Research

Traffic Characterization and Modeling

Traffic modeling has an increasing importance in the management and dimensioning of telecommunications networks. The complexity associated with the generation and traffic control mechanisms, as well as the diversity of applications and services, introduced a set of peculiar traffic characteristics, such as self-similarity, long range dependence and multifractality. These characteristics have a strong impact on the network performance and, therefore, need to be properly modeled. Paulo Salvador proposed a set of traffic models, which are able to describe these peculiar behaviors, and that can be classified in two classes: Markovian models and models based on Lindenmayer systems. In both cases, models for traffic with fixed and variable packet size were proposed.

Markovian Models

Paulo Salvador proposed two Markovian models and the respective parameter inference procedures. The first model is a Markov modulated Poisson process in discrete time (dMMPP) which characterizes the packet arrivals. It is obtained by superposing a memoryless dMMPP with an arbitrary number of states (M-dMMPP) and a set of dMMPPs with two states (2-dMMPPs). In order to infer the parameters, the 2-dMMPPs are used to fit the empirical autocovariance function and the M-dMPPP is used to fit the empirical probability mass function considering the restrictions imposed by the 2-dMMPPs. The number of states of the process can be adjusted according to the traffic characteristics. The second model is a batch Markovian arrival process in discrete time (dBMAP). It extends the first model by allowing the modeling of the packet size. In this process the packet arrivals occur according to a dMMPP and the packet sizes have a general distribution which depends on the phase of the subjacent dMMPP. The inference procedure of the first model is used to infer the parameters of the subjacent dMMPP.

Lindenmayer systems (L-Systems) models

Paulo Salvador proposed traffic models based on Lindenmayer systems (L-Systems) and the respective parameter inference procedures. L-Systems were introduced in 1968 by A. Lindenmayer as a method to model plant growth. Starting from an initial symbol, an L-System generates iteratively progressively longer sequences of symbols, by successive application of production rules. In order to define traffic models based on L-Systems, the symbols are interpreted as arrival rates or mean packet sizes and each iteration is associated with a time scale of the traffic. The proposed models included one to characterize the packet arrivals and three other to characterize simultaneously the packet arrivals and the packet sizes with different levels of detail. These models are able to capture the multiscaling and multifractal characteristics of the traffic.

User Behavior Characterization

Paulo Salvador participated in a proposal for reliable and efficient classification of Internet users, based on their traffic profile. The proposal addressed the classification of Internet users, presenting, discussing and comparing two different approaches for solving this problem: Discriminant Analysis and artificial Neural Networks.

Traffic Measurements

Measurement Architectures and Platforms

The ever growing complexity of modern data networks requires versatile and scalable network monitoring architectures. Paulo Salvador proposed a network monitoring system with a peer-to-peer (P2P) architecture, allowing for high tolerance to failures and distributed storage of measured data. The main features of the architecture, namely the system elements and its hierarchical organization, the protocols for handshaking, promoting and demotion of system elements, and distributing control information, the algorithm for system startup, addition of new elements and failure recovery, and the procedures for storing, replicating, searching and downloading measurement data. The proposed architecture has shown to be flexible in adapting to various network conditions and available resources.

Detection and Identification of Internet Applications

An accurate mapping of traffic to their applications can be very important for a broad range of network management and measurement tasks including traffic engineering, service differentiation, performance/failure monitoring, and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. Paulo Salvador proposed a new approach, based on neural networks, that is able to identify flow patterns generated by several Internet applications while overcoming the limitations of existing approaches. The results obtained show that, when conveniently trained, neural networks constitute a valuable tool to identify Internet applications.

Internet Security

Anomaly Detection Based on Traffic Profiles

The detection of compromised hosts is currently performed at the network and host levels but any one of these options presents important security flaws: at the host level, antivirus, anti-spyware and personal firewalls are ineffective in the detection of hosts that are compromised via new or target-specific malicious software while at the network level network firewalls and Intrusion Detection Systems were developed to protect the network from external attacks but they were not designed to detect and protect against vulnerabilities that are already present inside the local area network. Paulo Salvador presented a new approach for the identification of illicit traffic that tries to overcome some of the limitations of existing approaches, while being computationally efficient and easy to deploy. The approach is based on neural networks and is able to detect illicit traffic based on the historical traffic profiles presented by "licit" and "illicit" network applications.

Content Distribution

Peer-to-peer (P2P) networks have grown as a file sharing platform for digital contents and become the main platform for media content distribution. Currently, these systems are evolving towards a valuable and efficient platform for IPTV and VoD services. Paulo Salvador has an on-going definition and implementation of a P2P multimedia streaming platform.