Jay Chen

Scalability, fidelity, and containment in the potemkin virtual honeyfarm

The rapid evolution of large-scale worms, viruses and bot-nets have made Internet malware a pressing concern. Such infections are at the root of modern scourges including DDoS extortion, on-line identity theft, SPAM, phishing, and piracy. However, the most widely used tools for gathering intelligence on new malware -- network honeypots -- have forced investigators to choose between monitoring activity at a large scale or capturing behavior with high fidelity. In this paper, we describe an approach to minimize this tension and improve honeypot scalability by up to six orders of magnitude while still closely emulating the execution behavior of individual Internet hosts. We have built a prototype honeyfarm system, called Potemkin, that exploits virtual machines, aggressive memory sharing, and late binding of resources to achieve this goal. While still an immature implementation, Potemkin has emulated over 64,000 Internet honeypots in live test runs, using only a handful of physical servers.

RuralCafe: web search in the rural developing world

The majority of people in rural developing regions do not have access to the World Wide Web. Traditional network connectivity technologies have proven to be prohibitively expensive in these areas. The emergence of new long-range wireless technologies provide hope for connecting these rural regions to the Internet. However, the network connectivity provided by these new solutions are by nature intermittent due to high network usage rates, frequent power-cuts and the use of delay tolerant links. Typical applications, especially interactive applications like web search, do not tolerate intermittent connectivity. In this paper, we present the design and implementation of RuralCafe, a system intended to support efficient web search over intermittent networks. RuralCafe enables users to perform web search asynchronously and find what they are looking for in one round of intermittency as opposed to multiple rounds of search/downloads. RuralCafe does this by providing an expanded search query interface which allows a user to specify additional query terms to maximize the utility of the results returned by a search query. Given knowledge of the limited available network resources, RuralCafe performs optimizations to prefetch pages to best satisfy a search query based on a users search preferences. In addition, RuralCafe does not require modifications to the web browser, and can provide single round search results tailored to various types of networks and economic constraints. We have implemented and evaluated the effectiveness of RuralCafe using queries from logs made to a large search engine, queries made by users in an intermittent setting, and live queries from a small testbed deployment. We have also deployed a prototype of RuralCafe in Kerala, India.

Hermes: data transmission over unknown voice channels

While the cellular revolution has made voice connectivity ubiquitous in the developing world, data services are largely absent or are prohibitively expensive. In this paper, we present Hermes1, a point-to-point data connectivity solution that works by modulating data onto acoustic signals that are sent over a cellular voice call. The main challenge is that most voice codecs greatly distort signals that are not voice-like; furthermore, the backhaul can be highly heterogeneous and of low quality, thereby introducing unpredictable distortions. Hermes modulates data over the extremely narrow-band approximately 3kHz bandwidth) acoustic carrier, while being severely constrained by the requirement that the resulting sound signals are voice-like, as far as the voice codecs are concerned. Hermes uses a robust data transcoding and modulation scheme to detect and correct errors in the face of bit flips, insertions and deletions; it also adapts the modulation parameters to the observed bit error rate on the actual voice channel. Through real-world experiments, we show that Hermes achieves approximately 1.2 kbps goodput which when compared to SMS, improves throughput by a factor of 5× and reduces the cost-per-byte by over a factor of 50x

SMS-based web search for low-end mobile devices

Short Messaging Service (SMS) based mobile information services have become increasingly common around the world, especially in emerging regions among users with low-end mobile devices. This paper presents the design and implementation of SMSFind, an SMS-based search system that enables users to obtain extremely concise (one SMS) message of 140 bytes) and appropriate search responses for queries across arbitrary topics in one round of interaction. SMSFind is designed to complement existing SMS-based search services that are either limited in the topics they recognize or involve a human in the loop. Given an unstructured search query, SMSFind, uses a conventional search engine as a back-end to elicit several search responses and uses a combination of information retrieval techniques to extract the most appropriate 140-byte snippet as the final SMS search response. We show that SMSFind returns appropriate responses for 57.3% of ChaCha search queries in our test set; this accuracy rate is high given that ChaCha employs a human to answer the same questions. We have also deployed a pilot version of SMSFind for use with a small focus group in Kenya to explore the interaction issues of such a system and share our experience.

