Daniel Sadoc Menasché

Asaf Cohen, Dennis Goeckel, Omer Gurewitz et al.

Consider a communication network with a source, a relay and a destination. Each time interval, the source may dynamically choose between a few possible coding schemes, based on the channel state, traffic pattern and its own queue status. For example, the source may choose between a direct route to the destination and a relay-assisted scheme. Clearly, due to the difference in the performance achieved, as well as the resources each scheme uses, a sender might wish to choose the most appropriate one based on its status. In this work, we formulate the problem as a Semi-Markov Decision Process. This formulation allows us to find an optimal policy, expressed as a function of the number of packets in the source queue and other parameters. In particular, we show a general solution which covers various configurations, including different packet size distributions and varying channels. Furthermore, for the case of exponential transmission times, we analytically prove the optimal policy has a threshold structure, that is, there is a unique value of a single parameter which determines which scheme (or route) is optimal. Results are also validated with simulations for several interesting models.

Felipe Moreno-Vera, Mateus Nogueira, Cainã Figueiredo et al.

This paper proposes a machine learning-based approach for detecting the exploitation of vulnerabilities in the wild by monitoring underground hacking forums. The increasing volume of posts discussing exploitation in the wild calls for an automatic approach to process threads and posts that will eventually trigger alarms depending on their content. To illustrate the proposed system, we use the CrimeBB dataset, which contains data scraped from multiple underground forums, and develop a supervised machine learning model that can filter threads citing CVEs and label them as Proof-of-Concept, Weaponization, or Exploitation. Leveraging random forests, we indicate that accuracy, precision and recall above 0.99 are attainable for the classification task. Additionally, we provide insights into the difference in nature between weaponization and exploitation, e.g., interpreting the output of a decision tree, and analyze the profits and other aspects related to the hacking communities. Overall, our work sheds insight into the exploitation of vulnerabilities in the wild and can be used to provide additional ground truth to models such as EPSS and Expected Exploitability.

Yu-Zhen Janice Chen, Daniel S. Menasché, Don Towsley

Effective resource allocation in sensor networks, IoT systems, and distributed computing is essential for applications such as environmental monitoring, surveillance, and smart infrastructure. Sensors or agents must optimize their resource allocation to maximize the accuracy of parameter estimation. In this work, we consider a group of sensors or agents, each sampling from a different variable of a multivariate Gaussian distribution and having a different estimation objective. We formulate a sensor or agent's data collection and collaboration policy design problem as a Fisher information maximization (or Cramer-Rao bound minimization) problem. This formulation captures a novel trade-off in energy use, between locally collecting univariate samples and collaborating to produce multivariate samples. When knowledge of the correlation between variables is available, we analytically identify two cases: (1) where the optimal data collection policy entails investing resources to transfer information for collaborative sampling, and (2) where knowledge of the correlation between samples cannot enhance estimation efficiency. When knowledge of certain correlations is unavailable, but collaboration remains potentially beneficial, we propose novel approaches that apply multi-armed bandit algorithms to learn the optimal data collection and collaboration policy in our sequential distributed parameter estimation problem. We illustrate the effectiveness of the proposed algorithms, DOUBLE-F, DOUBLE-Z, UCB-F, UCB-Z, through simulation.

Eduarda de Souza Marques, Arthur Sobrinho Ferreira da Rocha, Joao Paixao et al.

Geometry-grounded learning asks models to respect structure in the problem domain rather than treating observations as arbitrary vectors. Motivated by this view, we revisit a classical but underused primitive for comparing datasets: linear relations between two data matrices, expressed via the co-span constraint $Ax = By = z$ in a shared ambient space. To operationalize this comparison, we use the generalized singular value decomposition (GSVD) as a joint coordinate system for two subspaces. In particular, we exploit the GSVD form $A = HCU$, $B = HSV$ with $C^{\top}C + S^{\top}S = I$, which separates shared versus dataset-specific directions through the diagonal structure of $(C, S)$. From these factors we derive an interpretable *angle score* $θ(z) \in [0, π/2]$ for a sample $z$, quantifying whether z is explained relatively more by $A$, more by $B$, or comparably by both. The primary role of $θ(z)$ is as a *per-sample geometric diagnostic*. We illustrate the behavior of the score on MNIST through angle distributions and representative GSVD directions. A binary classifier derived from $θ(z)$ is presented as an illustrative application of the score as an interpretable diagnostic tool.

