In this letter, we develop a behavioral metric with which spamming botnets can be quickly identified with respect to their residing IP blocks. Our method aims at line-speed operation without deep inspection, so only TCP/IP header fields of the passing packets are examined. However, the proposed metric yields a high-quality receiver operating characteristics (ROC), with high detection rates and low false positive rates.

We analytically prove that the error in the channel idle time-based collision probability estimation in face of non-saturated stations is bounded by 2/(CWmin+1) in the IEEE 802.11 wireless LANs (WLANs). This work explicitly quantifies the impact of non-saturation, and the result vindicates the use of the estimation technique in real-life IEEE 802.11 WLANs, in such applications as the acknowledgement-based link adaptation and the throughput optimization through contention window size adaptation.

Lawful Interception (LI) refers to a lawfully authorized process of looking into private communication under a court-issued warrant. Quite a number of countries have been drafting and enacting laws authorizing the LI procedures on packet-switched IP networks including traditional circuit-switched ones. As the IP mobility becomes more ubiquitous, propelled by wireless networks, it becomes an issue in the LI domain to keep track of a migrating target. However, with the world's focus on the current LI architectures, little consideration has been given to a seamless LI triggering, which accommodates IP mobility and vertical handover. Proposed herein are a seamless LI architecture and relevant triggering algorithms for the heterogeneous wireless networks. The simulation results demonstrate that the proposed architecture secures a seamless LI by capturing all the suspected target traffics without any time delay, which usually occurs during an LI triggering between different service providers. Furthermore, when compared with the existing LI architectures, the architecture significantly helps reduce transmission and the time consumed for analysis of the content of communication (CC) and intercept related information (IRI).

In this letter, we develop an analytical model for the drive-thru applications based on the IEEE 802.11p WAVE. The model shows that prioritizing the bitrates via the 802.11e EDCA mechanism leads to significant throughput improvement.

A novel method of voice frame aggregation for wireless mesh networks is presented. In the method, the degree of aggregation is automatically regulated by the congestion level on the wireless link. On the IEEE 802.11-based mesh network, it is shown to yield approximately twice the call capacity, while incurring no additional delay for frame aggregation.

Grouping multiple voice frames into a single IP packet ("frame grouping") is a commonly mentioned approach to saving bandwidth in IP telephony. But little is known as to when, how, and how much frame grouping should be done in Internet environment. This paper explores the feasibility and the methods of frame grouping based on Internet delay measurement. Specifically, we propose an adaptive frame grouping method that minimizes the delay violation while reducing the bandwidth usage by as much as a factor of two under real Internet delay fluctuations. The performance of the method is evaluated as it is used against a single voice stream and then against multiple voice streams.

The Next Generation Internet Initiative was launched in the U.S. to advance key networking technologies that will enable a new wave of applications on the Internet. Now, in its third year, the program has launched and fostered over one hundred new research projects in partnership with academic, industrial and government laboratories. One key research area that has been emphasized within the program is the next-generation optical networking. Given the ever increasing demand for network bandwidth, and the recent phenomenal advances in WDM technologies, the Next Generation Internet is expected to be an IP-based optical WDM network. As IP over WDM networking technologies mature, a number of important architectural, management and control issues have surfaced. These issues need to be addressed before a true Next Generation Optical Internet can emerge. This paper provides a brief introduction to the overall goals and activities of DARPA's NGI program and describes the key architectural, management, and control issues for the Optical Internet. We review the different IP/WDM networking architectural models and their tradeoffs. We outline and discuss several management and control issues and possible solutions related to the configuration, fault, and performance management of IP over dynamic WDM networks. We present an analysis and supporting simulation results demonstrating the potential benefits of dynamic IP over WDM networks. We then discuss the issues related to IP/WDM traffic engineering in more detail, and present the approach taken in the NGI SuperNet Network Control and Management Project funded by DARPA. In particular, we motivate and present an innovative integrated traffic-engineering framework for re-configurable IP/WDM networks. It builds on the strength of Multi-Protocol Label Switching (MPLS) for fine-grain IP load balancing, and on the strength of Re-configurable WDM networking for reducing the IP network's weighted-hop-distance, and for expanding the bottleneck bandwidth.

In the IEEE 802.11p WAVE system, applications can directly control the transmission power of the messages sent in WAVE Short Message Protocol (WSMP). This feature enables the vehicles to control the transmission range based on the application requirements and/or the vehicle density. Seemingly straightforward, however, the distributed power control between vehicles can easily go awry. Unless carefully coordinated, the power assignments can irrevocably deviate from the vehicle density pattern. In this letter, we first show that such anomaly happens for a straightforward power control where the power level reacts to the number of messages heard from ambient vehicles. Then in order to resolve the anomaly, we propose an application layer scheme that adapts the WSMP transmission power so that the power assignments precisely reflect the vehicle density pattern.

