Nicholas C. Valler

Non-binary information propagation: Modeling BGP routing churn

In this work, we generalize the commonly-used “binary” (or categorical) information propagation model to describe the propagation of a continuous-value node-property in a network. Most efforts so far focus on discrete states for nodes (i.e. healthy, sick). Here, we extend the above model to describe the propagation of a node property that is characterized by a real value. As a case study, we focus on routing messages at the Internet backbone (BGP level), which we refer to as routing instability or churn. Our goal is to develop the simplest possible model that can characterize the propagation of routing instability. To capture an important routing property (routing policies), we enrich the model in a non-trivial way. Varying our small set of model parameters, we show that our model can exhibit a wide range of behaviors, from fast “die-out” to non-zero steady-state and oscillations. To the best of our knowledge, this is the first work that casts routing as a network-wide propagation problem and sets the stage for a theoretical analysis of routing instability, and the propagation of non-binary node properties in general.

A behavior-aware profiling of handheld devices

The Bring-Your-Own-Handheld-device (BYOH) phenomenon continues to make inroads as more people bring their own handheld devices to work or school. While convenient to device owners, this trend presents novel management challenges to network administrators. Prior efforts only focused on studying either the comparative characterization of aggregate network traffic between BYOHs and non-BYOHs or network performance issues, such as TCP and download times or mobility issues. We identify one critical question that network administrators need to answer: how do these BYOHs behave individually? In response, we design and deploy Brofiler, a behavior-aware profiling framework that improves visibility into the management of BYOHs. The contributions of our work are two-fold. First, we present Brofiler, a time-aware device-centric approach for grouping devices into intuitive behavioral groups. Second, we conduct an extensive study of BYOHs using our approach with real data collected over a year, and highlight several novel insights on the behavior of BYOHs. These observations underscore the importance of that BYOHs need to be managed explicitly as they behave in unique and unexpected ways.

Smartphone viruses propagation on heterogeneous composite networks

Smartphones are now targets of malicious viruses. Furthermore, the increasing “connectedness” of smartphones has resulted in new delivery vectors for malicious viruses, including proximity-, social- and other technology-based methods. In fact, Cabir and CommWarrior are two viruses-observed in the wild-that spread, at least in part, using proximity-based techniques (line-of-sight bluetooth radio). In this paper, we propose and evaluate SI1I2S a competition model that describes the spread of two mutually exclusive viruses across heterogeneous composite networks, one static (social connections) and one dynamic (mobility pattern). To approximate dynamic network behavior, we use classic mobility models from ad hoc networking, e.g., Random Waypoint, Random Walk and Levy Flight. We analyze our model using techniques from dynamic systems and find that the first eigenvalue of the system matrices λs1, λs2 of the two networks (static and dynamic networks) appropriately captures the competitive interplay between two viruses and effectively predicts the competitions “winner”, which provides a feasible way to defend against smartphone viruses.

Characterizing the behavior of handheld devices and its implications

Abstract The Bring-Your-Own-Handheld-device (BYOH) phenomenon continues to make inroads as more people bring their own handheld devices to work or school. While convenient to device owners, this trend presents novel management challenges to network administrators as they have no control over these devices and no solid understanding of the behavior of these emerging devices. In order to cope with the impact of these BYOHs on current existing network management infrastructures, we identify two tightly-coupled questions that network administrators need to answer: (a) how do these BYOHs behave? and (b) how can we manage them more effectively based on the understanding of their behaviors? In response, we design and deploy Brofiler, a framework that could enable network administrators to effectively manage BYOHs via behavior-aware profiling. Our behavior-aware profiling captures the behaviors of each individual BYOH and improves the visibility on managing these BYOHs. In detail, the contributions of our work are three-fold. First, we present Brofiler, a time-aware device-centric approach for grouping devices into intuitive behavioral groups from multiple perspectives, including data plane, temporal behavior, and the protocol and control plane. Second, we conduct an extensive study of BYOHs using our approach with real data collected over a year, and highlight several novel insights on the behavior of BYOHs. For example, we find that 70% of the BYOHs generate 50% of their monthly data traffic in one day, while remaining mostly idle the rest of the month. In addition, 68% of BYOHs do not conform to DHCP protocol specifications. Third, we present the implications of our study based on the framework in DHCP management, bandwidth management and access control. Overall, our approach could enable network administrators better understand and manage these new emerging devices for their networks in the post-PC era.

XLR: Tackling the Inefficiency of Landmark-Based Routing in Large Wireless Sensor Networks

Landmark-based routing (LR) provides a promising approach for scalable point-to-point routing in wireless sensor networks (WSNs). Though various approaches have been proposed for landmark-based routing, they either introduce significant computational complexity or are inefficient in realistic, dynamic environments. In this paper, we identify three design principles that could form the basis of efficiency: algorithmic simplicity, update efficiency, and application awareness. Motivated by these principles, we present XLR, a new, flexible and comprehensive framework that tackles the inefficiency of landmark-based routing. XLR consists of four components: Relay Selection (RS), Parametric P-Norm distance function (PPN), Efficient Update with Coordinate Difference (EUCD) and General Forwarding (GF). The key advantage of XLR is that any subset of XLRs components can be independently incorporated into most landmark-based routing protocols.We perform extensive simulations to demonstrate that: (i) RS, a simple method, yields good performance comparable with previous methods, (ii) PPN increases LR performance considerably, (iii) EUCD reduces coordinate update overhead by up to 39%, and (iv) our GF outperforms previous approaches that consider factors such as link quality, delay and power consumption independently.

Characterizing the Scam Hosting Infrastructure

Industry has responded to the ever-growing presence of spam by attacking the spam distribution infrastructure, essentially trying to prevent spam email from ever landing in the inbox of end-users. Recently, industry and academia have begun investigating the web hosting infrastructure of spam campaigns, attacking spammers where it hurts most, in their pocketbooks. Spammers have responded by introducing cooperative interme- diaries that redirect traffic, effectively decoupling the spam- advertised URL from the final destination website. In this study, we analyze not only the URLs in spam messages, but the less-studied redirection infrastructure that takes the user to a target website or other malicious host. Our initial results show that among all the hosts that can be reached directly from URLs embedded in email bodies, 64.87% are cooperative redirection hosts. However, these redirection hosts are only used to protect a small portion (11.33%) of final destination websites. Additionally, we find that around 70% of embedded URLs resolve to two ranges of IP space (61.0.0.0/8 and 124.0.0.0/8). By further analyzing the relationship between the final destinations and redirection hosts, we find that 74.19% of the final destination hosts are located in the same AS with their redirection hosts.