6883771
A firewalling scheme for securing MPOA-based enterprise networks
A well-known security problem with MPOA is that cut-through connections generally bypass firewall routers if there are any. None of the previously proposed approaches solved the problem properly. We propose a novel firewalling scheme for MPOA that nicely fixes the security hole. Our firewalling scheme has three outstanding advantages that make it ideal for securing MPOA-based enterprise networks. First, based on our novel concept of logical chokepoints, our firewalling scheme does not require the existence of physical chokepoints inside the network. Second, the scheme is nicely embedded into the MPOA protocol so that its cost, performance overhead, and protocol complexity are reduced to a minimum. Third, the scheme is centrally administrated so that it scales well to very large networks.
42254231
A novel cache architecture to support layer-four packet classification at memory access speeds
Existing and emerging layer-4 switching technologies require packet classification to be performed on more than one header field, known as layer-4 lookup. Currently, the fastest general layer-8 lookup scheme delivers a throughput of 1 million lookups per second (MLPS), far off from 25/75 MLPS needed to support 50/150 Gbps layer-4 router. We propose the use of route caching to speed up layer-4 lookup, and design and implement a cache architecture for this purpose. We investigated the locality behavior of the Interent traffic (at layer-4) and propose a near-LRU algorithm that can best harness this behavior. In implementation, to best approximate fully-associative near-LRU using relatively inexpensive set-associative hardware, we invented a dynamic set-associative scheme that exploits the nice properties of N-universal hash functions. The cache architecture achieves a high and stable hit ratio above 90 percent and a fast throughput up to 75 MLPS at a reasonable cost.
26863394
A Firewalling Scheme for Securing MPOA-Based Enterprise Networks
A well-known security problem with MPOA is that cut-through connections generally bypasses firewall routers if there are any. None of the previously proposed approaches solved the problem properly. In this paper, we propose a novel firewalling scheme for MPOA that nicely fixes the security hole. Our firewalling scheme has three outstanding advantages that make it ideal for securing MPOA-based enterprise networks. First, based on our novel concept of "logical chokepoints", our firewalling scheme does not require the existence of physical chokepoints inside the network. Second, the scheme is nicely embedded into the MPOA protocol so that its cost, performance overhead, and protocol complexity are reduced to a minimum. Third, the scheme is centrally administered so that it scales well to very large networks.
11752783
Design of a high-performance ATM firewall
A router-based packet-filtering firewall is an effective way of protecting an enterprise network from unauthorized access. However, it will not work efficiently in an ATM network because it requires the termination of end-to-end ATM connections at a packet-filtering router, which incurs huge overhead of SAR (Segmentation and Reassembly). Very few approaches to this problem have been proposed in the literature, and none is completely satisfactory. In this paper we present the hardware design of a high-speed ATM firewall that does not require the termination of an end-to-end connection in the middle. We propose a novel firewall design philosophy, called Quality of Firewalling (QoF), that applies security measures of different strength to traffic with different risk levels and show how it can be implemented in our firewall. Compared with the traditional firewalls, this ATM firewall performs exactly the same packet-level filtering without compromising the performance and has the same “look and feel” by sitting at the chokepoint between the trusted ATM LAN and untrusted ATM WAN. It is also easy to manage and flexible to use.
16148439
Solving the brachytherapy seed localization problem using geometric and linear programming techniques
We propose a technique to solve the Brachytherapy Seed Localization problem in prostate brachytherapy. Our algorithm is based on novel geometric approaches to exploit the special structure of the problem combined with a number of key observations which help us formulate it as an Integer Program. We solve the equivalent linear program and present a variant of randomized rounding to yield an integral solution to our problem. The algorithm is efficient and performs extremely well in practice. We discuss in detail the underlying theory and performance evaluations based on our implementation.
7849638
Edge-fault-tolerant edge-bipancyclicity of hypercubes
In this paper, we consider the problem embedding a cycle into the hypercube Q"n with existence of faulty edges and show that for any edge subset F of Q"n with |F|==4 and all edges in F are not incident with the same vertex. This result improves some known results.
16907782
Large-scale IP traceback in high-speed Internet: practical techniques and theoretical foundation
Tracing attack packets to their sources, known as IP traceback, is an important step to counter distributed denial-of-service (DDoS) attacks. In this paper, we propose a novel packet logging based (i.e., hash-based) traceback scheme that requires an order of magnitude smaller processing and storage cost than the hash-based scheme proposed by Snoeren, et al. (2001), thereby being able to scalable to much higher link speed (e.g., OC-768). The baseline idea of our approach is to sample and log a small percentage (e.g., 3.3%) of packets. The challenge of this low sampling rate is that much more sophisticated techniques need to be used for traceback. Our solution is to construct the attack tree using the correlation between the attack packets sampled by neighboring routers. The scheme using naive independent random sampling does not perform well due to the low correlation between the packets sampled by neighboring routers. We invent a sampling scheme that improves this correlation and the overall efficiency significantly. Another major contribution of this work is that we introduce a novel information-theoretic framework for our traceback scheme to answer important questions on system parameter tuning and the fundamental trade-off between the resource used for traceback and the traceback accuracy. Simulation results based on real-world network topologies (e.g. Skitter) match very well with results from the information-theoretic analysis. The simulation results also demonstrate that our traceback scheme can achieve high accuracy, and scale very well to a large number of attackers (e.g., 5000+).
757091
Efficient Job Scheduling Algorithms with Multi-type Contentions
In this paper, we consider an interesting generalization of the classic job scheduling problem in which each job needs to compete for not only machines but also other types of resources The contentions among jobs for machines and resources could interfere with each other, which complicates the problem dramatically We present a family of approximation algorithms for solving several variants of the problem by using a generic algorithmic framework Our algorithms achieve a constant approximation ratio (i.e., 3) if there is only one type of resources or certain dependency relation exists among multiple types of resources For the case that r unrelated resources are given, the approximation ratio of our algorithm becomes k + 2, where k ≤ r is a constant depending on the problem instance As an application, we also show that our techniques can be easily applied to optical burst switching (OBS) networks for deriving more efficient wavelength scheduling algorithms.
5323377
Visualizing the expertise space
Expertise management systems are being widely adopted in organizations to manage tacit knowledge embedded in employees' heads. These systems have successfully applied many information technologies developed in fields such as information retrieval and document management to support expertise information collection, processing, and distribution. In this paper, we investigate the potentials of applying visualization techniques to support exploration of an expertise space. We implemented two widely applied dimensionality reduction visualization techniques, the self-organizing map and multidimensional scaling; to generate expert map and expertise field map visualizations based on an expertise data set. Our proposed approach is generic for automatic mapping of expertise space of an organization, research field, scientific domain, etc. Our initial analysis on the visualization results indicated that the expert map and expertise field map captured useful underlying structures of the expertise space and had the potential to support more efficient and effective expertise information searching and browsing.