Characterization of Network-Wide Anomalies in Traffic Flows

Detecting and understanding anomalies in IP networks is an open and ill-defined problem. Toward this end, we have recently proposed the subspace method for anomaly diagnosis. In this paper we present the first large-scale exploration of the power of the subspace method when applied to flow traffic. An important aspect of this approach is that it fuses information from flow measurements taken throughout a network. We apply the subspace method to three different types of sampled flow traffic in a large academic network: multivariate timeseries of byte counts, packet counts, and IP-flow counts. We show that each traffic type brings into focus a different set of anomalies via the subspace method. We illustrate and classify the set of anomalies detected. We find that almost all of the anomalies detected represent events of interest to network operators. Furthermore, the anomalies span a remarkably wide spectrum of event types, including denial of service attacks (single-source and distributed), flash crowds, port scanning, downstream traffic engineering, high-rate flows, worm propagation, and network outage.

Using Speculation to Reduce Server Load and Service Time on the WWW

Speculative service implies that a client's request for a document is serviced by sending, in addition to the document requested, a number of other documents (or pointers thereto) that the server speculates will be requested by the client in the near future. This speculation is based on statistical information that the server maintains for each document it serves. The notion of speculative service is analogous to prefetching, which is used to improve cache performance in distributed/parallel shared memory systems, with the exception that servers (not clients) control when and what to prefetch. Using trace simulations based on the logs of our departmental HTTP server http://cs-www.bu.edu, we show that both server load and service time could be reduced considerably, if speculative service is used. This is above and beyond what is currently achievable using client-side caching [3] and server-side dissemination [2]. We identify a number of parameters that could be used to fine-tune the level of speculation performed by the server.

Deanonymizing Users of the SafeWeb Anonymizing Service

The SafeWeb anonymizing system has been lauded by the press and loved by its users; self-described as "the most widely used online privacy service in the world," it served over 3,000,000 page views per day at its peak. SafeWeb was designed to defeat content blocking by firewalls and to defeat Web server attempts to identify users, all without degrading Web site behavior or requiring users to install specialized software. In this article we describe how these fundamentally incompatible requirements were realized in SafeWeb's architecture, resulting in spectacular failure modes under simple JavaScript attacks. These exploits allow adversaries to turn SafeWeb into a weapon against its users, inflicting more damage on them than would have been possible if they had never relied on SafeWeb technology. By bringing these problems to light, we hope to remind readers of the chasm that continues to separate popular and technical notions of security.

Service Provisioning in Mobile Networks Through Distributed Coordinated Resource Management

The pervasiveness of personal computing platforms offers an unprecedented opportunity to deploy large-scale services that are distributed over wide physical spaces. Two major challenges face the deployment of such services: the often resource-limited nature of these platforms, and the necessity of preserving the autonomy of the owner of these devices. These challenges preclude using centralized control and preclude considering services that are subject to performance guarantees. To that end, this thesis advances a number of new distributed resource management techniques that are shown to be effective in such settings, focusing on two application domains: distributed Field Monitoring Applications (FMAs), and Message Delivery Applications (MDAs). In the context of FMA, this thesis presents two techniques that are well-suited to the fairly limited storage and power resources of autonomously mobile sensor nodes. The first technique relies on amorphous placement of sensory data through the use of novel storage management and sample diffusion techniques. The second approach relies on an information-theoretic framework to optimize local resource management decisions. Both approaches are proactive in that they aim to provide nodes with a view of the monitored field that reflects the characteristics of queries over that field, enabling them to handle more queries locally, and thus reduce communication overheads. Then, this thesis recognizes node mobility as a resource to be leveraged, and in that respect proposes novel mobility coordination techniques for FMAs and MDAs. Assuming that node mobility is governed by a spatio-temporal schedule featuring some slack, this thesis presents novel algorithms of various computational complexities to orchestrate the use of this slack to improve the performance of supported applications. The findings in this thesis, which are supported by analysis and extensive simulations, highlight the importance of two general design principles for distributed systems. First, a-priori knowledge (e.g., about the target phenomena of FMAs and/or the workload of either FMAs or DMAs) could be used effectively for local resource management. Second, judicious leverage and coordination of node mobility could lead to significant performance gains for distributed applications deployed over resource-impoverished infrastructures.