Adaptive Congestion Control for Unpredictable Cellular Networks

Legacy congestion controls including TCP and its variants are known to perform poorly over cellular networks due to highly variable capacities over short time scales, self-inflicted packet delays, and packet losses unrelated to congestion. To cope with these challenges, we present Verus, an end-to-end congestion control protocol that uses delay measurements to react quickly to the capacity changes in cellular networks without explicitly attempting to predict the cellular channel dynamics. The key idea of Verus is to continuously learn a delay profile that captures the relationship between end-to-end packet delay and outstanding window size over short epochs and uses this relationship to increment or decrement the window size based on the observed short-term packet delay variations. While the delay-based control is primarily for congestion avoidance, Verus uses standard TCP features including multiplicative decrease upon packet loss and slow start. Through a combination of simulations, empirical evaluations using cellular network traces, and real-world evaluations against standard TCP flavors and state of the art protocols like Sprout, we show that Verus outperforms these protocols in cellular channels. In comparison to TCP Cubic, Verus achieves an order of magnitude (> 10x) reduction in delay over 3G and LTE networks while achieving comparable throughput (sometimes marginally higher). In comparison to Sprout, Verus achieves up to 30% higher throughput in rapidly changing cellular networks.

Dissecting Web Latency in Ghana

Web access is prohibitively slow in many developing regions despite substantial effort to increase bandwidth and network penetration. In this paper, we explore the fundamental bottlenecks that cause poor web performance from a clients perspective by carefully dissecting webpage load latency contributors in Ghana. Based on our measurements from 2012 to 2014, we find several interesting issues that arise due to the increasing complexity of web pages and number of server redirections required to completely render the assets of a page. We observe that, rather than bandwidth, the primary bottleneck of web performance in Ghana is the lack of good DNS servers and caching infrastructure. The main bottlenecks are: (a) Recursive DNS query resolutions; (b) HTTP redirections; (c) TLS/SSL handshakes. We experiment with a range of well-known end-to-end latency optimizations and find that simple DNS caching, redirection caching, and the use of SPDY can all yield substantial improvements to user-perceived latency.

Comparing web interaction models in developing regions

Internet connections in developing regions are scarce and often unreliable. While options for connecting to the Internet are gradually being realized, progress is slow. We observed people performing web search and browsing in a low bandwidth environment in Kerala, India. We found that people in this environment experienced frustration and boredom while waiting for page loads compared to typical experiences in the developed world. Following these observations, we conducted a formal study with 20 participants at the same location comparing the conventional web search and browsing process with an asynchronous queueing model. Participants using the asynchronous queueing system performed as well as the status quo in terms of the number of tasks completed, and we observed greater interaction and information viewed for the asynchronous system. Our participants also preferred the asynchronous system over conventional search. Finally, we found evidence that the asynchronous system would have greater benefits in environments where the network is even more constrained.

Computing security in the developing world: a case for multidisciplinary research

Technology users in the developing world face a varied and complex set of computer security concerns. These challenges are deeply tied to a range of contextual factors including poor infrastructure, non-traditional usage patterns, and different attitudes towards security, which make simply importing security solutions from industrialized nations inadequate. Recognizing this, we describe some of the specific security risks in developing regions and their relationships with technical, political, social, and economic factors. We present concrete examples of how these factors affect the security of individuals, groups, and key applications such as mobile banking. Our analysis highlights the urgency of the concerns that need attention and presents an important intellectual challenge for the research community.

Routing in an Internet-scale network emulator

One of the primary challenges facing scalable network emulation and simulation is the overhead of storing network-wide routing tables or computing appropriate routes on a per-packet basis. We present an approach to routing table calculation and storage based on spanning tree construction that provides an order of magnitude reduction in routing table size for Internet-like topologies. In our approach, we maintain a variable number of spanning trees for a given topology and choose the path between two hosts in each tree, choosing the shortest. We also populate offline a negative cache of actual shortest paths for source-destination pairs - typically a few percent of the total - where the lookups result in sub-optimal routes. We have implemented our technique in a popular network emulator, ModelNet, and show that our enhanced version can emulate Internet topologies 10-100 times larger than previously possible.

Analyzing and accelerating web access in a school in peri-urban India

While computers and Internet access have growing penetration amongst schools in the developing world, intermittent connectivity and limited bandwidth often prevent them from being fully utilized by students and teachers. In this paper, we make two contributions to help address this problem. First, we characterize six weeks of HTTP traffic from a primary school outside of Bangalore, India, illuminating opportunities and constraints for improving performance in such settings. Second, we deploy an aggressive caching and prefetching engine and show that it accelerates a users overall browsing experience (apart from video content) by 2.8x. Our accelerator leverages innovative techniques that have been proposed, but not evaluated in detail, including the effectiveness of serving stale pages, cached page highlighting, and client-side prefetching. Unlike proxy-based techniques, our system is bundled as an open-source Firefox plugin and runs directly on client machines. This allows easy installation and configuration by end users, which is especially important in developing regions where a lack of permissions or technical expertise often prevents modification of internal network settings.