Contributions published at Communication Systems Group (Burkhard Stiller)

null

Bereits zum fünften Mal treffen sich dieses Jahr Forscher aus Deutschland und den europäischen Nachbarländern, um unter dem Dach des "Workshop on Mobile Ad-hoc Networks" Erfahrungen und Forschungsergebnisse auszutauschen und neue Ideen zu diskutieren. Nachdem der WMAN 2002 als eigenständige Veranstaltung abgehalten wurde, folgten 2004 und 2005 Veranstaltungen unter dem Dach der GI Jahrestagungen in Ulm und Bonn. 2007 fand der WMAN Workshop dann als Workshop der Konferenz "Kommunikation in Verteilten Systemen (KiVS) 2007" in Bern statt. Für 2009 ist wieder geplant, einen KiVS- Workshop anzubieten. Um die Kontakte und Diskussionen in diesen zwei Jahren nicht abreißen zu lassen, bieten wir 2008 nun ein neues Format an: ein WMAN Fachgespräch. In der Ausrichtung und den Anforderungen an die Beiträge ist dieses deutlicher und flexibler als ein vollständiger Workshop. Primäres Ziel ist ein informeller Gedankenaustausch, der durch Vorträge und kurze Beiträge unterstützt wird, die in Form dieses technischen Berichtes veröffentlicht werden. Themen der diesjährigen Beiträge sind verschiedenste Aspekte mobiler Ad-hoc Netzwerke, angefangen von der Nutzung von VoIP in Mesh Netzen, Beiträgen zu taktischen Ad-hoc Netzwerken und VANETs bis hin zur Tool-Unterstützung.

null

null

One of the key challenges in peer-to-peer networks is the design of incentives to encourage peers to share their resources. Incentives are necessary in order to exploit the full potential of these systems. The tit-for-tat incentive scheme, as used in BitTorrent for example, has proven to be a successful approach in P2P file sharing systems, where peers have direct relations and share the same kind of resources. However, in P2P systems where different kind of resources are shared between peers with non-direct relations, the design of incentives remains a challenge. In this paper, a large-scale, fully decentralized P2P collaboration network is shown, where peers share not only bandwidth and storage space, but also contribute by editing articles and voting for or against changes. A new incentive scheme is proposed which supports non-direct relations and provides incentives for sharing different kind of resources. The incentive scheme is based on a reputation system that assigns a reputation value to every peer reflecting its previous behavior in the network. Based on this value, the service level is differentiated, i.e. the higher a peer's reputation the better the quality of service it can get from the network. The service differentiation has been analyzed and simulated with rational, irrational and altruistic peers based on game theory concepts.

The following topics were dealt with: provisioning of bandwidth on demand; resource allocation; multi-domain optical networks; network pricing; bandwidth trading; virtual network topology control; bandwidth reservation network and GMPLS signalling.

null

Peer-to-peer (P2P) systems show numerous advantages over centralized systems, such as load balancing, scalability, and fault tolerance, and they require certain functionality, such as search, repair, and message and data transfer. In particular, structured P2P networks perform an exact search in logarithmic time proportional to the number of peers. However, keyword similarity search in a structured P2P network remains a challenge. Similarity search for service discovery can significantly improve service management in a distributed environment. As services are often described informally in text form, keyword similarity search can find the required services or data items more reliably. This paper presents a fast similarity search algorithm for structured P2P systems. The new algorithm, called P2P fast similarity search (P2PFastSS), finds similar keys in any distributed hash table (DHT) using the edit distance metric, and is independent of the underlying P2P routing algorithm. Performance analysis shows that P2PFastSS carries out a similarity search in time proportional to the logarithm of the number of peers. Simulations on PlanetLab confirm these results and show that a similarity search with 34,000 peers performs in less than three seconds on average. Thus, P2PFastSS is suitable for similarity search in large-scale network infrastructures, such as service description matching in service discovery or searching for similar terms in P2P storage networks.

