<?xml version="1.0" encoding="UTF-8"?>
<xml><records><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">On different ways to classify Internet traffic: a short review of selected publications</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2013</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Theoretical and Applied Informatics</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><VOLUME><style face="normal" font="default" size="100%">25</style></VOLUME><NUMBER><style face="normal" font="default" size="100%">2</style></NUMBER><PAGES><style face="normal" font="default" size="100%">119–136</style></PAGES><ABSTRACT><style face="normal" font="default" size="100%">Traffic classification is an important tool for network management. It reveals the source of observed network traffic and has many potential applications in Quality of Service, network security, traffic visualization, and more. In the last decade, traffic classification evolved quickly due to the raise of peer-to-peer traffic. Nowadays, researchers still find new methods in order to withstand the rapid changes in the Internet. In this paper, we review 13 papers on traffic classification and related topics that were published during 2009-2012. We show diversity in recent algorithms and we highlight possible directions for the future research on traffic classification: relevance of multi-level classification, importance of experimental validation, and the need for common traffic datasets.</style></ABSTRACT><title><style face="normal" font="default" size="100%">On different ways to classify Internet traffic: a short review of selected publications</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Tracedump: A Novel Single Application IP Packet Sniffer</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2012</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Theoretical and Applied Informatics</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><VOLUME><style face="normal" font="default" size="100%">24</style></VOLUME><NUMBER><style face="normal" font="default" size="100%">1</style></NUMBER><ABSTRACT><style face="normal" font="default" size="100%">The article introduces a novel Internet diagnosis utility - an open source IP packet sniffer which captures TCP and UDP packets sent and received by a single Linux process only. Preliminary evaluation results are presented. The utility can be applied in the field of IP traffic classification.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Tracedump: A Novel Single Application IP Packet Sniffer</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>2</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Statistical, real-time classification of IP traffic in Linux operating system</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2011</style></YEAR><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">Politechnika Śląska</style></PUBLISHER><ABSTRACT><style face="normal" font="default" size="100%">The thesis introduces a practical system for statistical classification of IP traffic. Two novel algorithms are applied and extended. They are based on feature vector classification using SVM. A software library written in C language is presented. Resultant system can monitor network interfaces in realtime and read off-line packet trace files. Simultaneous classification, system training, and performance evaluation is possible. The system yields very good results, in terms of quality and packet processing speed, achieving %TP&gt;97 and %FP=0 on average.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Statistical, real-time classification of IP traffic in Linux operating system</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">C. Callegari</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">M. Pagano</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Piotr Gaj</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Waterfall traffic identification: optimizing classification cascades</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2015</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Computer Networks</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">Springer International Publishing Switzerland</style></PUBLISHER><PAGES><style face="normal" font="default" size="100%">1–10</style></PAGES><ABSTRACT><style face="normal" font="default" size="100%">The Internet transports data generated by programs whch cause various phenomena in IP flows. By means of machine learning techniques, we can automatically discern between flows generated by different traffic sources and gain a more informed view of the Internet. In this paper, we optimize Waterfall, a promising architecture for cascade traffic classification. We present a new heuristic approach to optimal design of cascade classifiers. On the example of Waterfall, we show how to determine the order of modules in a cascade so that the classification speed in maximized, while keeping the number of errors and unlabeled flows at minimum. We validate our method experimentally on 4 real traffic datasets, showing significant improvements over random cascades.