Marcel Flores

Searching for spam: detecting fraudulent accounts via web search

Twitter users are harassed increasingly often by unsolicited messages that waste time and mislead users into clicking nefarious links. While increasingly powerful methods have been designed to detect spam, many depend on complex methods that require training and analyzing message content. While many of these systems are fast, implementing them in real time could present numerous challenges. Previous work has shown that large portions of spam originate from fraudulent accounts. We therefore propose a system which uses web searches to determine if a given account is fraudulent. The system uses the web searches to measure the online presence of a user and labels accounts with insufficient web presence to likely be fraudulent. Using our system on a collection of actual Twitter messages, we are able to achieve a true positive rate over 74% and a false positive rate below 11%, a detection rate comparable to those achieved by more expensive methods. Given its ability to operate before an account has produced a single tweet, we propose that our system could be used most effectively by combining it with slower more expensive machine learning methods as a first line of defense, alerting the system of fraudulent accounts before they have an opportunity to inject any spam into the ecosystem.

Fury Route: Leveraging CDNs to Remotely Measure Network Distance

Estimating network distance between arbitrary Internet endpoints is an essential primitive in applications ranging from performance optimization to network debugging and auditing. Enabling such a primitive without deploying new infrastructure was demonstrated via DNS. However, the proliferation of DNS hosting has made DNS-based measurement techniques far less dependable. In this paper, we show that the heterogeneous infrastructure of different CDNs, combined with the proliferation of the EDNS0 client-subnet extension (ECS), enables novel infrastructureless measurement. We design Fury Route, a system that estimates network distance by utilizing ECS to construct a virtual path between endpoints via intermediate CDN replicas.

Oak: User-Targeted Web Performance

Web performance has long proved to be one of the most sought after and difficult to achieve components for the web. Since the inception of the modern web infrastructure, the situation has been growing in complexity, adding remote hosts and objects, providing everything from computation infrastructure, content distribution capability, and targeted advertising. While many of these components provide improvements for some users, the complexity of the Internet often leaves other users suffering from poor performance. We propose Oak, a system which addresses client performance on the individual level, hence addressing challenges which may be unique to the user. Oak measures a users performance for objects loading on a page, and determines which components are under-performing. Oak further provides an automated mechanism by which sites are able to replace resources with those provided by a better performing alternative service for a particular user. In this work, we demonstrate the prevalence of under-performing services on the web, finding that over 60% of the Alexa Top 500 have at least one under-preforming server. We further evaluate Oak on experimental and popular existing webpages, and demonstrate its effectiveness in making decisions in existing environments and with a distributed user base.

Enabling router-assisted congestion control on the Internet

Enabling communication between routers and endpoints has long been sought after as an approach to congestion control in the Internet. However, the narrow-waist of TCP/IP has complicated the deployment of such communication. In this paper, we present Kick-Ass1, a congestion control mechanism that enables explicit rate congestion control protocols to be deployed within the TCP/IP stack. The key idea is to utilize packet lengths as a vehicle to communicate fine-grained explicit rate and other information from routers to endpoints and vice versa. Given that our approach (i) requires no explicit coordination among Kick-Ass routers, (ii) no explicit coordination among Kick-Ass routers and endpoints, and (iii) is effective on paths that include legacy routers, it provides a practical road towards a faster Internet, today. Using large-scale simulations, testbed experiments, and wide-area Internet evaluations, we demonstrate that (i) a basic explicit-rate protocol using the Kick-Ass mechanism improves flow completion times by up to an order of magnitude and outperforms endpoint-based approaches, including CUBIC and PCC. (ii) Kick-Ass is incrementally deployable on the Internet. (iii) Deploying Kick-Ass at end-hosts and edge routers can enable the above performance benefits, without waiting for universal adoption. (iv) Our packet-fragmentation mechanism is well behaved on the Internet.

Riptide: Jump-Starting Back-Office Connections in Cloud Systems

Large-scale cloud networks are constantly driven by the need for improved performance in communication between datacenters. Indeed, such back-office communication makes up a large fraction of traffic in many cloud environments. This communication often occurs frequently, carrying control messages, coordination and load balancing information, and customer data. However, ensuring such inter-datacenter traffic is delivered efficiently requires optimizing connections over large physical distances, which is non-trivial. Worse still, many large cloud networks are subject to complex configuration and administrative restrictions, limiting the types of solutions that can be implemented. In this paper, we propose improving the efficiency of datacenter to datacenter communication by learning the congestion level of links in between. We then use this knowledge to inform new connections made between the relevant datacenters, allowing us to eliminate the overhead associated with traditional slow-start processes in new connections. We further present Riptide, a tool which implements this approach. We present the design and implementation details of Riptide, showing that it can be easily executed on modern Linux servers deployed in the real world. We further demonstrate that it successfully reduces total transfer times in a production global-scale content delivery network (CDN), providing up to a 30% decrease in tail latency. We further show that Riptide is simple to deploy and easy to maintain within a complex existing network.