatively through a comparative analysis of the minimum link capacity installation cost. A jointly optimal capacity and flow assignment algorithm is developed for the self-healing ATM networks based on end-to-end and line restoration. Several networks with diverse topological characteristics as well as multiple projected traffic demand patterns are employed in the experiments to see the effect of various network parameters. The results indicate that the network topology has a significant impact on the required resource installation cost for each restoration scheme. Contrary to a wide belief in the economic advantage of the end-to-end restoration scheme, this study reveals that the attainable gain could be marginal for a well-connected and/or unbalanced network.

A predictive bandwidth reservation scheme using mobile positioning and road topology information

In cellular networks, an important practical issue is how to limit the handoff dropping probability efficiently. One possible approach is to perform dynamic bandwidth reservation based on mobility predictions. With the rapid advances in mobile positioning technology, and the widespread availability of digital road maps previously designed for navigational devices, we propose a predictive bandwidth reservation scheme built upon these timely opportunities. In contrast to the common practice of utilizing only incoming handoff predictions at each cell to compute the reservations, our scheme is more efficient as it innovatively utilizes both incoming and outgoing handoff predictions; it can meet the same target handoff dropping probability by blocking fewer new calls. The individual base stations are responsible for the computations, which are shown to be simple enough to be performed in real-time. We evaluate the scheme via simulation, along with five other schemes for comparison. Simulation results show that those schemes that rely on positioning information are significantly more efficient than those that do not. Our schemes additional use of the road topology information further improves upon this advantage, bringing the efficiency closer to the bound set by a benchmark scheme that assumes perfect knowledge about future handoffs