01138nas a2200145   4500000000100000000000100001000000100002008004100003100001900044245009200063300001400155490000700169520080200176022001400978       2013                            d1 aPawel Foremski00aOn different ways to classify Internet traffic: a short review of selected publications  a119–1360 v253 aTraffic classification is an important tool for network management. It reveals the source of observed network traffic and has many potential applications in Quality of Service, network security, traffic visualization, and more. In the last decade, traffic classification evolved quickly due to the raise of peer-to-peer traffic. Nowadays, researchers still find new methods in order to withstand the rapid changes in the Internet. In this paper, we review 13 papers on traffic classification and related topics that were published during 2009-2012. We show diversity in recent algorithms and we highlight possible directions for the future research on traffic classification: relevance of multi-level classification, importance of experimental validation, and the need for common traffic datasets.  a1896-533400550nas a2200121   4500000000100000000000100001000000100002008004100003100001900044245006000063490000700123520029800130       2012                            d1 aPawel Foremski00aTracedump: A Novel Single Application IP Packet Sniffer0 v243 aThe article introduces a novel Internet diagnosis utility - an open source IP packet sniffer which captures TCP and UDP packets sent and received by a single Linux process only. Preliminary evaluation results are presented. The utility can be applied in the field of IP traffic classification.00841nas a2200109   4500000000100000000000100001008004100002260002600043100001900069245008200088520056100170       2011                            d  bPolitechnika Śląska1 aPawel Foremski00aStatistical, real-time classification of IP traffic in Linux operating system3 aThe thesis introduces a practical system for statistical classification of IP traffic. Two novel algorithms are applied and extended. They are based on feature vector classification using SVM. A software library written in C language is presented. Resultant system can monitor network interfaces in realtime and read off-line packet trace files. Simultaneous classification, system training, and performance evaluation is possible. The system yields very good results, in terms of quality and packet processing speed, achieving %TP>97 and %FP=0 on average.01166nas a2200157   4500000000100000000000100001008004100002260005000043100001900093700001700112700001400129700001400143245007300157300001100230520076700241       2015                            d  bSpringer International Publishing Switzerland1 aPawel Foremski1 aC. Callegari1 aM. Pagano1 aPiotr Gaj00aWaterfall traffic identification: optimizing classification cascades  a1–103 aThe Internet transports data generated by programs whch cause various phenomena in IP flows. By means of machine learning techniques, we can automatically discern between flows generated by different traffic sources and gain a more informed view of the Internet. In this paper, we optimize Waterfall, a promising architecture for cascade traffic classification. We present a new heuristic approach to optimal design of cascade classifiers. On the example of Waterfall, we show how to determine the order of modules in a cascade so that the classification speed in maximized, while keeping the number of errors and unlabeled flows at minimum. We validate our method experimentally on 4 real traffic datasets, showing significant improvements over random cascades.01223nas a2200145   4500000000100000000000100001008004100002100001900043700001700062700001400079245006200093856006200155520084600217022001401063       2014                            d1 aPawel Foremski1 aC. Callegari1 aM. Pagano00aDNS-Class: Immediate classification of IP flows using DNS  uhttps://www.iitis.pl/ pjf/pub/2014-dnsclass-preprint.pdf3 aNowadays we see a tremendous growth of the Internet, especially in terms of the amount of data being transmitted and new network protocols being introduced. This poses a challenge for network administrators, who need adequate tools for network management. Recent findings show that DNS can contribute valuable information on IP flows and improve traffic visibility in a computer network. In this paper, we apply these findings on DNS to propose a novel traffic classification algorithm with interesting features. We experimentally show that the information carried in domain names and port numbers is sufficient for immediate classification of a highly significant portion of the traffic. We present DNS-Class: an