Sándor Laki

Spotter: A model based active geolocation service

The localization of Internet hosts opens space for a wide scope of applications, from targeted, location aware content provision to localizing illegal content. In this paper we present a novel probabilistic approach, called Spotter, for estimating the geographic position of Internet devices with remarkable precision. While the existing methods use landmark specific calibration for building their internal models we show that the delay-distance data follow a generic distribution for each landmark. Hence, instead of describing the delay-distance space in a landmark specific manner our proposed method handles all the calibration points together and derives a common delay-distance model. This fundamental discovery indicates that, in contrast to prior techniques, Spotter is less prone to measurement errors and other anomalies such as indirect routing. To demonstrate the robustness and the accuracy of Spotter we test the performance on PlanetLab nodes as well as on a more realistic reference set collected by CAIDA explicitly for geolocation comparison purposes. To the best of our knowledge, we are the first to use this novel ground truth containing over 23000 network routers with their geographic locations.

Early Identification of Peer-to-Peer Traffic

To manage and monitor their networks in a proper way, network operators are often interested in identifying the applications generating the traffic traveling through their networks, and doing it as fast (i.e., from as few packets) as possible. State-of-the-art packet-based traffic classification methods are either based on the costly inspection of the payload of several packets of each flow or on basic flow statistics that do not take into account the packet content. In this paper we consider the intermediate approach of analyzing only the first few bytes of the first (or first few) packets of each flow. We propose automatic, machine-learning-based methods achieving remarkably good early classification performance on real traffic traces generated from a diverse set of applications (including several versions of P2P TV and file sharing), while requiring only limited computational and memory resources.

A detailed path-latency model for router geolocation

This study outlines two novel techniques which can be used in the area of IP geolocation. First we introduce a detailed path-latency model to be able to determine the overall propagation delays along the network paths more accurately. This knowledge then leads to more precise geographic distance estimation between network routers and measurement nodes. In addition to the application of the detailed path-latency model, we describe a method which utilizes high-precision one-way delay measurements to further increase the accuracy of router geolocation techniques. The precise one-way delay values are used as a “path-constraint” to limit the overall geographic distance between the measurement nodes. The approach introduced in this paper can be used to localize all the network routers along the network path between the measurement nodes and can be combined with other existing geolocation techniques. The introduced techniques are validated in a wide range of experiments performed in the ETOMIC measurement infrastructure.

The NOVI information models

The NOVI Information Model (IM) and the corresponding data models are the glue between the software components in the NOVI Service Layer. The IM enables the communication among the various components of the NOVI Architecture and supports the various functionalities it offers. The NOVI IM consists of three main ontologies: resource, monitoring and policy ontology that have evolved over time to accommodate the emerging requirements of the NOVI architecture. This article presents the NOVI IM and its ontologies, together with an overview of how the NOVI software prototypes have benefited from using the IM.

On the network geography of the Internet

The geographic layout of the physical Internet inherently determines important network properties and traffic characteristics. To give insight into the geography of the Internet, we examine the spatial properties of the topology and routing. To represent the network we conducted a geographically dispersed traceroute campaign, and embedded the extracted topology into the geographic space by applying a novel IP geolocalization service, called Spotter. In this paper we present the frequency analysis of link lengths, quantify path circuitousness and explore the symmetry of end-to-end Internet routes.

ETOMIC Advanced Network Monitoring System for Future Internet Experimentation

ETOMIC is a network traffic measurement platform with high precision GPS-synchronized monitoring nodes. The infrastructure is publicly available to the network research community, supporting advanced experimental techniques by providing high precision hardware equipments and a Central Management System. Researchers can deploy their own active measurement codes to perform experiments on the public Internet. Recently, the functionalities of the original system were significantly extended and new generation measurement nodes were deployed. The system now also includes well structured data repositories to archive and share raw and evaluated data. These features make ETOMIC as one of the experimental facilities that support the design, development and validation of novel experimental techniques for the future Internet. In this paper we focus on the improved capabilities of the management system, the recent extensions of the node architecture and the accompanying database solutions.

SONoMA: A Service Oriented Network Measurement Architecture

Distributed network measurements are essential to characterize the structure, dynamics and operational state of the Internet. Although in the last decades several such systems have been created, the easy access of these infrastructures and the orchestration of complex measurements are not solved. We propose a system architecture that combines the flexibility of mature network measurement facilities such as PlanetLab or ETOMIC with the general accessibility and popularity of public services like Web based bandwidth measurement or traceroute servers. To realize these requirements we developed a network measurement platform, called SONoMA, based on Web Services and the basic principles of SOA, which is a well established paradigm in distributed business application development. Our approach opens the door to perform atomic and complex network measurements in real time, handles heterogeneous measurement devices, automatically stores the results in a public database and protects against malicious users as well. Furthermore, SONoMA is not only a tool for network researchers but it opens the door to developing novel applications and services requiring real-time and large scale network measurements.

High speed packet forwarding compiled from protocol independent data plane specifications

P4 is a high level language for programming network switches that allows for great flexibility in the description of packet structure and processing, independent of the specifics of the underlying hardware. In this demo, we present our prototype P4 compiler in which the hardware independent and hardware specific functionalities are separated. We have identified the requisites of the latter, which form the interface of our target specific Hardware Abstraction Library (HAL); the compiler turns P4 code into a target independent core program that is linked to this library and invokes its operations. The two stage separation improves portability: to support a new architecture, only the hardware dependent library has to be implemented. In the demo, we demonstrate the flexibility of our compiler with a HAL for Intel DPDK, and show the packet processing and forwarding performance of compiled switches in different scenarios.

Toward a holistic federated future internet experimentation environment: the experience of NOVI research and experimentation

This article presents the design and pilot implementation of a suite of intelligent methods, algorithms, and tools for federating heterogeneous experimental platforms (domains) toward a holistic Future Internet experimentation ecosystem. The proposed framework developed within the NOVI research and experimentation European collaborative effort, aims at providing a modular data, control, and management plane architecture that includes: an information model capturing the abstractions of virtualized resources residing in different yet interworking experimental platforms; resource mapping algorithms tackling the inter-domain virtual network embedding problem; mechanisms providing interoperability of monitoring tools; policy-based management services for role-based intra and inter-domain management policies; and dataplane stitching mechanisms to enable the composition of user-specific slices (baskets of virtual resources drawn from the federated substrate). The NOVI framework was deployed and validated in a combined testbed consisting of two dissimilar platforms: a private PlanetLab domain with resources interconnected over the public Internet; and FEDERICA, an infrastructure of virtual resources interconnected via dedicated networking facilities of European National Research and Education Networks and GÉANT. This pre-normative work is expected to contribute to bridging Future Internet experimental federations with interconnected cloud architectures and interworked public/private data-centers, adding value via its intelligent services, information models, and composite algorithms.

Efficient Methods for Early Protocol Identification

To manage and monitor their networks in a proper way, network operators are often interested in automatic methods that enable them to identify applications generating the traffic traveling through their networks as fast (i.e., from the first few packets) as possible. State-of-the-art packet-based traffic classification methods are either based on costly inspection of the payload of several packets in each flow or on basic flow statistics without taking into account the packet content. In this paper, we consider an intermediate approach of analyzing only the first few bytes of the first (or first few) packet(s) of each flow and propose automatic, machine-learning-based methods with very low computational complexity and memory footprint. The performance of these techniques are thoroughly analyzed, showing that outstanding early classification accuracy can be achieved on traffic traces generated by a diverse set of applications (including P2P TV and file sharing) in a laboratory environment as well as on a real-world data set collected in the network of a large European ISP.