@conference {18692,
	title = {The Deployment of a Darknet on an Organization-Wide Network: An Empirical Analysis},
	year = {2008},
	month = {2008/12//},
	pages = {59 - 68},
	abstract = {Darknet sensors have the interesting property of collecting only suspicious traffic, including misconfiguration, backscatter and malicious traffic. The type of traffic collected highly depends on two parameters: the size and the location of the darknet sensor. The goals of this paper are to study empirically the relationship between these two parameters and to try to increase the volume of attackers detected by a given darknet sensor. Our empirical results reveal that on average, on a daily basis, 485 distinct external source IP addresses perform a TCP scan on one of the two /16 networks of our organizationpsilas network. Moreover, a given darknet sensor of 77 IP addresses deployed in the same /16 network collects on average attack traffic from 26\% of these attackers.},
	keywords = {attack traffic, backscatter, darknet sensors, external source IP address, malicious traffic, organization network, organization-wide network, TCP scan, telecommunication congestion control, transmission control protocol, Transport protocols},
	doi = {10.1109/HASE.2008.54},
	author = {Berthier,R. and Michel Cukier}
}
@conference {15466,
	title = {ASPIRE: automated systematic protocol implementation robustness evaluation},
	booktitle = {Software Engineering Conference, 2004. Proceedings. 2004 Australian},
	year = {2004},
	month = {2004///},
	pages = {241 - 250},
	abstract = {Network protocol implementations are susceptible to problems caused by their lack of ability to handle invalid inputs. We present ASPIRE: automated systematic protocol implementation robustness evaluation, an automated approach to pro-actively test protocol implementations by observing their responses to faulty protocol data units (PDUs) or messages. In contrast to existing approaches, we sample the faulty PDU space in a systematic manner, thus allowing us to evaluate protocol implementations in the face of a wider variety of faulty PDUs. We use a pruning strategy to reduce, from exponential, the size of the faulty PDU set to polynomial in the number of fields of a PDU. We have implemented the ASPIRE algorithms and evaluated them on implementations of HTTP (Apache, Google Web Server (GWS), and Microsoft IIS) and SMTP (Sendmail and Microsoft Exchange) protocols. Our results show that Apache, GWS, and IIS, although implementing the same protocol specification, behave differently on faulty HTTP PDUs; Sendmail and exchange are different in handling our faulty SMTP PDUs.},
	keywords = {algorithm, ASPIRE, automated systematic protocol, automated testing, fault tolerant computing, faulty PDU, formal specification, HTTP, implementation robustness evaluation, Internet, network protocol, protocol data unit, protocol specification, robustness testing, SMTP protocol, stateful protocols, stateless protocols, Transport protocols},
	doi = {10.1109/ASWEC.2004.1290477},
	author = {Vasan,Arunchandar and Memon, Atif M.}
}
@conference {17575,
	title = {Clustering and server selection using passive monitoring},
	booktitle = {IEEE INFOCOM 2002. Twenty-First Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {3},
	year = {2002},
	month = {2002///},
	pages = {1717- 1725 vol.3 - 1717- 1725 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We consider the problem of client assignment in a distributed system of content servers. We present a system called Webmapper for clustering IP addresses and assigning each cluster to an optimal content server. The system is passive in that the only information it uses comes from monitoring the TCP connections between the clients and the servers. It is also flexible in that it makes no a priori assumptions about network topology and server placement and it can react quickly to changing network conditions. We present experimental results to evaluate the performance of Webmapper.},
	keywords = {client assignment, client-server systems, clustering, content servers, Delay, distributed system, Educational institutions, Internet, IP addresses, Monitoring, network conditions, Network servers, Network topology, optimal content server, passive monitoring, server selection, Space technology, TCPIP, Transport protocols, Web pages, Web server, Webmapper},
	isbn = {0-7803-7476-2},
	doi = {10.1109/INFCOM.2002.1019425},
	author = {Andrews,M. and Shepherd,B. and Srinivasan, Aravind and Winkler,P. and Zane,F.}
}
@conference {18690,
	title = {Quantifying the cost of providing intrusion tolerance in group communication systems},
	year = {2002},