innovative, fast, and reliable flow-based traffic classification algorithm, which on average yields 99.8% of True Positives and  a1099-119001093nas a2200133   4500000000100000000000100001008004100002100001900043700001700062700001400079245007700093520077500170022001400945       2014                            d1 aPawel Foremski1 aC. Callegari1 aM. Pagano00aWaterfall: Rapid identification of IP flows using cascade classification3 aIn the last years network traffic classification has attracted much research effort, given that it represents the foundation of many Internet functionalities such as Quality of Service (QoS) enforcement, monitoring, and security. Nonetheless, the proposed works are not able to satisfactorily solve the problem, usually being suitable for only addressing a given portion of the whole network traffic and thus none of them can be considered an ultimate solution for network classification. In this paper, we address network traffic classification by proposing a new architecture-named Waterfall architecture-that, by combining several classification algorithms together according to a cascade principle, is able to correctly classify the whole mixture of network traffic.  a1865-092900637nas a2200121   4500000000100000000000100001008004100002100001900043700002100062700002200083245004800105520036200153       2014                            d1 aPawel Foremski1 aMichał Gorawski1 aKrzysztof Grochla00aSource Model of TCP Traffic in LTE Networks3 aWe propose a generator that represents traffic transmitted in wireless mobile networks. It is based on the measurements of traffic in large scale LTE networks. The proposed tool generates TCP flow sizes and duration. We verify the proposed generator by comparison with traces available in the literature and propose application in discrete event simulators.01743nas a2200181   4500000000100000000000100001000000100002008004100003260000600044100001900050700002100069700002200090700001800112245009100130490000700221520131900228022001401547       2015                            d  c91 aPawel Foremski1 aMichał Gorawski1 aKrzysztof Grochla1 aKonrad Połys00aEnergy-Efficient Crowdsensing of Human Mobility and Signal Levels in Cellular Networks0 v153 aThe paper presents a practical application of the crowdsensing idea to measure human mobility and signal coverage in cellular networks. Currently, virtually everyone is carrying a mobile phone, which may be used as a sensor to gather research data by measuring, e.g., human mobility and radio signal levels. However, many users are unwilling to participate in crowdsensing experiments. This work begins with the analysis of the barriers for engaging people in crowdsensing. A survey showed that people who agree to participate in crowdsensing expect a minimum impact on their battery lifetime and phone usage habits. To address these requirements, this paper proposes an application for measuring the location and signal strength data based on energy-efficient GPS tracking, which allows one to perform the measurements of human mobility and radio signal levels with minimum energy utilization and without any engagement of the user. The method described combines measurements from the accelerometer with effective management of the GPS to monitor the user mobility with the decrease in battery lifetime by approximately 20%. To show the applicability of the proposed platform, the sample results of signal level distribution and coverage maps gathered for an LTE network and representing human mobility are shown.  a1424-822001045nas a2200145   4500000000100000000000100001008004100002260005000043100001900093700002200112700001400134245007000148300001200218520066900230       2015                            d  aSpringer International Publishing Switzerland1 aPawel Foremski1 aKrzysztof Grochla1 aPiotr Gaj00aLTE or WiFi? Client-Side Internet link selection for smartphones.  a43–533 aCurrent mobile phones and tablets are equipped with two technologies for accessing the Internet: WiFi and Cellular. Deciding which of these two interfaces provides faster data transfer is often non-trivial, but most of the currently used devices use a simple priority scheme that prefers WiFi to Cellular. In this paper, we propose a novel system that automatically selects the best link available in the current user location. The system periodically probes the bandwidth available on both links and makes statistical predictions, while avoiding excessive data and battery usage. We experimentally validated our approach using a dedicated application for Android.00899nas a2200133   4500000000100000000000100001008004100002260000800043100002200051700001900073245007700092300001400169520058200183       