</style></ABSTRACT><NOTES><style face="normal" font="default" size="100%">22nd International Conference, CN 2015 Brunów, Poland, June 16-19, 2015</style></NOTES><title><style face="normal" font="default" size="100%">Waterfall traffic identification: optimizing classification cascades</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">C. Callegari</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">M. Pagano</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">DNS-Class: Immediate classification of IP flows using DNS</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2014</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">International Journal of Network Management</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><ABSTRACT><style face="normal" font="default" size="100%">Nowadays we see a tremendous growth of the Internet, especially in terms of the amount of data being transmitted and new network protocols being introduced. This poses a challenge for network administrators, who need adequate tools for network management. Recent findings show that DNS can contribute valuable information on IP flows and improve traffic visibility in a computer network. In this paper, we apply these findings on DNS to propose a novel traffic classification algorithm with interesting features. We experimentally show that the information carried in domain names and port numbers is sufficient for immediate classification of a highly significant portion of the traffic. We present DNS-Class: an innovative, fast, and reliable flow-based traffic classification algorithm, which on average yields 99.8% of True Positives and</style></ABSTRACT><URL><style face="normal" font="default" size="100%">https://www.iitis.pl/ pjf/pub/2014-dnsclass-preprint.pdf</style></URL><title><style face="normal" font="default" size="100%">DNS-Class: Immediate classification of IP flows using DNS</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">C. Callegari</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">M. Pagano</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Waterfall: Rapid identification of IP flows using cascade classification</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2014</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Communications in Computer and Information Science</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><ABSTRACT><style face="normal" font="default" size="100%">In the last years network traffic classification has attracted much research effort, given that it represents the foundation of many Internet functionalities such as Quality of Service (QoS) enforcement, monitoring, and security. Nonetheless, the proposed works are not able to satisfactorily solve the problem, usually being suitable for only addressing a given portion of the whole network traffic and thus none of them can be considered an ultimate solution for network classification. In this paper, we address network traffic classification by proposing a new architecture-named Waterfall architecture-that, by combining several classification algorithms together according to a cascade principle, is able to correctly classify the whole mixture of network traffic.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Waterfall: Rapid identification of IP flows using cascade classification</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Michał Gorawski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Krzysztof Grochla</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Source Model of TCP Traffic in LTE Networks</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2014</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Information Sciences and Systems 2014</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><ABSTRACT><style face="normal" font="default" size="100%">We propose a generator that represents traffic transmitted in wireless mobile networks. It is based on the measurements of traffic in large scale LTE networks. The proposed tool generates TCP flow sizes and duration. We verify the proposed generator by comparison with traces available in the literature and propose application in discrete event simulators.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Source Model of TCP Traffic in LTE Networks</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Michał Gorawski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Krzysztof Grochla</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Konrad Połys</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Energy-Efficient Crowdsensing of Human Mobility and Signal Levels in Cellular Networks</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2015</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Sensors</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><VOLUME><style face="normal" font="default" size="100%">15</style></VOLUME><NUMBER><style face="normal" font="default" size="100%">9</style></NUMBER><DATE><style face="normal" font="default" size="100%">9</style></DATE><ABSTRACT><style face="normal" font="default" size="100%">The paper presents a practical application of the crowdsensing idea to measure human mobility and signal coverage in cellular networks. Currently, virtually everyone is carrying a mobile phone, which may be used as a sensor to gather research data by measuring, e.g., human mobility and radio signal levels. However, many users are unwilling to participate in crowdsensing experiments. This work begins with the analysis of the barriers for engaging people in crowdsensing. A survey showed that people who agree to participate in crowdsensing expect a minimum impact on their battery lifetime and phone usage habits. To address these requirements, this paper proposes an application for measuring the location and signal strength data based on energy-efficient GPS tracking, which allows one to perform the measurements of human mobility and radio signal levels with minimum energy utilization and without any engagement of the user. The method described combines measurements from the accelerometer with effective management of the GPS to monitor the user mobility with the decrease in battery lifetime by approximately 20%. To show the applicability of the proposed platform, the sample results of signal level distribution and coverage maps gathered for an LTE network and representing human mobility are shown.