researResearch - Télécom Bretagne

h Research
9
RESEARCH
Main achievements of the project
Metrology of Traffic for the Security
and Performance of Networks
For his PhD thesis, Pedro Casas is jointly
supervised by Telecom Bretagne and the
university of the Republic in Montevidéo, Uruguay
(ARTES group). Differents aspects related to
network monitoring are studied in this thesis.
Work related to the traffic matrix is continuing, in
collaboration with the Technology University of
Compiègne (UTC). A parsimonious linear model of
the matrix has been proposed which allows
resolving the fundamental problem of nonobservability.
Once the model was introduced,
numerous theoretical issues have been addressed
and algorithms, whose theoretical properties are
known, have been used to estimate the traffic
matrix, to follow traffic variations, or to detect
anomalies in the traffic matrix. We worked
particularly on the detection and localisation of
anomalies in the traffic matrix, with sequential
and non-sequential approaches. We showed the
excellent performance of this approach compared
to other approaches described in the literature.
Pedro Casas also addressed perceived QoS
issues. The aim of these studies is to
automatically qualify the perceived QoS for a video
data stream, looking solely at network and/or
multimedia related parameters (encoding format,
loss, delay, jitter…). This is done thanks to a
random neural network, whose inputs are the
network and multimedia parameters and whose
output is the perceived quality of service mark.
The neural network is calibrated during a learning
phase; once calibrated the network automatically
supplies perceived quality of service indicators. A
software tool box has been developed and been
made freely available to the scientific community.
Together with Christian Callegari from Pisa
University (TLCNETGROUP) we have worked on
Network Intrusion Detection Systems (NIDS). This
NIDS is developed for anomaly detection, that is
to say it detects unusual deviations in certain
traffic descriptors. We observe the chain of flags
(ACK, SYN, URG, PSH, RST, FIN) corresponding to
each TCP connection and any “unusual behavior”
is detected. Various statistical models have been
proposed and compared. The method has first
been validated on a set of DARPA data, which is
generally used as reference for testing IDS
performance. As the 1999 DARPA set is now
outdated, we set up a means of collecting traffic
from laboratories that corresponds to current
usage and recent attacks. The proposed NIDS was
tested on both sets of data and gave good results.
Overlay and autonomous networks
Three PhD students, Bing Han, Yiping Chen and
Yaning Liu, and a post doc, Jimmy Leblet, have
worked in 2008 on the topic of autonomous
spontaneous networks. The application field for
these studies is the diffusion of video images on
the Internet. As this topic was new for us, we had
to assess the characteristics (advantages and
drawbacks) of a totally decentralized and
autonomous systems. The interactions in this
team led us to approach the problems in a kind of
combined optimisation and operational research
manner.
The start point is that video is now sent as
multiple independent streams, containing little
information, which must then be re-combined to
reconstruct the whole video. So we tried to use
this concept in peer to peer networks; notably we
tried to reconcile (i) a kind of organisation allowing
each peer to specialise in the transmission of a
certain type of stream and (ii) the structure-less
logic of peer to peer networks, a popular
approach in which the topography of the network
is not pre-arranged, but rather emerges from the
action of algorithms which are largely based on
random processes. Our approach allowed to
model the problem as a problem linked to
domination in planar graphs. This idea allowed us
to present papers and aroused the interest of
researchers both at EPFL and Linköping
University. We hope to take advantage of these
contacts in 2009 and organize some exchanges or
visits.
The other major study that we undertook in 2008
is finalizing Bing Han’ PhD on capacity sharing in
sensor networks. We identified the theoretical
95