In the design of distributed systems, defending against Sybil attack is an important issue. Recently, OSN (Online Social Network)-based Sybil defending approaches, which use the fast mixing property of a social network graph with sufficient length of random walks and provide Sybil-resistant trust values, have been proposed. However, because of the probabilistic property of the previous approaches, some honest (non-Sybil) identities obtain low trust value and they are mistakenly considered as Sybil identities. A simple solution of boosting the trust value of honest identities is using longer random walks, but this direct boosting method also increases trust values of Sybil identities significantly. In this paper, a two-step boosting method is proposed to increase the Sybil-resistant trust value of honest identities reasonably and to prevent Sybil identities from having high trust values. The proposed boosting method is composed of two steps: initializing the trust value with a reasonably long random walks and boosting the trust value by using much longer random walks than the first step. The proposed method is evaluated by using sampled social network graphs of Facebook, and it is observed that the proposed method reduces the portion of honest identities mistakenly considered as Sybil identities substantially (from 30% to 1.3%) and keeps the low trust values of Sybil identities.

When P2P systems are used for data sensitive systems, the data availability has become an important issue. The availability-based replication using individual node availability is the most popular method keeping high data availability efficiently. However, since the individual node availability is derived by the individual lifetime information of each node, the availability-based replication may select useless replicas. In this paper, we explore the relative MTTF (Mean Time To Failure)-based incentive scheme for the more efficient availability-based replication. The relative MTTF is used to classify the guaranteed replicas which can get the incentive node availability, and these replicas help reduce the data traffic and the number of replicas without losing the target data availability. Results from trace-driven simulations show that the replication using our relative MTTF-based incentive scheme achieves the same target data availability with 41% less data traffic and 24% less replicas.

Recently, Network Function Virtualization (NFV) has drawn attentions of many network researchers with great deal of flexibilities, and various network service chains can be used in an SDN/NFV environment. With the flexibility of virtual middlebox placement, how to place virtual middleboxes in order to optimize the performance of service chains becomes essential. Some past studies focused on placement problem of consolidated middleboxes which combine multiple functions into a virtual middlebox. However, when a virtual middlebox providing only a single function is considered, the placement problem becomes much more complex. In this paper, we propose a new heuristic method, the gradual switch clustering based virtual middlebox placement method, in order to improve the performance of service chains, with the constraints of end-to-end delay, bandwidth, and operation cost of deploying a virtual middlebox on a switch. The proposed method gradually finds candidate places for each type of virtual middlebox along with the sequential order of service chains, by clustering candidate switches which satisfy the constraints. Finally, among candidate places for each type of virtual middlebox, the best places are selected in order to minimize the end-to-end delays of service chains. The evaluation results, which are obtained through Mininet based extensive emulations, show that the proposed method outperforms than other methods, and specifically it achieves around 25% less end-to-end delay than other methods.

A widely-used query on a graph is a regular path query (RPQ) whose answer is a set of tuples of nodes connected by paths corresponding to a given regular expression. Traditionally, evaluating an RPQ on a large graph takes substantial memory spaces and long response time. Recently, several studies have focused on improving response time for evaluating an RPQ by splitting an original RPQ into smaller subqueries, evaluating them in parallel and combining partial answers. In these works, how to choose split labels in an RPQ is one of key points of the performance of RPQ evaluation, and rare labels of a graph can be used as split labels. However there is still a room for improvement, because a rare label cannot guarantee the minimum evaluation cost all the time. In this paper, we propose a novel approach of selecting split labels by estimating evaluation cost of each split subquery with a unit-subquery cost matrix (USCM), which can be obtained from a graph in prior to evaluate an RPQ. USCM presents the evaluation cost of a unit-subquery which is the smallest possible subquery, and we can estimate the evaluation cost of an RPQ by decomposing into a set of unit-subqueries. Experimental results show that our proposed approach outperforms rare label based approaches.

