Jilong Wang

Rumor Riding: Anonymizing Unstructured Peer-to-Peer Systems

Although anonymizing Peer-to-Peer (P2P) systems often incurs extra traffic costs, many systems try to mask the identities of their users for privacy considerations. Existing anonymity approaches are mainly path-based: peers have to pre-construct an anonymous path before transmission. The overhead of maintaining and updating such paths is significantly high. We propose Rumor Riding (RR), a lightweight and non-path-based mutual anonymity protocol for decentralized P2P systems. Employing a random walk mechanism, RR takes advantage of lower overhead by mainly using the symmetric cryptographic algorithm. We conduct comprehensive trace-driven simulations to evaluate the effectiveness and efficiency of this design, and compare it with previous approaches. We also introduce some early experiences on RR implementations.

On the design of fast prefix-preserving IP address anonymization scheme

Traffic traces are generally anonymized before used in analysis. Prefix-preserving anonymization is often used to avoid privacy issues as well as preserve prefix relationship after anonymization. To facilitate research on real time high speed network traffic, address anonymization algorithm should be fast and consistent. In this paper, the bit string based algorithm and the embedded bit string algorithm will be introduced. Bit string based algorithm uses precomputed bit string to improve the anonymization performance. Instead of only using the LSB of each Rijndael output, the embedded bit string algorithm will take advantage of the full size Rijndael output to anonymize several bits at the same time. The implementation can be downloaded from https://sourceforge.net/ projects/ipanon.

CDNs Meet CN An Empirical Study of CDN Deployments in China

Today’s content delivery networks (CDNs) use large sets of globally distributed servers, advanced routing techniques, and dynamic server selection to provide users with low delay, reliable access to Web, and streaming content. These strategies allow CDNs to extend their reach and performance into large numbers of networks around the globe. However, nearly 20% of Internet users reside in China, where local regulations and network policies make it challenging for global CDNs to serve foreign content from servers in China and limit the effectiveness of their traditional strategies for low-latency content delivery. Recently, a number of China-specific CDNs have partnered with global CDNs to provide service in the country. However, little is known about how CDNs in China are implemented, nor their impact on performance. In this paper, we are the first to investigate the impact of China’s unique policy and networking environment on CDN implementations and deployments. We find that deployments inside China exhibit different client-mapping behavior than global ones, namely, through static server selection for clients given a customer site, and through region-specific clients partitioning and mapping rather than using live network information. We also show that ignoring these properties can significantly impact server selection quality. Our results can be useful for optimization of CDNs in China.

DRAGON-Lab—Next generation internet technology experiment platform

Testbed technology is very important in the development of the Internet. Similar to the present internet, next generation internet also starts from testbed. There are two kinds of testbeds, testbed networks like CNGI-CERNET2, Internet2, Geant; testbed systems like PlanetLab, NS2. DRAGON-Lab can be viewed as both testbed network and testbed system. DRAGON-Lab is an independent AS (autonomous system) and connected to multiple real networks. On the other hand, DRAGON-Lab integrates many resources of its own, partners’ and internet’s, so as to provide open service. DRAGON-Lab has a large scale, provides open service, supports remote visualized experiments and programmable experiments. More details will be introduced in this paper.

Credit-based network management

Increasingly, a computer network administrators job is pre-occupied with user behavioral problems rather than physical failures of network and system components. A small number of malicious users can cause problems that affect a large number of users; more often, by not following proper procedures a user may let his/her system be used by malicious users; and there are various other misuses that all leave the network in a state of the tragedy of the commons. In this paper, we introduce the concept of credit-based networking - borrowing ideas from financial management and adapting them to network management. We first focus on a campus network by studying concrete scenarios of how credit-based network management can be applied. We then discuss how the concept is generally applicable to managing network behaviors as well by applying it to managing ISP peering relationships. We argue that the cascading effect of credit-based network management can enhance network management efficiency and improve the global network environment we all live in.

Netflow based P2P detection in UDP traffic

Though it is commonly assumed that Internet traffic is dominated by TCP, there has been an increasing demand for UDP based P2P applications. UDP is widely used in new P2P networks because it can provides better support for NAT traversal. Since many of these applications use private protocols, UDP traffic is often hard to analyze, especially if the available data is only netflow records. In this paper, a component based method is proposed to analyze UDP traffic. Since flows in each component share the same application, P2P traffic can be identified without packet level information.

UDP traffic classification using most distinguished port

Comparing to TCP traffic, the composition of UDP traffic is still unclear. Although it is observed that a large fraction of UDP traffic appears to be P2P applications, application level classification of UDP traffic is still very hard since most of these applications are private protocols based. In this paper, a novel method is proposed to classify UDP traffic. Based on the assumption that traffic from two communicating half-tuples identified by the <; IP address, portnumber > is from the same application, all half-tuples can be grouped into several connected subgraphs. The port numbers which are adopted by most links or half-tuples in each subgroup can thus be used to characterize the application types of the whole subgroup. Experiment results show that this approach is feasible and can classify UDP traffic only using flow level information. The port numbers adopted by most links or half-tuples are surprisingly stable among different time periods, for example, for Youku application remain the same for more than 90% of periods in all the 1429 periods.

Evaluation of bulk traffic mitigation practices in campus network

With the fast growing of internet, ISPs are faced with added challenges from unwanted bulk traffic. To deal with this problem, Tsinghua university implements bulk traffic mitigation practices to contain excessive use of bandwidth. Result indicates that current strategy can effectively decrease heavy use of bandwidth from aggressive applications. The strategy selection, effectiveness of the different practice and the selection of the quota limit are studied aided by the traffic statistics with and without these practices. Challenges to current bulk traffic mitigation practices are also discussed.

Impact of Development and Governance Factors on IPv4 Address Ownership

The worldwide distribution of IPv4 addresses is highly non-uniform. The factors that contribute to IPv4 address resources owned by a country remain unknown. In this paper, we systematically study the relationship between the number of allocated IPv4 addresses and 30 factors extracted from political, economic, ecological, social, and cultural dimensions. We observe that GDP has the largest influence on the number of IPv4 addresses while the influence of political factors is very weak. To further quantify the complex relationship among them, we fit data into a Decision Tree model. Based on the pruned model, we can extract precise rules that contribute to IPv4 address resources owned by a country. To the best of our knowledge, this is the first work to evaluate IPv4 address ownership by quantitative factors. Our work is helpful to better understand the network development of a country.

Correlation based analysis of spreading Codered worms

The spreading worms have greatly affected the network infrastructure security. After the CodeRed, there have been many new worms reported. To take countermeasure against the spreading worms, in this paper, a correlation based method is proposed and applied in the analysis. Results indicate that the spreading worms could cause dramatic changes in the flow size distribution. This method provides new insight into the worm detection and traffic anomaly discovery.