Differentiated Predictive Fair Service for TCP Flows

The majority of the traffic (bytes) flowing over the Internet today have been attributed to the Transmission Control Protocol (TCP). This strong presence of TCP has recently spurred further investigations into its congestion avoidance mechanism and its effect on the performance of short and long data transfers. At the same time, the rising interest in enhancing Internet services while keeping the implementation cost low has led to several service-differentiation proposals. In such service-differentiation architectures, much of the complexity is placed only in access routers, which classify and mark packets from different flows. Core routers can then allocate enough resources to each class of packets so as to satisfy delivery requirements, such as predictable (consistent) and fair service. In this paper, we investigate the interaction among short and long TCP flows, and how TCP service can be improved by employing a low-cost service-differentiation scheme. Through control-theoretic arguments and extensive simulations, we show the utility of isolating TCP flows into two classes based on their lifetime/size, namely one class of short flows and another of long flows. With such class-based isolation, short and long TCP flows have separate service queues at routers. This protects each class of flows from the other as they possess different characteristics, such as burstiness of arrivals/departures and congestion/sending window dynamics. We show the benefits of isolation, in terms of better predictability and fairness, over traditional shared queueing systems with both tail-drop and Random-Early-Drop (RED) packet dropping policies. The proposed class-based isolation of TCP flows has several advantages: (1) the implementation cost is low since it only requires core routers to maintain per-class (rather than per-flow) state; (2) it promises to be an effective traffic engineering tool for improved predictability and fairness for both short and long TCP flows; and (3) stringent delay requirements of short interactive transfers can be met by increasing the amount of resources allocated to the class of short flows.

Distributed Placement of Service Facilities in Large-Scale Networks

The effectiveness of service provisioning in largescale networks is highly dependent on the number and location of service facilities deployed at various hosts. The classical, centralized approach to determining the latter would amount to formulating and solving the uncapacitated k-median (UKM) problem (if the requested number of facilities is fixed), or the uncapacitated facility location (UFL) problem (if the number of facilities is also to be optimized). Clearly, such centralized approaches require knowledge of global topological and demand information, and thus do not scale and are not practical for large networks. The key question posed and answered in this paper is the following: "How can we determine in a distributed and scalable manner the number and location of service facilities?" We propose an innovative approach in which topology and demand information is limited to neighborhoods, or balls of small radius around selected facilities, whereas demand information is captured implicitly for the remaining (remote) clients outside these neighborhoods, by mapping them to clients on the edge of the neighborhood; the ball radius regulates the trade-off between scalability and performance. We develop a scalable, distributed approach that answers our key question through an iterative reoptimization of the location and the number of facilities within such balls. We show that even for small values of the radius (1 or 2), our distributed approach achieves performance under various synthetic and real Internet topologies that is comparable to that of optimal, centralized approaches requiring full topology and demand information.

NETEMBED: A Network Resource Mapping Service for Distributed Applications

Emerging configurable infrastructures such as large-scale overlays and grids, distributed testbeds, and sensor networks comprise diverse sets of available computing resources (e.g., CPU and OS capabilities and memory constraints) and network conditions (e.g., link delay, bandwidth, loss rate, and jitter) whose characteristics are both complex and time-varying. At the same time, distributed applications to be deployed on these infrastructures exhibit increasingly complex constraints and requirements on resources they wish to utilize. Examples include selecting nodes and links to schedule an overlay multicast file transfer across the Grid, or embedding a network experiment with specific resource constraints in a distributed testbed such as PlanetLab. Thus, a common problem facing the efficient deployment of distributed applications on these infrastructures is that of "mapping" application-level requirements onto the network in such a manner that the requirements of the application are realized, assuming that the underlying characteristics of the network are known. We refer to this problem as the network embedding problem. In this paper, we propose a new approach to tackle this combinatorially-hard problem. Thanks to a number of heuristics, our approach greatly improves performance and scalability over previously existing techniques. It does so by pruning large portions of the search space without overlooking any valid embedding. We present a construction that allows a compact representation of candidate embeddings, which is maintained by carefully controlling the order via which candidate mappings are inserted and invalid mappings are removed. We present an implementation of our proposed technique, which we call NETEMBED – a service that identify feasible mappings of a virtual network configuration (the query network) to an existing real infrastructure or testbed (the hosting network). We present results of extensive performance evaluation experiments of NETEMBED using several combinations of real and synthetic network topologies. Our results show that our NETEMBED service is quite effective in identifying one (or all) possible embeddings for quite sizable queries and hosting networks – much larger than what any of the existing techniques or services are able to handle.