2015                            d  bACM1 aKrzysztof Grochla1 aPawel Foremski00aDemo: Wireless Link Selection on Smartphone: Throughput vs Battery Drain  a190–1923 aThe method for automatic selection of wireless interface on smart phones is presented. We consider the selection between WiFi and LTE / 3G radios to maximize the throughput of the data transmission and minimize the amount of energy used to scan and measure the throughput of the network. The proposed selection algorithm defines when to measure and how to estimate the network throughput to balance between the accuracy of the selection and the battery drain caused by the measurements. The link speed estimation method optimized for LTE and WiFi networks is also demonstrated.01126nas a2200193   4500000000100000000000100001008004100002260003400043100002000077700001800097700001900115700002000134700002400154700001500178245006300193490000900256520064500265020002200910       2011                            d  bSpringeraBerlin / Heidelberg1 aSławomir Nowak1 aMateusz Nowak1 aPawel Foremski1 aSergey Balandin1 aKoucheryavy Yevgeni1 aHu Honglin00aSmart Spaces and Next Generation Wired/Wireless Networking0 v68693 aWe present a new synchronization method for parallel discrete event simulation for wireless networks. The method merges paradigms of time-stepped and event-driven simulations to achieve reduction of messages exchanged between local processes of simulation. The method is particularly suitable for wireless network simulation, in which objects share the same physical medium and parallel simulation involves a significant overhead for interprocess communication. The article describes the method and compare it to conservative and optimistic synchronization methods, on the basis of results of simulations of selected wireless network model.  a978-3-642-22874-200453nas a2200157   4500000000100000000000100001008004100002260001200043100001900055700002400074700001900098245008900117856006400206300001100270022001400281       2016                            d  c10/20161 aPawel Foremski1 aChristian Callegari1 aMichele Pagano00aWaterfall Traffic Classification: A Quick Approach to Optimizing Cascade Classifiers  uhttps://link.springer.com/article/10.1007/s11277-016-3751-5  a1–16  a0929-621200343nas a2200133   4500000000100000000000100001008004100002260002600043100001900069700001700088700001800105245005500123856003100178       2016                            d  c11/2016aSanta Monica1 aPawel Foremski1 aDavid Plonka1 aArthur Berger00aEntropy/IP: Uncovering Structure in IPv6 Addresses  uhttp://www.entropy-ip.com/01572nas a2200205   4500000000100000000000100001008004100002260002500043100001800068700002000086700001900106700001500125700002200140700002000162700001800182700001600200245007100216856003500287520104400322       2018                            d  bACMaBoston, MA, USA1 aOliver Gasser1 aQuirin Scheitle1 aPawel Foremski1 aQasim Lone1 aMaciej Korczynski1 aStephen Strowes1 aLuuk Hendriks1 aGeorg Carle00aClusters in the Expanse: Understanding and Unbiasing IPv6 Hitlists  uhttps://ipv6hitlist.github.io/3 a<p>Network measurements are an important tool in understanding the Internet. Due to the expanse of the IPv6 address space, exhaustive scans as in IPv4 are not possible for IPv6. In recent years, several studies proposed to use target lists of IPv6 addresses, called hitlists. In this paper, we show that addresses in IPv6 hitlists are heavily clustered. We present novel techniques that allow to push IPv6 hitlists from quantity to quality. We perform a longitudinal active measurement study over 6 months, targeting more than 50 M addresses. We develop a rigorous method to detect aliased prefixes, which identifies 1.5% of our prefixes as aliased, pertaining to about half of our target addresses. Using entropy clustering, we group the entire hitlist into just 6 distinct addressing schemes. Furthermore, we perform client measurements by leveraging crowdsourcing. To encourage reproducibility in network measurement research and serve as a starting point for future IPv6 studies, we publish source code, analysis tools, and data.</p>
01816nas a2200133   4500000000100000000000100001008004100002260002800043100001900071700001800090700001800108245004800126520150800174       2019                            d  c10/2019bACMaAmsterdam1 aPawel Foremski1 aOliver Gasser1 aGiovane Moura00aDNS Observatory: The Big Picture of the DNS3 a<p>The Domain Name System (DNS) is thought of as having the simple-sounding task of resolving domains into IP addresses. With its stub resolvers, different layers of recursive resolvers, authoritative nameservers, a multitude of query types, and DNSSEC, the DNS ecosystem is actually quite complex.</p>