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Energy-Efficient Crowdsensing of Human Mobility and Signal Levels in Cellular Networks</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Krzysztof Grochla</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Piotr Gaj</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">LTE or WiFi? Client-Side Internet link selection for smartphones.</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2015</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Computer Networks</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Springer International Publishing Switzerland</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PAGES><style face="normal" font="default" size="100%">43–53</style></PAGES><ABSTRACT><style face="normal" font="default" size="100%">Current mobile phones and tablets are equipped with two technologies for accessing the Internet: WiFi and Cellular. Deciding which of these two interfaces provides faster data transfer is often non-trivial, but most of the currently used devices use a simple priority scheme that prefers WiFi to Cellular. In this paper, we propose a novel system that automatically selects the best link available in the current user location. The system periodically probes the bandwidth available on both links and makes statistical predictions, while avoiding excessive data and battery usage. We experimentally validated our approach using a dedicated application for Android.</style></ABSTRACT><NOTES><style face="normal" font="default" size="100%">22nd International Conference, CN 2015 Brunów, Poland, June 16-19, 2015</style></NOTES><title><style face="normal" font="default" size="100%">LTE or WiFi? Client-Side Internet link selection for smartphones.</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Krzysztof Grochla</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Demo: Wireless Link Selection on Smartphone: Throughput vs Battery Drain</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2015</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">MobiCom '15 Proceedings of the 21st Annual International Conference on Mobile Computing and Networking</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">ACM</style></PUBLISHER><PAGES><style face="normal" font="default" size="100%">190–192</style></PAGES><ABSTRACT><style face="normal" font="default" size="100%">The method for automatic selection of wireless interface on smart phones is presented. We consider the selection between WiFi and LTE / 3G radios to maximize the throughput of the data transmission and minimize the amount of energy used to scan and measure the throughput of the network. The proposed selection algorithm defines when to measure and how to estimate the network throughput to balance between the accuracy of the selection and the battery drain caused by the measurements. The link speed estimation method optimized for LTE and WiFi networks is also demonstrated.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Demo: Wireless Link Selection on Smartphone: Throughput vs Battery Drain</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>7</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Sławomir Nowak</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Mateusz Nowak</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Sergey Balandin</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Koucheryavy Yevgeni</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Hu Honglin</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Smart Spaces and Next Generation Wired/Wireless Networking</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2011</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Lecture Notes in Computer Science</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Berlin / Heidelberg</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">Springer</style></PUBLISHER><VOLUME><style face="normal" font="default" size="100%">6869</style></VOLUME><SECTION><style face="normal" font="default" size="100%">New Synchronization Method for the Parallel Simulations of Wireless Networks</style></SECTION><ISBN><style face="normal" font="default" size="100%">978-3-642-22874-2</style></ISBN><ABSTRACT><style face="normal" font="default" size="100%">We present a new synchronization method for parallel discrete event simulation for wireless networks. The method merges paradigms of time-stepped and event-driven simulations to achieve reduction of messages exchanged between local processes of simulation. The method is particularly suitable for wireless network simulation, in which objects share the same physical medium and parallel simulation involves a significant overhead for interprocess communication. The article describes the method and compare it to conservative and optimistic synchronization methods, on the basis of results of simulations of selected wireless network model.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Smart Spaces and Next Generation Wired/Wireless Networking</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Christian Callegari</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Michele Pagano</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Waterfall Traffic Classification: A Quick Approach to Optimizing Cascade Classifiers</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2016</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Wireless Personal Communications</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PAGES><style face="normal" font="default" size="100%">1–16</style></PAGES><DATE><style face="normal" font="default" size="100%">10/2016</style></DATE><URL><style face="normal" font="default" size="100%">https://link.springer.com/article/10.1007/s11277-016-3751-5</style></URL><title><style face="normal" font="default" size="100%">Waterfall Traffic Classification: A Quick Approach to Optimizing Cascade