Ivan Dedinski

Cross-Layer Peer-to-Peer Traffic Identification and Optimization Based on Active Networking

P2P applications appear to emerge as ultimate killer applications due to their ability to construct highly dynamic overlay topologies with rapidly-varying and unpredictable traffic dynamics, which can constitute a serious challenge even for significantly over-provisioned IP networks. As a result, ISPs are facing new, severe network management problems that are not guaranteed to be addressed by statically deployed network engineering mechanisms. As a first step to a more complete solution to these problems, this paper proposes a P2P measurement, identification and optimisation architecture, designed to cope with the dynamicity and unpredictability of existing, well-known and future, unknown P2P systems. The purpose of this architecture is to provide to the ISPs an effective and scalable approach to control and optimise the traffic produced by P2P applications in their networks. This can be achieved through a combination of different application and network-level programmable techniques, leading to a cross-layer identification and optimisation process. These techniques can be applied using Active Networking platforms, which are able to quickly and easily deploy architectural components on demand. This flexibility of the optimisation architecture is essential to address the rapid development of new P2P protocols and the variation of known protocols.

Cooperative Keep-Alives: An Efficient Outage Detection Algorithm for P2P Overlay Networks

One of the challenges of todays overlay networks, especially P2P, is still scalability. A key issue in almost all of the current overlay architectures is the link count per single node. If the link count is too high, the management overhead in terms of keep-alive messages increases. If the amount of links per node is too low, the resilience of the system against network splits decreases and the system can hardly route in an optimal way. Moreover, if keep-alive messages are not sent frequently enough, outdated information could be propagated, which again could cause net splits. This paper presents a new cooperative keep-alive algorithm that strongly reduces the costs for sending keep- alive messages and, at the same time, preserves the effectiveness and reliability of standard keep-alive mechanisms in todays overlay networks. The algorithm allows to increase the number of links per node, and, thus, to improve the connectivity and routing efficiency in the network, while keeping the keep-alive overhead low. When used without increasing the link count, the algorithm reduces drastically the keep-alive traffic. The properties of the algorithm are evaluated analytically and simulatively and compared to existing keep-alive techniques.There have been many proposals for constructing routing tables for distributed hash tables (DHT). They can be classified into two groups: A) those that assume that the peers are uniformly randomly distributed in the identifier space, and B) those that allow order-preserving hash functions that lead to a skewed peer distribution in the identifier space. Good solutions for group A have been known for many years. However, DHTs in group A are limited to use randomized hashing and therefore, queries over whole identifier ranges thus do not scale. Group B can handle such queries easily. However, it is more difficult to connect the peers such that the resulting topology provides efficient routing, small routing tables, and balanced routing load. We present an elegant new solution to construct an efficient DHT for group B. Our main idea is to decouple the identifier space from the routing topology. In consequence, our DHT allows arbitrarily skewed peer distributions in the identifier space and does not require the overhead of sampling. Furthermore, the table construction is cheap and does not require active replacement of lost routing entries. To evaluate the performance of routing cost and table construction under high churn, we built an efficient simulator. Using the right data structures, we can easily process the state of over one million peers in RAM.

A framework for large-scale simulation of collaborative intrusion detection systems

Distributed intrusion detection and prevention play an increasingly important role in securing computer networks. In a distributed intrusion detection system, information about the current situation and knowledge about attacks are exchanged, aggregated, fused, and correlated in a cooperative manner to overcome the limitations of conventional centralized intrusion detection systems. However, this distributed approach introduces new challenges such as self-organization and efficient communication techniques. In this paper we propose a novel framework for developing, simulating, and deploying a distributed intrusion detection system that consists of several collaborating agents. The framework provides a programming interface and comprises all essential communication and synchronization methods that enables self-organized collaboration in a completely distributed manner. In two experiments we demonstrate the performance and capabilities of our implementation by simulating a large-scale worm outbreak and a one-to-many attack. Furthermore, we present two applications of our framework to show how collaboration of agents can be used to detect one-to-many attacks and how detection performance benefits from cooperation of agents.

A Source Routing Solution to Non-Transitive Connectivity Problems in Distributed Hash Tables

Distributed hash tables are popular third generation P2P protocols which are well understood in theory. These protocols usually assume that every node in the overlay is able to exchange messages with any other overlay node. However, this assumption is not always true for real-world networks, including the PlanetLab or the entire Internet. In these networks, the non-transitive connectivity phenomenon is experienced, in which some overlay nodes are able to exchange messages with a certain node and others are not. This turned out to be a serious problem, particularly for structured P2P overlays. Non-transitive connectivity issues were mainly ignored by P2P research for a long time, but have been intensively discussed recently. This paper suggests a new measure for the degree of non-transitive connectivity and presents a comprehensive, source routing based solution, to overcome non-transitive connectivity problems in distributed hash tables.