Thomas F. La Porta

As cyber-attacks on networks become stealthier, monitoring techniques relying on low-rate packet sampling may prove insufficient to detect attacks. While various methods, such as truncating packets, flow-based sampling, and adaptive sampling rates, have been proposed to enhance detection rates and ease capability limitations, it remains challenging to perform sufficient sampling at line speed and high rates at a single sampling point due to limited CPU or bandwidth capacity and fluctuating network traffic. To address these challenges, we propose CoordSamp, a system that distributes the sampling workload across multiple sampling points and coordinates their actions to avoid duplicate sampling of the same packet. This design enables scalable, resource-aware monitoring—particularly suited for dynamic, agentless cloud-based environments—relying solely on network-level deployment that can be dynamically assigned and adjusted by the provider. We develop a coordinated sampling algorithm on multiple P4-programmable switches and show that the algorithm ensures coordination among multiple sampling points for each flow, preventing duplicate samples, with negligible network overhead and real-time configurability. At its core, CoordSamp separates offline placement—the budgeted selection of sampling points—from online allocation—the capacity-aware assignment of sampling tasks—allowing practical deployment in hybrid networks that combine programmable and legacy switches. We formulate sampling point placement as budgeted maximum multi-coverage problems, solving them optimally in pseudo-polynomial time. Our system far outperforms those based on greedy placement along many key dimensions.

HoneyIoT is a high-interaction Internet of Things honeypot that leverages reinforcement learning to adaptively engage and deceive attackers. We demonstrate its superior performance over existing approaches, identify recent trends in attacker evolution, and point out directions for future research.

Edge computing has become a very popular service that enables mobile devices to run complex tasks with the help of network-based computing resources. However, edge clouds are often resource-constrained, which makes resource allocation a challenging issue. In addition, edge cloud servers must make allocation decisions with only limited information available, since the arrival of future client tasks might be impossible to predict, and the states and behavior of neighboring servers might be obscured. We focus on a distributed resource allocation method in which servers operate independently and do not communicate with each other, but interact with clients (tasks) to make allocation decisions. We follow a two-round bidding approach to assign tasks to edge cloud servers, and servers are allowed to preempt previous tasks to allocate more useful ones. We evaluate the performance of our system using realistic simulations and real-world trace data from a high-performance computing cluster. Results show that our heuristic improves system-wide performance by 20-25% over previous work when accounting for the time taken by each approach. In this way, an ideal trade-off between performance and speed is achieved.

Massive Machine-Type Communications (mMTC) are one of the three main use cases powered by 5G and beyond networks. These are distinguished by the need to serve a large number of devices which are characterized by non-intensive traffic and low energy consumption. While the sporadic nature of the mMTC traffic does not pose an exertion on the efficient operation of the network, multiplexing the traffic from a large number of these devices within the cell certainly does. This traffic from the Base Station (BS) is then transported further towards the Core Network (CN), where it is combined with the traffic from other BSs. Therefore, planning carefully the network resources, both on the Radio Access Network (RAN) and the CN, for this type of traffic is of paramount importance. To do this, the statistics of the traffic pattern that arrives at the BS and the CN should be known. To this end, in this paper, we derive first the distribution of the inter-arrival times of the traffic at the BS from a general number of mMTC users within the cell, assuming a generic distribution of the traffic pattern by individual users. Then, using the previous result we derive the distribution of the traffic pattern at the CN. Further, we validate our results on traces for channel conditions and by performing measurements in our testbed. Results show that adding more mMTC users in the cell and more BSs in the network in the long term does not increase the variability of the traffic pattern at the BS and at the CN. Furthermore, this arrival process at all points of our interest in the network is shown to be Poisson both for homogeneous and heterogeneous traffic. However, the empirical observations show that a huge number of packets is needed for this process to converge, and this number of packets increases with the number of users and/or BSs.

Cloud file systems offer organizations a scalable and reliable file storage solution. However, cloud file systems have become prime targets for adversaries, and traditional designs are not equipped to protect organizations against the myriad of attacks that may be initiated by a malicious cloud provider, co-tenant, or end-client. Recently proposed designs leveraging cryptographic techniques and trusted execution environments (TEEs) still force organizations to make undesirable trade-offs, consequently leading to either security, functional, or performance limitations. In this paper, we introduce BFS , a cloud file system that leverages the security capabilities provided by TEEs to bootstrap new security protocols that deliver strong security guarantees, high-performance, and a transparent POSIX-like interface to clients. BFS delivers stronger security guarantees and up to a $2.5\times$ speedup over a state-of-the-art secure file system. Moreover, compared to the industry standard NFS, BFS achieves up to $2.2\times$ speedups across micro-benchmarks and incurs $\lt 1\times$ overhead for most macro-benchmark workloads. BFS demonstrates a holistic cloud file system design that does not sacrifice an organizations' security yet can embrace all of the functional and performance advantages of outsourcing.

Load balancing in software-defined networks (SDNs) is commonly realized with a centralized architecture. Dynamic load balancing relies on the SDN controller to periodically collect traffic statistics from network switches and make decisions in a timely manner. In this paper, we examine the extent to which an adversary that has compromised a switch can influence the load balancing algorithm by misreporting its own traffic statistics. We design an attack that allows an adversary to perform preliminary reconnaissance, which means learning network traffic distributions and setting attack parameters, and then accurately model and estimate the reward from misreporting while evading detection. Our evaluation offers three insights: 1) network traffic exhibits discernible patterns by reconnaissance; 2) the reconnaissance can be used to design misreporting attacks that can effectively draw unfair proportions of network traffic to the adversary under the guise of honest behavior; and 3) reconnaissance itself can be accelerated by misreporting to launch more targeted attacks.