A multitude of electronic services is offered nowadays over the Internet. Service consumers and service providers agree on contracts in which classical contract conditions (what, when, price) are settled. However, one important aspect, regarding the conditions of delivery, can not be settled: the path and with it, which legal domains (LDs) that must not be traversed. This work provides a compilation of approaches that allow to find and establish LD restricted paths. Among those approaches, the two most promising candidates are prototypical implemented. The first implemented approach allows to find an LD restricted path within an autonomous system (AS), based on LD annotated links and a constrained shortest path first algorithm. The second approach provides LD restricted AS paths by utilizing BGP information and AS-LD mappings. Both approaches are evaluated for their functionality by means of a reliability evaluation. In addition, the performance of the intra-AS approach is also evaluated and compared to the performance of a shortest path first implemenation.

Network-based intrusion detection systems monitoring state-of-the-art high-volume net- work links demand for more computational resources than available from conventional computer hardware. Frequently, this problem is overcome by increasing the available resources with dedicated, specialized hardware. Instead of employing expensive infras- tructure, efficiently decreasing the amount of data to be processed may lead to the same goal. NetFlow enabled routers can be used as a source for aggregated connection data that can be leveraged for intrusion detection purposes. Using a model, possible use cases for combining conventional, packet-based and novel, flow-based intrusion detection are elabo- rated. With the Bro intrusion detection system as a central component, an architecture to combine both data sources is presented. In order to effectively reduce the amount of pack- ets to be processed, a pre-filter employing flow data for the detection of peer-to-peer-based and IRC-based botnets is presented. The performed evaluation, based on the comparison of the new, combined approach and the analysis of all packets, shows, depending on the implementation, a reduction of re- source usage. Minor losses in the detection rate were observed. The prototypical imple- mentation which was realized with existing software components shows synergy potentials for combining NetFlow and packet data for intrusion detection purposes. Further work is recommended, particularly to develop a flow-based pre-filter in a low-level language in order to further enhance resource efficiency.

Socio-economics aims to understand the interplay between the society, economy, markets, institutions, self-interest, and moral commitments. It is a multidisciplinary field using methods from economics, psychology, sociology, history, and even anthropology. Socio-economics of networks have been studied for over 30 years, but mostly in the context of social networks instead of the underlying communication networks. The aim of this paper is to present and discuss challenges and perspectives related to “socio-economic” issues in the Future Internet. It is hoped that this will lead to new insights on how to structure the architecture and services in the Internet of the future.

Socio-economic aspects play an increasingly important role in the Future Internet. To enable a TripleWin situation for the involved players, i.e. the end users, the ISPs and telecommunication operators, and the service providers, a new, incentive-based concept is proposed referred to as Economic Traffic Management (ETM). It aims at reducing costs within the network while improving the Quality-of-Experience (QoE) for end users. In particular, peer-to-peer (P2P) overlay applications generate a large amount of costs due to inter-domain traffic. ETM solution approaches have to take into account (a) the traffic patterns stemming from the overlay application, (b) the charging models for transit traffic, and (c) the applicability and efficiency of the proposed solution. The complex interaction between these three components and its consequences is demonstrated on selected examples. As a result it is shown that different ETM approaches have to be combined for an overall solution. To this end, the paper derives functional and non-functional requirements for designing ETM and provides a suitable architecture enabling the implementation of a TripleWin solution.

The concept of Economic Traffic Management (ETM) encompasses various techniques for optimizing overlay networks considering both, underlay and overlay networks’ performance requirements as well as the resulting economic implications for ISPs. This work presents several mechanisms through an overall ETM System (ETMS), identifying the possibility for synergies between mechanisms, both in the sense of complementarity of decision grounds and in the sense of functionality and components employed thereby. The paper describes the core ETMS architecture and how various mechanisms are instantiated. It continues with the discussion of the flexibility and modularity of this architecture, allowing for the accommodation of synergies. Finally, it presents selected results from the test-bed trials of the ETMS and a dedicated discussion on incentives behind these ETM mechanisms.