The role of the community service order and the suspended sentence in Ireland: a judicial perspective

Imprisonment is the most severe penalty utilised by the criminal courts in Ireland. In recent decades the prison population has grown significantly despite expressions both official and public to reduce the use of the sanction. Two other sanctions are available to the Irish sentencer which may be used as a direct and comparable sentence in lieu of a term of imprisonment namely, the community service order and the suspended sentence. The community service order remains under-utilised as an alternative to the custodial sentence. The suspended sentence is used quite liberally but its function may be more closely related to the aim of deterrence rather than avoiding the use of the custodial sentence. Thus the aim of decarceration may not be optimal in practice when either sanction is utilised. The decarcerative effect of either sanction is largely dependent upon the specific purpose which judges invest in the sanction. Judges may also be inhibited in the use of either sanction if they lack confidence that the sentence will be appropriately monitored and executed. The purpose of this thesis is to examine the role of the community service order and the suspended sentence in Irish sentencing practice. Although community service and the suspended sentence present primarily as alternatives to the custodial sentence, the manner in which the judges utilise or fail to utilise the sanctions may differ significantly from this primary manifestation. Therefore the study proceeds to examine the judges' cognitions and expectations of both sanctions to explore their underlying purposes and to reveal the manner in which the judges use the sanctions in practice. To access this previously undisclosed information a number of methodologies were deployed. An extensive literature review was conducted to delineate the purpose and functionality of both sanctions. Quantitative data was gathered by way of sampling for the suspended sentence and the part-suspended sentence where deficiencies were apparent to show the actual frequency in use of that sanction. Qualitative methodologies were used by way of focus groups and semi-structured interviews of judges at all jurisdictional levels to elucidate the purposes of both sanctions. These methods allowed a deeper investigation of the factors which may promote or inhibit such usage. The relative under-utilisation of the community service order as an alternative to the custodial sentence may in part be explained by a reluctance by some judges to equate it with a real custodial sentence. For most judges who use the sanction, particularly at summary level, community service serves a decarcerative function. The suspended sentence continues to be used extensively. It operates partly as a decarcerative penalty but the purpose of deterrence may in practice overtake its theoretical purpose namely the avoidance of custody. Despite ongoing criticism of executive agencies such as the Probation Service and the Prosecution in the supervision of such penalties both sanctions continue to be used. Engagement between the Criminal Justice actors may facilitate better outcomes in the use of either sanction. The purposes for which both sanctions are deployed find their meaning essentially in the practices of the judges themselves as opposed to any statutory or theoretical claims upon their use or purpose.

A literary occupation: responses of German writers in service in occupied Europe

This thesis examines the literary output of German servicemen writers writing from the occupied territories of Europe in the period 1940-1944. Whereas literary-biographical studies and appraisals of the more significant individual writers have been written, and also a collective assessment of the Eastern front writers, this thesis addresses in addition the German literary responses in France and Greece, as being then theatres of particular cultural/ideological attention. Original papers of the writer Felix Hartlaub were consulted by the author at the Deutsches Literatur Archiv (DLA) at Marbach. Original imprints of the wartime works of the subject writers are referred to throughout, and citations are from these. As all the published works were written under conditions of wartime censorship and, even where unpublished, for fear of discovery written in oblique terms, the texts were here examined for subliminal authorial intention. The critical focus of the thesis is on literary quality: on aesthetic niveau, on applied literary form, and on integrity of authorial intention. The thesis sought to discover: (1) the extent of the literary output in book-length forms. (2) the auspices and conditions under which this literary output was produced. (3) the publication history and critical reception of the output. The thesis took into account, inter alia: (1) occupation policy as it pertained locally to the writers’ remit; (2) the ethical implications of this for the writers; (3) the writers’ literary stratagems for negotiating the constraints of censorship.

A dual-band antenna enabling improved quality of service in multi-radio wireless sensor applications in indoor environments

Science Foundation Ireland (CSET - Centre for Science, Engineering and Technology, Grant No. 07/CE/11147)

Sectoral impacts on the diversity of carabid beetles (Coleoptera: Carabidae) and their associated ecosystem service of biocontrol