	month = {2002///},
	pages = {229 - 238},
	abstract = {Group communication systems that provide consistent group membership and reliable, ordered multicast properties in the presence of faults resulting from malicious intrusions have not been analyzed extensively to quantify the cost of tolerating these intrusions. This paper attempts to quantify this cost by presenting results from an experimental evaluation of three new intrusion-tolerant microprotocols that have been added to an existing crash-fault-tolerant group communication system. The results are analyzed to identify the parts that contribute the most overhead during provision of intrusion tolerance at the group communication system level.},
	keywords = {consistent group membership, crash-fault-tolerant group communication system, cryptography, finite state machines, groupware, intrusion-tolerant microprotocols, malicious intrusions, multicast communication, reliable ordered multicast properties, security of data, Transport protocols},
	doi = {10.1109/DSN.2002.1028904},
	author = {Ramasamy,H. V. and Pandey,P. and Lyons,J. and Michel Cukier and Sanders,W. H.}
}
@conference {14725,
	title = {Practical programmable packets},
	booktitle = {IEEE INFOCOM 2001. Twentieth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {1},
	year = {2001},
	month = {2001///},
	pages = {41-50 vol.1 - 41-50 vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present SNAP (safe and nimble active packets), a new scheme for programmable (or active) packets centered around a new low-level packet language. Unlike previous active packet approaches, SNAP is practical: namely, adding significant flexibility over IP without compromising safety and security or efficiency. In this paper we show how to compile from the well-known active picket language PLAN to SNAP, showing that SNAP retains PLAN{\textquoteright}s flexibility; give proof sketches of its novel approach to resource control; and present experimental data showing SNAP attains performance very close to that of a software IP router},
	keywords = {active picket language, Application software, complier, Contracts, Data security, efficiency, Explosives, INFORMATION SCIENCE, Internet, IP, IP networks, low-level packet language, packet switching, performance, PLAN, practical programmable packets, program compilers, Protection, resource control, Resource management, safe and nimble active packets, Safety, Security, SNAP, software IP router, Software performance, telecommunication security, Transport protocols},
	isbn = {0-7803-7016-3},
	doi = {10.1109/INFCOM.2001.916685},
	author = {Moore,J. T and Hicks, Michael W. and Nettles,S.}
}
@conference {17532,
	title = {Receiver based management of low bandwidth access links},
	booktitle = {IEEE INFOCOM 2000. Nineteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {1},
	year = {2000},
	month = {2000///},
	pages = {245-254 vol.1 - 245-254 vol.1},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {In this paper, we describe a receiver-based congestion control policy that leverages TCP flow control mechanisms to prioritize mixed traffic loads across access links. We manage queueing at the access link to: (1) improve the response time of interactive network applications; (2) reduce congestion-related packet losses; while (3) maintaining high throughput for bulk-transfer applications. Our policy controls queue length by manipulating receive socket buffer sizes. We have implemented this solution in a dynamically loadable Linux kernel module, and tested it over low-bandwidth links. Our approach yields a 7-fold improvement in packet latency over an unmodified system while maintaining 94\% link utilization. In the common case, congestion-related packet losses at the access link can be eliminated. Finally, by prioritizing short flows, we show that our system reduces the time to download a complex Web page during a large background transfer by a factor of two},
	keywords = {Bandwidth, buffer storage, bulk-transfer applications, complex Web page, congestion control policy, Delay, dynamically loadable Linux kernel module, information resources, interactive network, Internet, Kernel, link utilization, Linux, low-bandwidth access links, mixed traffic load, packet latency, queue length, queueing theory, receive socket buffer sizes, receiver-based management, response time, short flow prioritizing, Size control, Sockets, subscriber loops, TCP flow control, telecommunication congestion control, telecommunication network management, Telecommunication traffic, Testing, Throughput, Transport protocols, Unix, Web pages},
	isbn = {0-7803-5880-5},
	doi = {10.1109/INFCOM.2000.832194},