Virtual memory systems page out a cluster of contiguous modified pages in virtual memory to a swap disk at one disk I/O but cannot find large clusters in applications mainly changing non-contiguous pages. Our proposal stores small clusters at one disk I/O. This decreases disk writes for paging out small clusters, thus improving page-out performance.

In a smart home environment, sensors generate events whenever activities of residents are captured. However, due to some factors, abnormal events could be generated, which are technically reasonable but contradict to real-world activities. To detect abnormal events, a number of methods has been introduced, e.g., clustering-based or snapshot-based approaches. However, they have limitations to deal with complicated anomalies which occur with large number of events and blended within normal sensor readings. In this paper, we propose a novel method of detecting sensor anomalies under smart home environment by considering spatial correlation and dependable correlation between sensors. Initially, we pre-calculate these correlations of every pair of two sensors to discover their relations. Then, from periodic sensor readings, if it has any unmatched relations to the pre-computed ones, an anomaly is detected on the correlated sensor. Through extensive evaluations with real datasets, we show that the proposed method outperforms previous approaches with 20% improvement on detection rate and reasonably low false positive rate.

Recently in an SDN/NFV-enabled network, a consolidated middlebox is proposed in which middlebox functions required by a network flow are provided at a single machine in a virtualized manner. With the promising advantages such as simplifying network traffic routing and saving resources of switches and machines, consolidated middleboxes are going to replace traditional middleboxes in the near future. However, the location of consolidated middleboxes may affect the performance of an SDN/NFV network significantly. Accordingly, the consolidated middlebox positioning problem in an SDN/NFV-enabled network must be addressed adequately with service chain constraints (a flow must visit a specific type of consolidated middlebox), resource constraints (switch memory and processing power of the machine), and performance requirements (end-to-end delay and bandwidth consumption). In this paper, we propose a novel solution of the consolidated middlebox positioning problem in an SDN/NFV-enabled network based on flow clustering to improve the performance of service chain flows and utilization of a consolidated middlebox. Via extensive simulations, we show that our solution significantly reduces the number of routing rules per switch, the end-to-end delay and bandwidth consumption of service flows while meeting service chain and resource constraints.

Many cooperated web cache systems and protocols have been proposed. These systems, however, require expensive resources, such as external bandwidth and CPU power or storage of a proxy, while inducing hefty administrative costs to achieve adequate client population growth. Moreover, a scalability problem in the cache server management still exists. This paper suggests peer-to-peer client-clustering. The client-cluster provides a proxy cache with backup storage which is comprised of the residual resources of the clients. We use DHT based peer-to-peer lookup protocol to manage the client-cluster. With the natural characteristics of this protocol, the client-cluster is self-organizing, fault-tolerant, well-balanced and scalable. Additionally, we propose the Backward ICP which is used to communicate between the proxy cache and the client-cluster, to reduce the overhead of the object replication and to use the resources more efficiently. We examine the performance of the client-cluster via a trace driven simulation and demonstrate effective enhancement of the proxy cache performance.

DHT based p2p systems appear to provide scalable storage services with idle resource from many unreliable clients. If a DHT is used in storage intensive applications where data loss must be minimized, quick replication is especially important to replace lost redundancy on other nodes in reaction to failures. To achieve this easily, a simple replication method directly uses a consistent set, such as a leaf set and a successor list. However, this set is tightly coupled to the current state of nodes and the traffic needed to support this replication can be high and bursty under churn. This paper explores efficient replication methods that only glimpse a consistent set to select a new replica. Replicas are loosely coupled to a consistent set and we can eliminate the compulsory replication under churn. Because of a complication of the new replication methods, the careful data management is needed under churn for the correct and efficient data lookup. Results from a simulation study suggest that our methods can reduce network traffic enormously for high data durability.