This thesis aimed to provide an understanding of how human-induced changes in the economic sectors of agriculture and transport affect carabid diversity, potential carabidmediated biocontrol and predator-pest interactions. The research involved both observational and manipulative laboratory and field-based studies. Observational research consisted of two large-scale investigations of (1) the impact of Miscanthus and oilseed rape production (n=45) and (2) the impact of horticultural and ecological based landscaping of roadside verges (n=64). This research is the first record of carabid diversity, potential biocontrol and community assemblage with respect to bioenergy crop production and roadside landscaping in an Irish context and it is also an important addition to the limited knowledge of carabid populations in these ecosystems internationally. Manipulative work involved the examination of the role predator identity, diversity and biomass play in the suppression of pollen beetle larvae (an economically damaging insect pest of oilseed rape in Europe), using a novel experimental design called ‘simplex’. To complement this research, an additional field study on the impact of low and high oilseed rape pesticide management on carabid species richness and abundance, and crop yield, was also conducted. This research is a great contribution to the existing understanding of what constitutes the important components of predator biodiversity and expands the knowledge of the usefulness of carabid predators in the context of pollen beetle larvae control. In particular, the work shows that the abundance or biomass of beetles has an effect that is far larger than the effect of diversity on the capacity of beetles to consume prey. In turn, the field study showed that pesticide applications had little impact on yield, or carabid richness, but that carabid abundance/biomass declined drastically. The work provides compelling evidence that management practices erode the useful components of biodiversity that are essential for the delivery of biocontrol services.

Can population-level variation in early childhood development be measured in a manner that supports service planning and intervention?

Background: The Early Development Instrument (EDI) is a population-level measure of five developmental domains at school-entry age. The overall aim of this thesis was to explore the potential of the EDI as an indicator of early development in Ireland. Methods: A cross-sectional study was conducted in 47 primary schools in 2011 using the EDI and a linked parental questionnaire. EDI (teacher completed) scores were calculated for 1,344 children in their first year of full-time education. Those scoring in the lowest 10% of the sample population in one or more domains were deemed to be 'developmentally vulnerable'. Scores were correlated with contextual data from the parental questionnaire and with indicators of area and school-level deprivation. Rasch analysis was used to determine the validity of the EDI. Results: Over one quarter (27.5%) of all children in the study were developmentally vulnerable. Individual characteristics associated with increased risk of vulnerability were being male; under 5 years old; and having English as a second language. Adjusted for these demographics, low birth weight, poor parent/child interaction and mother’s lower level of education showed the most significant odds ratios for developmental vulnerability. Vulnerability did not follow the area-level deprivation gradient as measured by a composite index of material deprivation. Children considered by the teacher to be in need of assessment also had lower scores, which were not significantly different from those of children with a clinical diagnosis of special needs. all domains showed at least reasonable fit to the Rasch model supporting the validity of the instrument. However, there was a need for further refinement of the instrument in the Irish context. Conclusion: This thesis provides a unique snapshot of early development in Ireland. The EDI and linked parental questionnaires are promising indicators of the extent, distribution and determinants of developmental vulnerability.

Designing and evaluating an interactive assessment instrument to improve the process for mobile service application innovation

Published Version

Can prospect theory explain risk-seeking behavior by terminally ill patients?

Patients with life-threatening conditions sometimes appear to make risky treatment decisions as their condition declines, contradicting the risk-averse behavior predicted by expected utility theory. Prospect theory accommodates such decisions by describing how individuals evaluate outcomes relative to a reference point and how they exhibit risk-seeking behavior over losses relative to that point. The authors show that a patient's reference point for his or her health is a key factor in determining which treatment option the patient selects, and they examine under what circumstances the more risky option is selected. The authors argue that patients' reference points may take time to adjust following a change in diagnosis, with implications for predicting under what circumstances a patient may select experimental or conventional therapies or select no treatment.

Can metaphors and analogies improve communication with seriously ill patients?

OBJECTIVE: It is not known how often physicians use metaphors and analogies, or whether they improve patients' perceptions of their physicians' ability to communicate effectively. Therefore, the objective of this study was to determine whether the use of metaphors and analogies in difficult conversations is associated with better patient ratings of their physicians' communication skills. DESIGN: Cross-sectional observational study of audio-recorded conversations between patients and physicians. SETTING: Three outpatient oncology practices. PATIENTS: Ninety-four patients with advanced cancer and 52 physicians. INTERVENTION: None. MAIN OUTCOME MEASURES: Conversations were reviewed and coded for the presence of metaphors and analogies. Patients also completed a 6-item rating of their physician's ability to communicate. RESULTS: In a sample of 101 conversations, coders identified 193 metaphors and 75 analogies. Metaphors appeared in approximately twice as many conversations as analogies did (65/101, 64% versus 31/101, 31%; sign test p < 0.001). Conversations also contained more metaphors than analogies (mean 1.6, range 0-11 versus mean 0.6, range 0-5; sign rank test p < 0.001). Physicians who used more metaphors elicited better patient ratings of communication (rho = 0.27; p = 0.006), as did physicians who used more analogies (Spearman rho = 0.34; p < 0.001). CONCLUSIONS: The use of metaphors and analogies may enhance physicians' ability to communicate.