null

Transfer protocols like TCP and UDP exist for broad use. Their handicap is the lack of flexibility in sending data parallel along different paths through the Internet. Studies of 28 have shown that in 30 - 80 per cent of the cases the data do not take the best way through the Internet. It is the aim of this work to develop a mechanism to enable the data to reach the receiver by means of dfferent paths, in order to improve the efficiency of the data transfer.The developed mechanism has to be implemented, tested and then evaluated The implemented application is able to find a path through different autonomous systems. Tests on the application demonstrated, that in an overlay network, consisting of 9 nodes, at the most two different paths may result. To clarify the effciency of the data transfer via parallel paths, further tests are necessary. The implemented thesis is based on the assumption, that two paths disturbe each other, if sent via the same physical path. But this is not granted. This thesis provides a basis for further and more distincted research work in order to verify the existence of bottlenecks.

Measuring IP traffic traces gets increasingly more complex as data flows tend to increase over time. Processing and storage may no longer only be done by a single unit, such as a router, but may be handled by multiple units. Therefore this thesis develops two kinds of distributed storage strategies for IP traffic traces, and responds to the need of joining multiple nodes into a processing and storage network on top of one of the most used P2P frameworks, Freepastry. The first storage strategy adopts a random approach towards distributing either processing power or storage capacity. The second strategy is based on a data-centric replication strategy and is therefore completely different from the random approach. The thesis will also compare these two strategies and concludes why one strategy is favourable over the other. This work was started on the basis of an existing project from a previous semester thesis. Therefore the analysis chapter will focus on the existing project where as the following conclusion will show what parts of that application might be reusable and what parts should be replaced for a variety of reasons. Furthermore this thesis will include work from an ongoing project at the University of Konstanz where they build and test an XML based storage system called TreeTank. The implementation of this storage system will hopefully result in a more robust and highly efficient storage and processing platform for IP traffic traces. The solution to the overall problem is an architecture design called DIPStorage.

Today’s Internet states a global network of networks with a broad variety of service providers. These offer goods like music files or live video streams that are electronically distributable over the Internet. In order to sell such a service in a global environment, a legally valid contract between a provider and his customer has to be concluded, based on legal foundations of both parties. In some situations, a service provider requires means to determine a client’s geographic location on country level. Geographic location information is not obtainable directly from the Internet’s TCP/IP protocol stack. Accordingly, this work attempts to investigate suitable methods that allow a mapping of end systems or intermediate systems in the Internet to their actual geographic location and provides a comprehensive compilation of feasible approaches. Furthermore, it addresses a prototypical implementation of two candidate systems that are considered best suited for this task. A first candidate states a location information server that provides position data within an administrative domain. A second candidate represents an IP address query tool that enables country lookups at all five regional Internet registries. Both candidates are evaluated regarding their location information granularity, reliability, automation and performance in order to provide an indication of their applicability in a productive environment and to draw a comparison with existing solutions.

Anomaly Detection Systems have been applied successfully to a great variety of applications. To the present day there is still no system available that detects anomalies in call patterns in a Voice over IP system in order to prevent possible abuses. This work analyses di erent established methods for anomaly detection and examines their applicability in this context. The goal of this work is to design, develop and prototypically implement an Anomaly Detection System which is able to monitor a user's call behavior and detect anomalies in real time. The Anomaly Detection System developed in this work takes into account the call parameters destination number, day of the week and time of day. The pro le creation, as well as the classi cation process are realized with statistical methods. The implementation is done in C++ and connected to Asterisk® using Asterisk's FastAGI protocol. The evaluation shows that the prototype can operate in real time successfully. The false positive and the false negative rates depend on the actual values of the classi er settings (thresholds, number of calls used for pro le creation, etc.). The results show that using the same values for all the pro les do not lead to optimal classi cation results for all pro les. Further investigations with respect to a dynamic adjustment of the con guration values to the user pro le are necessary. Also, the expansion of the model to take into account additional parameters (for example the location of the user) must be considered. Therefore the model could be expanded to a multi-stage classi er.

null