Theophilus Benson

Ayyoob Hamza, Hassan Habibi Gharakheili, Theophilus A. Benson et al.

IoT networks are increasingly becoming target of sophisticated new cyber-attacks. Anomaly-based detection methods are promising in finding new attacks, but there are certain practical challenges like false-positive alarms, hard to explain, and difficult to scale cost-effectively. The IETF recent standard called Manufacturer Usage Description (MUD) seems promising to limit the attack surface on IoT devices by formally specifying their intended network behavior. In this paper, we use SDN to enforce and monitor the expected behaviors of each IoT device, and train one-class classifier models to detect volumetric attacks. Our specific contributions are fourfold. (1) We develop a multi-level inferencing model to dynamically detect anomalous patterns in network activity of MUD-compliant traffic flows via SDN telemetry, followed by packet inspection of anomalous flows. This provides enhanced fine-grained visibility into distributed and direct attacks, allowing us to precisely isolate volumetric attacks with microflow (5-tuple) resolution. (2) We collect traffic traces (benign and a variety of volumetric attacks) from network behavior of IoT devices in our lab, generate labeled datasets, and make them available to the public. (3) We prototype a full working system (modules are released as open-source), demonstrates its efficacy in detecting volumetric attacks on several consumer IoT devices with high accuracy while maintaining low false positives, and provides insights into cost and performance of our system. (4) We demonstrate how our models scale in environments with a large number of connected IoTs (with datasets collected from a network of IP cameras in our university campus) by considering various training strategies (per device unit versus per device type), and balancing the accuracy of prediction against the cost of models in terms of size and training time.

Usama Naseer, Theophilus Benson

The web serving protocol stack is constantly changing and evolving to tackle technological shifts in networking infrastructure and website complexity. As a result of this evolution, the web serving stack includes a plethora of protocols and configuration parameters that enable the web serving stack to address a variety of realistic network conditions. Yet, today, most content providers have adopted a "one-size-fits-all" approach to configuring the networking stack of their user facing web servers (or at best employ moderate tuning), despite the significant diversity in end-user networks and devices. In this paper, we revisit this problem and ask a more fundamental question: Are there benefits to tuning the network stack? If so, what system design choices and algorithmic ensembles are required to enable modern content provider to dynamically and flexibly tune their protocol stacks. We demonstrate through substantial empirical evidence that this "one-size-fits-all" approach results in sub-optimal performance and argue for a novel framework that extends existing CDN architectures to provide programmatic control over the configuration options of the CDN serving stack. We designed ConfigTron a data-driven framework that leverages data from all connections to identify their network characteristics and learn the optimal configuration parameters to improve end-user performance. ConfigTron uses contextual multi-arm bandit-based learning algorithm to find optimal configurations in minimal time, enabling a content providers to systematically explore heterogeneous configurations while improving end-user page load time by as much as 19% (upto 750ms) on median.

Christopher Streiffer, Huan Chen, Theophilus Benson et al.

In recent years, many techniques have been developed to improve the performance and efficiency of data center networks. While these techniques provide high accuracy, they are often designed using heuristics that leverage domain-specific properties of the workload or hardware. In this vision paper, we argue that many data center networking techniques, e.g., routing, topology augmentation, energy savings, with diverse goals actually share design and architectural similarity. We present a design for developing general intermediate representations of network topologies using deep learning that is amenable to solving classes of data center problems. We develop a framework, DeepConfig, that simplifies the processing of configuring and training deep learning agents that use the intermediate representation to learns different tasks. To illustrate the strength of our approach, we configured, implemented, and evaluated a DeepConfig-Agent that tackles the data center topology augmentation problem. Our initial results are promising --- DeepConfig performs comparably to the optimal.