When the residual resources on a virtualized substrate network (SN) are insufficient to meet the resource demands from the requested virtual network (VN) at specific locations, we can attempt to accommodate the VN by allocating resources at alternative locations and transparently serve the accesses to the VN by having them internally rerouted to the actually allocated locations. In this letter, we explore the feasibility of nodal resource splitting in such alternative allocation scenarios. We find that in order to facilitate such alternative allocations, we should first define the node-link resource dependencies. Once the dependencies are given, we demonstrate that the splitting can visibly improve the SN utilization and the request rejection rate for VN embedding requests under many network scenarios.

The proposed scheduling scheme minimizes the energy consumption of a real-time task on the multi-core processor with the dynamic voltage and frequency scaling capability. The scheme allocates a pertinent number of cores to the task execution, inactivates unused cores, and assigns the lowest frequency meeting the deadline. For a periodic real-time task with consecutive real-time instances, the scheme prepares the minimum-energy solutions for all input cases at off-line time, and applies one of the prepared solutions to each real-time instance at runtime.

ACK thinning refers to the technique to discard or reduce TCP acknowledgements (ACKs) for the purpose of diverting scarce bandwidth to TCP data traffic. It has been shown that under some circumstances the technique is effective to boost the TCP throughput on wireless links, in particular the IEEE 802.11 wireless LAN (WLAN). In this letter, however, we show that ACK thinning backfires under congestion due to its cross-layer impact on the 802.11 MAC dynamics. With the ACK filtering example, we demonstrate the phenomenon and analyze the cause. Based on the analysis, we show how the IEEE 802.11 contention window size control solves the problem.

To access Internet services supported in a home network, a mobile node must obtain the right to use an access network, and it must be able to contact a home network gateway to access the Internet in the home network. This means that the device must be authenticated by an AP to use the access network, and it must additionally be authenticated by the home network gateway to access its home network. EAP-PEAP is currently the most commonly used authentication protocol in access networks, and IKEv2 is common security protocol for mutual authentication on the Internet. As the procedures in EAP-PEAP and IKEv2 are quite similar, EAP-PEAP can be replaced by IKEv2. If the access network authentication uses IKEv2-based protocols and the home network authentication also uses IKEv2, the IKEv2 messages exchanged in each authentication become duplicated. However, it should be noted that EAP-IKEv2 is not able to carry EAP exchanges. We propose a hybrid authentication mechanism that can be used to authenticate a mobile node for both networks simultaneously. The proposed mechanism is based on the IKEv2-EAP exchanges instead of the EAP exchanges currently used to authenticate the access network, but our scheme adopts the encapsulation method defined by EAP-IKEv2 to transport the IKEv2 message over IEEE 802.11 so as not to change the current access network authentication architecture and the message format used by the authentication protocols. The scheme authenticates both networks through a single IKEv2 authentication, rather than two authentication procedures - one for the access network and one for the home network. This reduces the number of exchanged messages and authentication time.

Network resiliency has become crucial as the failure of a group of networks happens more frequently, being caused by either natural disasters or malicious attacks. In order to enhance the resiliency of the Internet, we show that changing the evolving strategy is more important than increasing the number of links by multihoming, which connects a single network with two or more links. From the simulation with Internet topologies, it is shown that the resiliency of the Internet can be enhanced by replacing the current evolving strategy only in part.

In order to improve the quality of VoIP services, an adaptive routing method is proposed in the application layer of Internet gateways. This method determines routing paths based on the average one-way delays in a predetermined re-routing interval. In order to evaluate the performance of the method, five different routing policies are specifically designed and tested. Experimental results show that the method can improve the QoS of Internet phone services.

From the introduction of CodeRed and Slammer worms, it has been learned that the early detection of worm epidemics is important in order to reduce the damage resulting from outbreaks. A prominent characteristic of Internet worms is the random selection of subsequent targets. In this paper, we propose a new worm detection mechanism by checking the random distribution of destination addresses in network traffic. The proposed mechanism constructs a matrix from network traffic and checks the rank of the matrix in order to detect the spreading of Internet worms. From the fact that a random binary matrix holds a high rank value, ADUR (Anomaly Detection Using Randomness check) is proposed for detecting unknown worms based on the rank of the matrix. From experiments on various environments, it is demonstrated that the ADUR mechanism effectively detects the spread of new worms in the early stages, even when there is only a single host infected in a monitoring network. Also, we show that ADUR is highly sensitive so that the worm epidemic can be detectable quickly, e.g., three times earlier than the infection of 90% vulnerable hosts.