Classifiers</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">David Plonka</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Arthur Berger</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Entropy/IP: Uncovering Structure in IPv6 Addresses</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2016</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">ACM Internet Measurement Conference 2016</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Santa Monica</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><DATE><style face="normal" font="default" size="100%">11/2016</style></DATE><URL><style face="normal" font="default" size="100%">http://www.entropy-ip.com/</style></URL><title><style face="normal" font="default" size="100%">Entropy/IP: Uncovering Structure in IPv6 Addresses</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Oliver Gasser</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Quirin Scheitle</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Qasim Lone</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Maciej Korczynski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Stephen Strowes</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Luuk Hendriks</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Georg Carle</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Clusters in the Expanse: Understanding and Unbiasing IPv6 Hitlists</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2018</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">ACM Internet Measurement Conference 2018</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Boston, MA, USA</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">ACM</style></PUBLISHER><ABSTRACT><style face="normal" font="default" size="100%">&lt;p&gt;Network measurements are an important tool in understanding the Internet. Due to the expanse of the IPv6 address space, exhaustive scans as in IPv4 are not possible for IPv6. In recent years, several studies proposed to use target lists of IPv6 addresses, called hitlists. In this paper, we show that addresses in IPv6 hitlists are heavily clustered. We present novel techniques that allow to push IPv6 hitlists from quantity to quality. We perform a longitudinal active measurement study over 6 months, targeting more than 50 M addresses. We develop a rigorous method to detect aliased prefixes, which identifies 1.5% of our prefixes as aliased, pertaining to about half of our target addresses. Using entropy clustering, we group the entire hitlist into just 6 distinct addressing schemes. Furthermore, we perform client measurements by leveraging crowdsourcing. To encourage reproducibility in network measurement research and serve as a starting point for future IPv6 studies, we publish source code, analysis tools, and data.&lt;/p&gt;&#13;
</style></ABSTRACT><URL><style face="normal" font="default" size="100%">https://ipv6hitlist.github.io/</style></URL><title><style face="normal" font="default" size="100%">Clusters in the Expanse: Understanding and Unbiasing IPv6 Hitlists</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Oliver Gasser</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Giovane Moura</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">DNS Observatory: The Big Picture of the DNS</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2019</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">ACM Internet Measurement Conference 2019</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Amsterdam</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">ACM</style></PUBLISHER><DATE><style face="normal" font="default" size="100%">10/2019</style></DATE><ABSTRACT><style face="normal" font="default" size="100%">&lt;p&gt;The Domain Name System (DNS) is thought of as having the simple-sounding task of resolving domains into IP addresses. With its stub resolvers, different layers of recursive resolvers, authoritative nameservers, a multitude of query types, and DNSSEC, the DNS ecosystem is actually quite complex.&lt;/p&gt;&#13;
&#13;
&lt;p&gt;DNS Observatory provides a bird's-eye view and allows to analyze the big picture of DNS. As data source DNS Observatory leverages globally distributed DNS probes acquiring a peak of 200K DNS queries per second between recursive resolvers and authoritative nameservers. For each observed query we extract traffic features, aggregate them, and track the top k DNS objects.&lt;/p&gt;&#13;
&#13;
&lt;p&gt;This allows us to characterize DNS deployments and evaluate the median response delays of DNS queries, where we find that the top 10% nameservers (which handle about half the traffic) have indeed a shorter response time than less popular nameservers. We also leverage DNS Observatory to show correlations between decreasing TTLs and increasing DNS traffic. Furthermore, the TTL data allows us to anticipate upcoming changes in the DNS infrastructure. Another aspect that we analyze in depth is the effect of the Happy Eyeballs algorithm in combination with low negative caching TTLs, which results in a share of up to 90% empty responses for some domains. Finally, we propose actionable measures to improve uncovered DNS issues and shortcomings and we offer interested researchers access to DNS Observatory.&lt;/p&gt;&#13;