<p>DNS Observatory provides a bird's-eye view and allows to analyze the big picture of DNS. As data source DNS Observatory leverages globally distributed DNS probes acquiring a peak of 200K DNS queries per second between recursive resolvers and authoritative nameservers. For each observed query we extract traffic features, aggregate them, and track the top k DNS objects.</p>

<p>This allows us to characterize DNS deployments and evaluate the median response delays of DNS queries, where we find that the top 10% nameservers (which handle about half the traffic) have indeed a shorter response time than less popular nameservers. We also leverage DNS Observatory to show correlations between decreasing TTLs and increasing DNS traffic. Furthermore, the TTL data allows us to anticipate upcoming changes in the DNS infrastructure. Another aspect that we analyze in depth is the effect of the Happy Eyeballs algorithm in combination with low negative caching TTLs, which results in a share of up to 90% empty responses for some domains. Finally, we propose actionable measures to improve uncovered DNS issues and shortcomings and we offer interested researchers access to DNS Observatory.</p>
01839nas a2200133   4500000000100000000000100001008004100002260004100043100001900084700001800103700001800121245004800139520151800187       2019                            d  c10/2019bACMaAmsterdam, Netherlands1 aPawel Foremski1 aOliver Gasser1 aGiovane Moura00aDNS Observatory: The Big Picture of the DNS3 a<p>The Domain Name System (DNS) is thought of as having the simple-sounding task of resolving domains into IP addresses. With its stub resolvers, different layers of recursive resolvers, authoritative nameservers, a multitude of query types, and DNSSEC, the DNS ecosystem is actually quite complex.<br />
<br />
DNS Observatory provides a bird's-eye view and allows to analyze the big picture of DNS. As data source DNS Observatory leverages globally distributed DNS probes acquiring a peak of 200K DNS queries per second between recursive resolvers and authoritative nameservers. For each observed query we extract traffic features, aggregate them, and track the top k DNS objects.<br />
<br />
This allows us to characterize DNS deployments and evaluate the median response delays of DNS queries, where we find that the top 10% nameservers (which handle about half the traffic) have indeed a shorter response time than less popular nameservers. We also leverage DNS Observatory to show correlations between decreasing TTLs and increasing DNS traffic. Furthermore, the TTL data allows us to anticipate upcoming changes in the DNS infrastructure. Another aspect that we analyze in depth is the effect of the Happy Eyeballs algorithm in combination with low negative caching TTLs, which results in a share of up to 90% empty responses for some domains. Finally, we propose actionable measures to improve uncovered DNS issues and shortcomings and we offer interested researchers access to DNS Observatory.</p>
01468nas a2200157   4500000000100000000000100001008004100002100001900043700002000062700002000082700002500102700002200127245007700149490000700226520107700233       2020                            d1 aPawel Foremski1 aSławomir Nowak1 aPiotr Fröhlich1 aJose Hernandez-Ramos1 aGianmarco Baldini00aAutopolicy: Automated Traffic Policing for Improved IoT Network Security0 v203 a<p>A 2.3Tbps DDoS attack was recently mitigated by Amazon, which is a new record after the 2018 GitHub attack, or the famous 2016 Dyn DNS attack launched from hundreds of thousands of hijacked IoT devices. These attacks may disrupt the lives of billions of people worldwide, as we increasingly rely on the Internet. In this paper, we tackle the problem that hijacked IoT devices are often the origin of these attacks. With the goal of protecting the Internet and local networks, we propose Autopolicy: a system that automatically limits the IP traffic bandwidth - and other network resources - available to IoT devices in a particular network. We make use of the fact that devices such as sensors, cameras, and smart home appliances rarely need their high-speed network interfaces for normal operation. We present a simple yet flexible architecture for Autopolicy, specifying its functional blocks, message sequences, and general operation in a Software Defined Network. We present experimental validation results, and release a prototype open source implementation.</p>