Pedro Henrique de Paula França, Lucas Lopes Felipe, Daniel Sadoc Menasché

We propose image segmentation as a visual diagnostic testbed for coalition formation in hedonic games. Modeling pixels as agents on a graph, we study how a granularization parameter shapes equilibrium fragmentation and boundary structure. On the Weizmann single-object benchmark, we relate multi-coalition equilibria to binary protocols by measuring whether the converged coalitions overlap with a foreground ground-truth. We observe transitions from cohesive to fragmented yet recoverable equilibria, and finally to intrinsic failure under excessive fragmentation. Our core contribution links multi-agent systems with image segmentation by quantifying the impact of mechanism design parameters on equilibrium structures.

S. R. Eshwar, Lucas Lopes Felipe, Alexandre Reiffers-Masson et al.

Load balancing and auto scaling are at the core of scalable, contemporary systems, addressing dynamic resource allocation and service rate adjustments in response to workload changes. This paper introduces a novel model and algorithms for tuning load balancers coupled with auto scalers, considering bursty traffic arriving at finite queues. We begin by presenting the problem as a weakly coupled Markov Decision Processes (MDP), solvable via a linear program (LP). However, as the number of control variables of such LP grows combinatorially, we introduce a more tractable relaxed LP formulation, and extend it to tackle the problem of online parameter learning and policy optimization using a two-timescale algorithm based on the LP Lagrangian.

Jefferson E. Simoes, Eduardo Ferreira, Daniel S. Menasche et al.

Cryptocurrencies typically aim at preserving the privacy of their users. Different cryptocurrencies preserve privacy at various levels, some of them requiring users to rely on strategies to raise the privacy level to their needs. Among those strategies, we focus on two of them: merge avoidance and mixing services. Such strategies may be adopted on top of virtually any blockchain-based cryptocurrency. In this paper, we show that whereas optimal merge avoidance leads to an NP-hard optimization problem, incentive-compatible mixing services are subject to a certain class of impossibility results. Together, our results contribute to the body of work on fundamental limits of privacy mechanisms in blockchain-based cryptocurrencies.

Felipe Ribas Coutinho, Victor Pires, Claudio Miceli et al.

Blockchains and cryptocurrencies disrupted the conversion of energy into a medium of exchange. Numerous applications for blockchains and cryptocurrencies are now envisioned for purposes ranging from inventory control to banking applications. Naturally, in order to mine in an economically viable way, regions where energy is plentiful and cheap, e.g., close to hydroelectric plants, are sought. The possibility of converting energy into cash, however, also opens up opportunities for a new kind of cyber attack aimed at illegally mining cryptocurrencies by stealing energy. In this work, we indicate, using data from January and February of 2018 from our university, that such a threat is real, and present a projection of the gains derived from these attacks.

Vilc Rufino, Mateus Nogueira, Alberto Avritzer et al.

Anomaly detection systems aim to detect and report attacks or unexpected behavior in networked systems. Previous work has shown that anomalies have an impact on system performance, and that performance signatures can be effectively used for implementing an IDS. In this paper, we present an analytical and an experimental study on the trade-off between anomaly detection based on performance signatures and system scalability. The proposed approach combines analytical modeling and load testing to find optimal configurations for the signature-based IDS. We apply a heavy-tail bi-modal modeling approach, where "long" jobs represent large resource consuming transactions, e.g., generated by DDoS attacks; the model was parametrized using results obtained from controlled experiments. For performance purposes, mean response time is the key metric to be minimized, whereas for security purposes, response time variance and classification accuracy must be taken into account. The key insights from our analysis are: (i) there is an optimal number of servers which minimizes the response time variance, (ii) the sweet-spot number of servers that minimizes response time variance and maximizes classification accuracy is typically smaller than or equal to the one that minimizes mean response time. Therefore, for security purposes, it may be worth slightly sacrificing performance to increase classification accuracy.