</style></ABSTRACT><title><style face="normal" font="default" size="100%">DNS Observatory: The Big Picture of the DNS</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Oliver Gasser</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Giovane Moura</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">DNS Observatory: The Big Picture of the DNS</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2019</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">ACM Internet Measurement Conference 2019</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Amsterdam, Netherlands</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">ACM</style></PUBLISHER><DATE><style face="normal" font="default" size="100%">10/2019</style></DATE><ABSTRACT><style face="normal" font="default" size="100%">&lt;p&gt;The Domain Name System (DNS) is thought of as having the simple-sounding task of resolving domains into IP addresses. With its stub resolvers, different layers of recursive resolvers, authoritative nameservers, a multitude of query types, and DNSSEC, the DNS ecosystem is actually quite complex.&lt;br /&gt;&#13;
&lt;br /&gt;&#13;
DNS Observatory provides a bird's-eye view and allows to analyze the big picture of DNS. As data source DNS Observatory leverages globally distributed DNS probes acquiring a peak of 200K DNS queries per second between recursive resolvers and authoritative nameservers. For each observed query we extract traffic features, aggregate them, and track the top k DNS objects.&lt;br /&gt;&#13;
&lt;br /&gt;&#13;
This allows us to characterize DNS deployments and evaluate the median response delays of DNS queries, where we find that the top 10% nameservers (which handle about half the traffic) have indeed a shorter response time than less popular nameservers. We also leverage DNS Observatory to show correlations between decreasing TTLs and increasing DNS traffic. Furthermore, the TTL data allows us to anticipate upcoming changes in the DNS infrastructure. Another aspect that we analyze in depth is the effect of the Happy Eyeballs algorithm in combination with low negative caching TTLs, which results in a share of up to 90% empty responses for some domains. Finally, we propose actionable measures to improve uncovered DNS issues and shortcomings and we offer interested researchers access to DNS Observatory.&lt;/p&gt;&#13;
</style></ABSTRACT><title><style face="normal" font="default" size="100%">DNS Observatory: The Big Picture of the DNS</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>0</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Sławomir Nowak</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Piotr Fröhlich</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Jose Hernandez-Ramos</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Gianmarco Baldini</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Autopolicy: Automated Traffic Policing for Improved IoT Network Security</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2020</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">Sensors</style></SECONDARY_TITLE><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><VOLUME><style face="normal" font="default" size="100%">20</style></VOLUME><SECTION><style face="normal" font="default" size="100%">4265</style></SECTION><ABSTRACT><style face="normal" font="default" size="100%">&lt;p&gt;A 2.3Tbps DDoS attack was recently mitigated by Amazon, which is a new record after the 2018 GitHub attack, or the famous 2016 Dyn DNS attack launched from hundreds of thousands of hijacked IoT devices. These attacks may disrupt the lives of billions of people worldwide, as we increasingly rely on the Internet. In this paper, we tackle the problem that hijacked IoT devices are often the origin of these attacks. With the goal of protecting the Internet and local networks, we propose Autopolicy: a system that automatically limits the IP traffic bandwidth - and other network resources - available to IoT devices in a particular network. We make use of the fact that devices such as sensors, cameras, and smart home appliances rarely need their high-speed network interfaces for normal operation. We present a simple yet flexible architecture for Autopolicy, specifying its functional blocks, message sequences, and general operation in a Software Defined Network. We present experimental validation results, and release a prototype open source implementation.&lt;/p&gt;&#13;
</style></ABSTRACT><title><style face="normal" font="default" size="100%">Autopolicy: Automated Traffic Policing for Improved IoT Network Security</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Xander Bouwman</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Victor Le Pochat</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Tom Van Goethem</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Carlos Hernandez-Ganan</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Giovane Moura</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Samaneh Tajalizadehkhoob</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Wouter Joosen</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Michel van Eeten</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Helping hands: Measuring the impact of a large threat intelligence sharing community</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2022</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">USENIX Security Symposium (USENIX Security '22 Summer)</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Boston</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">USENIX</style></PUBLISHER><DATE><style face="normal" font="default" size="100%">08/2022</style></DATE><ABSTRACT><style face="normal" font="default" size="100%">We tracked the largest volunteer security information sharing community known to date: the COVID-19 Cyber Threat Coalition, with over 4,000 members. This enabled us to address long-standing questions on threat information sharing. First, does collaboration at scale lead to better coverage? And second, does making threat data freely available improve the ability of defenders to act? We found that the CTC mostly aggregated existing industry sources of threat information. User-submitted domains often did not make it to the CTC’s blocklist as a result of the high threshold posed by its automated quality assurance using VirusTotal. Although this ensured a low false positive rate, it also caused the focus of the blocklist to drift away from domains related to COVID-19 (1.4%-3.6%) to more generic abuse, such as phishing, for which established mitigation mechanisms already exist. However, in the slice of data that was related to COVID-19, we found promising evidence of the added value of a community like the CTC: just 25.1% of these domains were known to existing abuse detection infrastructures at time of listing, as compared to 58.4% of domains on the overall blocklist. From the unique experiment that the CTC represented, we draw three lessons for future threat data sharing initiatives.&#13;