01867nas a2200205   4500000000100000000000100001008004100002260002800043100001900071700002100090700001900111700002000130700002700150700001800177700002900195700001800224700002100242245008900263520130900352       2022                            d  c08/2022bUSENIXaBoston1 aXander Bouwman1 aVictor Le Pochat1 aPawel Foremski1 aTom Van Goethem1 aCarlos Hernandez-Ganan1 aGiovane Moura1 aSamaneh Tajalizadehkhoob1 aWouter Joosen1 aMichel van Eeten00aHelping hands: Measuring the impact of a large threat intelligence sharing community3 aWe tracked the largest volunteer security information sharing community known to date: the COVID-19 Cyber Threat Coalition, with over 4,000 members. This enabled us to address long-standing questions on threat information sharing. First, does collaboration at scale lead to better coverage? And second, does making threat data freely available improve the ability of defenders to act? We found that the CTC mostly aggregated existing industry sources of threat information. User-submitted domains often did not make it to the CTC’s blocklist as a result of the high threshold posed by its automated quality assurance using VirusTotal. Although this ensured a low false positive rate, it also caused the focus of the blocklist to drift away from domains related to COVID-19 (1.4%-3.6%) to more generic abuse, such as phishing, for which established mitigation mechanisms already exist. However, in the slice of data that was related to COVID-19, we found promising evidence of the added value of a community like the CTC: just 25.1% of these domains were known to existing abuse detection infrastructures at time of listing, as compared to 58.4% of domains on the overall blocklist. From the unique experiment that the CTC represented, we draw three lessons for future threat data sharing initiatives.
01398nas a2200145   4500000000100000000000100001000000100002008004100003260004400044100001900088700001800107700001700125245006600142520104400208       2021                            d  c03/2021bAkamai Technologies, Inc.aUSA1 aPawel Foremski1 aArthur Berger1 aDavid Plonka00aInternet address structure analysis, and applications thereof3 aAn analysis system automates IP address structure discovery by deep analysis of sample IPv6 addresses using a set of computational methods, namely, information-theoretic analysis, machine learning, and statistical modeling. The system receives a sample set of IP addresses, computes entropies, discovers and mines address segments, builds a network model of address segment inter-dependencies, and provides a graphical display with various plots and tools to enable a network analyst to navigate and explore the exposed IPv6 address structure. The structural information is then applied as input to applications that include: (a) identifying homogeneous groups of client addresses, e.g., to assist in mapping clients to content in a CDN; (b) supporting network situational awareness efforts, e.g., in cyber defense; (c) selecting candidate targets for active measurements, e.g., traceroutes campaigns, vulnerability assessments, or reachability surveys; and (d) remotely assessing a network's addressing plan and address assignment policy.01677nas a2200157   4500000000100000000000100001008004100002260002800043100001500071700001900086700001800105245006700123856003600190520127500226020001801501       2024                            d  c07/2024bACMaSingapore1 aLars Prehn1 aPawel Foremski1 aOliver Gasser00aKirin: Hitting the Internet with Distributed BGP Announcements  uhttps://kirin-attack.github.io/3 a<p>The Internet is a critical resource in the daily life of billions of users. To support the growing number of users and their increasing demands, operators continuously scale their network footprint–-e.g., by joining Internet Exchange Points (IXPs)–-and adopt relevant technologies–-such as IPv6–-which provides a vastly larger address space than its predecessor.In this paper, we revisit prefix de-aggregation attacks in the light of these two changes and introduce Kirin–-an advanced BGP prefix de-aggregation attack that announces millions of IPv6 routes via thousands of IXP connections to overflow the memory of routers within remote ASes. Kirin's highly distributed nature allows it to bypass traditional route-flooding defense mechanisms, such as per-session prefix limits or route flap damping.We analyze Kirin's theoretical feasibility by formulating it as a mathematical optimization problem, test for practical hurdles by deploying enough infrastructure to perform a micro-scale Kirin attack using 4 IXPs, and validate our assumptions via BGP data analysis, real-world measurements, and router testbed experiments. Despite its low deployment cost, we find that Kirin may inject lethal amounts of routes into the routers of thousands of ASes.</p>
  a9798400704826