Many p2p based wide-area storage networks have been proposed to provide scalable storage services by combining the idle resources of many unreliable nodes. These storage networks can also provide highly available and reliable storage services, by replicating each data on several nodes. The popular approach is availability based replication which uses individual node availability. However, some replicas leave within a short time under high churn in p2p networks. This results in heavy and bursty data traffic, and sometimes some data are lost. This paper presents the lifetime-aware replication which uses the lifetime of each node to prevent the bursty failures and the data loss. It keeps a primary replica which has enough time to replace a lost redundancy. It also spreads replicas on the timeline to reduce the overlapped replicas as best as it can. Results from event-driven simulations show that the lifetime-aware replication keeps high data durability with less data traffic.

While web proxy caching is a widely deployed technique, the performance of a proxy cache is limited by the local storage. Some studies have addressed this limitation by using the residual resources of clients via a p2p method and have achieved a very high hit rate. However, these approaches treat web objects as homogeneous objects and there is no consideration of various web characteristics. Consequently, the byte hit rate of the system is limited, external bandwidth is wasted, and perceived user latency is increased. The present paper suggests an efficient p2p based web caching technique that manages objects with different policies so as to exploit the characteristics of web objects, such as size and temporal locality. Small objects are stored alone whereas large objects are stored by dividing them into numerous small blocks, which are distributed in clients. On a proxy cache, header blocks of large objects take the place of objects themselves and smaller objects are cached. This technique increases the hit rate. Unlike a web cache, which evicts large objects as soon as possible in the case where clients fulfill the role of backup storage, large objects are given higher priority than small objects in the proposed approach. This maximizes the effect of hits for large objects and thereby increases the byte hit rate. Furthermore, we construct simple latency models for various p2p based web caching systems and analyze the effects of the proposed policies on these systems. We then examine the performances of the efficient policies via a trace driven simulation. The results demonstrate that the proposed techniques effectively enhance web cache performance, including hit rate, byte hit rate, and response time.

Distributed systems desire to construct a random overlay graph for robustness, efficient information dissemination and load balancing. A random walk-based overlay construction is a promising alternative to generate an ideal random scale free overlay in distributed systems. However, a simple random walk-based overlay construction can be affected by node churn. Especially, the number of edges increases and the degree distribution is skewed. This inappropriate distortion can be exploited by malicious nodes. In this paper, we propose a modified random walk-based overlay construction supported by a logistic/trial based decision function to compensate the impact of node churn. Through event-driven simulations, we show that the decision function helps an overlay maintain the proper degree distribution, low diameter and low clustering coefficient with shorter random walks.

Distributed Reflective Denial of Services (DRDoS) attacks have gained huge popularity and become a major factor in a number of massive cyber-attacks. Usually, the attackers launch this kind of attack with small volume of requests to generate a large volume of attack traffic aiming at the victim by using IP spoofing from legitimate hosts. There have been several approaches, such as static threshold based approach and confirmation-based approach, focusing on DRDoS attack detection at victim's side. However, these approaches have significant disadvantages: (1) they are only passive defences after the attack and (2) it is hard to trace back the attackers. To address this problem, considerable attention has been paid to the study of detecting DRDoS attack at source side. Because the existing proposals following this direction are supposed to be ineffective to deal with small volume of attack traffic, there is still a room for improvement. In this paper, we propose a novel method to detect DRDoS attack request traffic on SDN(Software Defined Network)-enabled gateways in the source side of attack traffic. Our method adjusts the sampling rate and provides a traffic-aware adaptive threshold along with the margin based on analysing observed traffic behind gateways. Experimental results show that the proposed method is a promising solution to detect DRDoS attack request in the source side.

In these days, recognizing a user personality is an important issue in order to support various personalized services. Besides the conventional phone usage such as call logs, SMS logs and application usages, smart phones can gather the behavior of users by polling various embedded sensors such as GPS sensors. In this paper, we focus on how to predict user attitude based on GPS log data by applying location clustering techniques and extracting features from the location clusters. Through the evaluation with one month-long GPS log data, it is observed that the location-based features, such as number of clusters and coverage of clusters, are correlated with user attitude to some extent. Especially, when SVM is used as a classifier for predicting the dichotomy of user attitudes of MBTI, over 90% F-measure is achieved.