Savvas Kastanakis, Pavlos Sermpezis, Vasileios Kotronis et al.

Joint caching and recommendation has been recently proposed as a new paradigm for increasing the efficiency of mobile edge caching. Early findings demonstrate significant gains for the network performance. However, previous works evaluated the proposed schemes exclusively on simulation environments. Hence, it still remains uncertain whether the claimed benefits would change in real settings. In this paper, we propose a methodology that enables to evaluate joint network and recommendation schemes in real content services by only using publicly available information. We apply our methodology to the YouTube service, and conduct extensive measurements to investigate the potential performance gains. Our results show that significant gains can be achieved in practice; e.g., 8 to 10 times increase in the cache hit ratio from cache-aware recommendations. Finally, we build an experimental testbed and conduct experiments with real users; we make available our code and datasets to facilitate further research. To our best knowledge, this is the first realistic evaluation (over a real service, with real measurements and user experiments) of the joint caching and recommendations paradigm. Our findings provide experimental evidence for the feasibility and benefits of this paradigm, validate assumptions of previous works, and provide insights that can drive future research.

Charles F. Gonçalves, Daniel S. Menasché, Alberto Avritzer et al.

The complexity and ubiquity of modern computing systems is a fertile ground for anomalies, including security and privacy breaches. In this paper, we propose a new methodology that addresses the practical challenges to implement anomaly detection approaches. Specifically, it is challenging to define normal behavior comprehensively and to acquire data on anomalies in diverse cloud environments. To tackle those challenges, we focus on anomaly detection approaches based on system performance signatures. In particular, performance signatures have the potential of detecting zero-day attacks, as those approaches are based on detecting performance deviations and do not require detailed knowledge of attack history. The proposed methodology leverages an analytical performance model and experimentation and allows to control the rate of false positives in a principled manner. The methodology is evaluated using the TPCx-V workload, which was profiled during a set of executions using resource exhaustion anomalies that emulate the effects of anomalies affecting system performance. The proposed approach was able to successfully detect the anomalies, with a low number of false positives (precision 90%-98%).

Ananda Streit, Gustavo H. A. Santos, Rosa Leão et al.

The problem of detecting anomalies in time series from network measurements has been widely studied and is a topic of fundamental importance. Many anomaly detection methods are based on packet inspection collected at the network core routers, with consequent disadvantages in terms of computational cost and privacy. We propose an alternative method in which packet header inspection is not needed. The method is based on the extraction of a normal subspace obtained by the tensor decomposition technique considering the correlation between different metrics. We propose a new approach for online tensor decomposition where changes in the normal subspace can be tracked efficiently. Another advantage of our proposal is the interpretability of the obtained models. The flexibility of the method is illustrated by applying it to two distinct examples, both using actual data collected on residential routers.

Pavlos Sermpezis, Savvas Kastanakis, João Ismael Pinheiro et al.

In this paper we propose that recommendation systems (RSs) for multimedia services should be "QoS-aware", i.e., take into account the expected QoS with which a content can be delivered, to increase the user satisfaction. Network-aware recommendations have been very recently proposed as a promising solution to improve network performance. However, the idea of QoS-aware RSs has been studied from the network perspective. Its feasibility and performance performance advantages for the content-provider or user perspective have only been speculated. Hence, in this paper we aim to provide initial answers for the feasibility of the concept of QoS-aware RS, by investigating its impact on real user experience. To this end, we conduct experiments with real users on a testbed, and present initial experimental results. Our analysis demonstrates the potential of the idea: QoS-aware RSs could be beneficial for both the users (better experience) and content providers (higher user engagement). Moreover, based on the collected dataset, we build statistical models to (i) predict the user experience as a function of QoS, relevance of recommendations (QoR) and user interest, and (ii) provide useful insights for the design of QoS-aware RSs. We believe that our study is an important first step towards QoS-aware recommendations, by providing experimental evidence for their feasibility and benefits, and can help open a future research direction.