Nabil Seddigh

Bandwidth assurance issues for TCP flows in a differentiated services network

Much industry attention has been focused on providing differentiated levels of service to users on IP networks. One such proposal is the RIO scheme proposed by Clark (see ACM Transactions on Networking, 1998 ). RIO is an extension of the RED algorithm that relies on a differentiated drop treatment during congestion to cause different levels of service. The end result of differentiated dropping of packets during congestion is differentiated throughput rates for end-users. The IETFs Diffserv Working Group has recently standardized a PHB (per hop behaviour) that is based on a differentiated drop scheme-assured forwarding (AF). This paper raises issues with providing bandwidth assurance for TCP flows in a RIO-enabled differentiated services network. The main contribution is a detailed experimental study of five different factors that impact throughput assurances for TCP and UDP flows in such a network. Our study demonstrates that these factors can cause different throughput rates for end-users in spite of having contracted identical service agreements.

Intelligent Traffic Conditioners for Assured Forwarding Based Differentiated Services Networks

Issues related to bandwidth assurance in Assured Forwarding based Differentiated Services (Diffserv) networks have been discussed in recent research papers [7][8][11]. Some of the factors that can bias bandwidth assurance are Round Trip Time (RTT), UDP/TCP interaction and different target rates. The bias due to these factors needs to be mitigated before bandwidth assurance for a paying customer can be articulated in Service Level Agreements (SLAs). This paper proposes intelligent traffic conditioning approaches at the edge of the network to mitigate the effect of Round Trip Time, UDP/TCP interactions, and different target rates. The simulation results show a significant improvement in bandwidth assurance with intelligent traffic conditioning. The limitation of the proposed solutions is that they require communication between edge devices. In addition, these solutions are not applicable for a one-to-any network topology.

A Connectionless Approach to Providing QoS in IP Networks

The attempt to provide QoS in IP networks has raised some interesting questions on how a service can be provided to meet the application requirements while obeying the network resource constraints. Previous efforts focussed on a flow-based, connection oriented approach to deliver QoS for IP Networks — Intserv. This approach was quite comprehensive but it has not been widely deployed because of complexity and scalability issues. A recent packet marking based scheme called Differentiated Services (Diffserv) Architecture provides a relatively simple and coarse approach. It is too early to predict the usefulness of this approach. This paper outlines a framework to deliver IP QoS which is based on Intserv. It addresses scalability concerns by removing the need for a connection-oriented reservation setup mechanism and replaces it with a Diffserv-like mechanism to consistently allocate bandwidth end-to-end in a network. A prototype device is discussed that manages bandwidth on a node. An algorithm is presented that allows the device to automatically detect application QoS requirements without the need for application-level signalling. A priority-based scheduling mechanism with a variant of weighted round-robin is described.

Experimental study of assured services in a diffserv IP QoS network

Much attention has recently been given to the differentiated services (Diffserv) approach to provide Quality of Service (QoS) for IP networks. This packet-marking based approach to IP QoS is attractive due to its simplicity and ability to scale. Two of the most popular services proposed for the Diffserv approach are the Assured and Premium Services. In this work prototypical implementations of Diffserv components are described. The prototypes are used to study the single-queue, dual drop-preference model proposed as a basis for assured services in Diffserv.

Evaluating a modified PCA approach on network anomaly detection

As the number, complexity and diversity of cyber threats continues to increase, anomaly detection techniques have proven to be a powerful technique to augment existing methods of security threat detection. Research has shown that Principal Component Analysis (PCA) is an anomaly detection method known to be viable for pinpointing the existence of anomalies in network traffic. Despite its recognized utility in detecting cyber threats, previous relevant research work has highlighted certain inconsistencies when the classical PCA method is used to detect anomalies in network traffic, resulting in false positives and false negatives. Specifically, it has been shown that the efficiency of the results are highly dependent on the nature of the input data and the calibration of its parameters. In classical PCA, the parameters have to be carefully selected in order to correctly define the normal and abnormal space. By obtaining real network traffic traces from a small enterprise and artificially injecting anomalies, we experiment with a modified PCA method to address the above shortcomings. The results of our experimentation are encouraging. The results indicate our modified PCA method may possess promising capabilities to efficiently detect network anomalies while addressing some of the limitations of the classic PCA approach.