</style></ABSTRACT><title><style face="normal" font="default" size="100%">Helping hands: Measuring the impact of a large threat intelligence sharing community</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>15</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Arthur Berger</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">David Plonka</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Internet address structure analysis, and applications thereof</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2021</style></YEAR><PLACE_PUBLISHED><style face="normal" font="default" size="100%">USA</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">Akamai Technologies, Inc.</style></PUBLISHER><NUMBER><style face="normal" font="default" size="100%">15618303</style></NUMBER><SECTION><style face="normal" font="default" size="100%">US10944639B2</style></SECTION><DATE><style face="normal" font="default" size="100%">03/2021</style></DATE><ABSTRACT><style face="normal" font="default" size="100%">An analysis system automates IP address structure discovery by deep analysis of sample IPv6 addresses using a set of computational methods, namely, information-theoretic analysis, machine learning, and statistical modeling. The system receives a sample set of IP addresses, computes entropies, discovers and mines address segments, builds a network model of address segment inter-dependencies, and provides a graphical display with various plots and tools to enable a network analyst to navigate and explore the exposed IPv6 address structure. The structural information is then applied as input to applications that include: (a) identifying homogeneous groups of client addresses, e.g., to assist in mapping clients to content in a CDN; (b) supporting network situational awareness efforts, e.g., in cyber defense; (c) selecting candidate targets for active measurements, e.g., traceroutes campaigns, vulnerability assessments, or reachability surveys; and (d) remotely assessing a network's addressing plan and address assignment policy.</style></ABSTRACT><title><style face="normal" font="default" size="100%">Internet address structure analysis, and applications thereof</style></title></RECORD><RECORD><source-app name="Bibcite" version="8.x">Drupal-Bibcite</source-app><REFERENCE_TYPE>31</REFERENCE_TYPE><CONTRIBUTORS><AUTHORS><AUTHOR><style face="normal" font="default" size="100%">Lars Prehn</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Pawel Foremski</style></AUTHOR><AUTHOR><style face="normal" font="default" size="100%">Oliver Gasser</style></AUTHOR></AUTHORS></CONTRIBUTORS><TITLES><TITLE><style face="normal" font="default" size="100%">Kirin: Hitting the Internet with Distributed BGP Announcements</style></TITLE></TITLES><KEYWORDS/><DATES/><AUTHORS><style face="normal" font="default" size="100%"/></AUTHORS><YEAR><style face="normal" font="default" size="100%">2024</style></YEAR><SECONDARY_TITLE><style face="normal" font="default" size="100%">ACM Asia Conference on Computer and Communications Security (AsiaCCS 2024)</style></SECONDARY_TITLE><PLACE_PUBLISHED><style face="normal" font="default" size="100%">Singapore</style></PLACE_PUBLISHED><LANGUAGE><style face="normal" font="default" size="100%">eng</style></LANGUAGE><PUBLISHER><style face="normal" font="default" size="100%">ACM</style></PUBLISHER><DATE><style face="normal" font="default" size="100%">07/2024</style></DATE><ISBN><style face="normal" font="default" size="100%">9798400704826</style></ISBN><ABSTRACT><style face="normal" font="default" size="100%">&lt;p&gt;The Internet is a critical resource in the daily life of billions of users. To support the growing number of users and their increasing demands, operators continuously scale their network footprint–-e.g., by joining Internet Exchange Points (IXPs)–-and adopt relevant technologies–-such as IPv6–-which provides a vastly larger address space than its predecessor.In this paper, we revisit prefix de-aggregation attacks in the light of these two changes and introduce Kirin–-an advanced BGP prefix de-aggregation attack that announces millions of IPv6 routes via thousands of IXP connections to overflow the memory of routers within remote ASes. Kirin's highly distributed nature allows it to bypass traditional route-flooding defense mechanisms, such as per-session prefix limits or route flap damping.We analyze Kirin's theoretical feasibility by formulating it as a mathematical optimization problem, test for practical hurdles by deploying enough infrastructure to perform a micro-scale Kirin attack using 4 IXPs, and validate our assumptions via BGP data analysis, real-world measurements, and router testbed experiments. Despite its low deployment cost, we find that Kirin may inject lethal amounts of routes into the routers of thousands of ASes.&lt;/p&gt;&#13;
</style></ABSTRACT><URL><style face="normal" font="default" size="100%">https://kirin-attack.github.io/</style></URL><title><style face="normal" font="default" size="100%">Kirin: Hitting the Internet with Distributed BGP Announcements</style></title></RECORD></records></xml>