	author = {Spring, Neil and Chesire,M. and Berryman,M. and Sahasranaman,V. and Anderson,T. and Bershad,B.}
}
@conference {14723,
	title = {PLANet: an active internetwork},
	booktitle = {IEEE INFOCOM {\textquoteright}99. Eighteenth Annual Joint Conference of the IEEE Computer and Communications Societies. Proceedings},
	volume = {3},
	year = {1999},
	month = {1999/03/21/25},
	pages = {1124-1133 vol.3 - 1124-1133 vol.3},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {We present PLANet: an active network architecture and implementation. In addition to a standard suite of Internet-like services, PLANet has two key programmability features: (1) all packets contain programs; and (2) router functionality may be extended dynamically. Packet programs are written in our special purpose programming language PLAN, the Packet Language for Active Networks, while dynamic router extensions are written in OCaml, a dialect of ML. Currently, PLANet routers run as byte-code-interpreted Linux user-space applications, and support Ethernet and IP as link layers. PLANet achieves respectable performance on standard networking operations: on 300 MHz Pentium-II{\textquoteright}s attached to 100 Mbps Ethernet, PLANet can route 48 Mbps and switch over 5000 packets per second. We demonstrate the utility of PLANet{\textquoteright}s activeness by showing experimentally how it can nontrivially improve application and aggregate network performance in congested conditions},
	keywords = {100 Mbit/s, 300 MHz, 48 Mbit/s, active internetwork, active network architecture, active network implementation, byte-code-interpreted applications, Computer architecture, Computer languages, Computer networks, congested conditions, dynamic programming, dynamic router extensions, Ethernet, Ethernet networks, INFORMATION SCIENCE, Internet, Internet-like services, internetworking, IP, IP networks, link layers, Linux user-space applications, Local area networks, ML dialect, Network performance, networking operations, OCaml, Packet Language for Active Networks, packet programs, packet switching, Pentium-II, performance, performance evaluation, PLAN, PLANet, Planets, programmability features, programming languages, router functionality, special purpose programming language, Switches, telecommunication network routing, Transport protocols, Web and internet services},
	isbn = {0-7803-5417-6},
	doi = {10.1109/INFCOM.1999.751668},
	author = {Hicks, Michael W. and Moore,J. T and Alexander,D. S and Gunter,C. A and Nettles,S. M}
}
@conference {14762,
	title = {Benchmarking a network of PCs running parallel applications},
	booktitle = {Performance, Computing and Communications, 1998. IPCCC {\textquoteright}98., IEEE International},
	year = {1998},
	month = {1998/02/16/18},
	pages = {1 - 7},
	publisher = {IEEE},
	organization = {IEEE},
	abstract = {Presents a benchmarking study that compares the performance of a network of four PCs connected by a 100 Mbit/s fast Ethernet running three different system software configurations: TCP/IP on Windows NT, TCP/IP on Linux and a lightweight message-passing protocol (U-Net active messages) on Linux. For each configuration, we report results for communication micro-benchmarks and the NAS (Numerical Aerodynamics Simulation) parallel benchmarks. For the NAS benchmarks, the overall running time using Linux TCP/IP was 12-500\% less than the Windows NT TCP/IP configuration. Likewise, the Linux U-Net based message-passing protocol outperformed the Linux TCP/IP version by 5-200\%+. We also show that, by using Linux U-Net, we are able to achieve 125 μs latency between two processes using PVM. Finally, we report that the default mathematical libraries supplied with NT (for both gcc and Visual C++) are substantially slower than the one supplied with Linux},
	keywords = {100 Mbit/s, 125 mus, Aerodynamics, Application software, communication micro-benchmarks, default mathematical libraries, Delay, Ethernet, Ethernet networks, gcc, latency, lightweight message-passing protocol, Linux, Local area networks, mathematics computing, Message passing, microcomputer applications, Microsoft Windows NT, NAS parallel benchmarks, network operating systems, Numerical simulation, parallel applications, PARALLEL PROCESSING, PC network benchmarking, performance comparison, performance evaluation, Personal communication networks, Protocols, PVM, running time, software libraries, System software, system software configurations, TCP/IP, TCPIP, Transport protocols, U-Net active messages, Visual C++},
	isbn = {0-7803-4468-5},
	doi = {10.1109/PCCC.1998.659876},
	author = {Hollingsworth, Jeffrey K and Guven, E. and Akinlar, C.}
}
