Unwanted

Traffic

in

Networks

The

presence

of

unwanted

-LRB-

or

background

-RRB-

traffic

in

the

Internet

is

a

well-known

fact

In

principle

any

network

that

has

been

engineered

without

taking

its

presence

into

account

might

experience

troubles

during

periods

of

massive

exposure

to

unwanted

traffic

e.g.

during

large-scale

infections

A

concrete

example

was

provided

by

the

spreading

of

Code-Red-II

in

which

caused

several

routers

crashes

worldwide

Similar

events

might

take

place

in

networks

as

well

with

further

potential

complications

arising

from

their

high

functional

complexity

and

the

scarcity

of

radio

resources

For

example

under

certain

hypothetical

network

configuration

settings

unwanted

traffic

and

specifically

scanning

traffic

from

infected

Mobile

Stations

can

cause

large-scale

wastage

of

logical

resources

and

in

extreme

cases

even

starvation

Unwanted

traffic

is

present

nowdays

also

in

GPRS/UMTS

mainly

due

to

the

widespread

use

of

connect

cards

for

laptops

We

urge

the

research

community

and

network

operators

to

consider

the

issue

of

robustness

to

unwanted

traffic

as

a

prominent

research

area

Categories

and

Subject

Descriptors

C.

-LSB-

Network

Operations

-RSB-

Public

networks

Network

monitoring

General

Terms

Security

Reliability

Measurement

Public

wide-area

wireless

networks

are

now

migrating

to

third-generation

systems

-LRB-

-RRB-

designed

to

support

packet-switched

data

services

and

Internet

access

Several

UMTS

networks

became

operational

since

while

early

GPRS

deployments

date

back

to

Since

then

the

growing

popularity

of

terminals

and

services

has

extended

the

coverage

of

Internet

wireless

access

to

the

geographic

area

and

networks

are

becoming

key

components

of

the

global

Internet

In

a

recent

CCR

contribution

Keshav

-LSB-

-RSB-

foresees

that

cell

phones

will

become

the

dominant

component

of

future

Internet

population

while

Kleinrock

expects

this

role

to

be

played

by

small

pervasive

devices

ubiquitously

embedded

in

the

physical

world

-LRB-

quoted

from

-LSB-

p.

-RSB-

-RRB-

Both

scenarios

underlay

that

the

main

access

mode

in

the

future

Internet

will

be

wide-area

wireless

Currently

deployed

networks

along

with

their

future

evolutions

are

in

pole-position

face

to

concurrent

technologies

-LRB-

e.g.

WIMAX

-RRB-

to

provide

such

access

connectivity

in

the

large-scale

Generally

speaking

the

network

being

essentially

a

mixture

of

two

paradigms

namely

mobile

cellular

and

IP

it

is

exposed

to

the

security

and

reliability

issues

affecting

each

component

plus

the

new

risks

emerging

from

their

combination

The

environment

inherits

from

the

cellular

paradigm

a

number

of

features

like

terminal

personalization

and

geolocalization

that

make

privacy

and

information

security

particularly

critical

When

coupled

with

the

IP

world

markedly

the

openess

of

its

applications

and

accessibility

the

concerns

of

privacy

and

security

from

the

user

perspective

become

even

more

critical

than

in

legacy

networks

Because

of

that

and

of

some

lessons

learned

from

past

mistakes

in

security

-LSB-

-RSB-

privacy

and

information

security

aspects

have

received

a

thorough

treatment

in

the

specifications

-LRB-

see

-LSB-

-RSB-

for

an

exhaustive

overview

-RRB-

Nevertheless

the

specific

topic

of

network

security

in

relation

to

the

robustness

and

availability

of

the

network

infrastructure

itself

has

not

received

adequate

attention

by

the

research

community

to

date

The

problem

can

be

condensed

in

the

following

question

What

is

the

level

of

robustness

of

a

network

against

deliberate

attacks

or

other

unanticipated

stimuli

The

problem

of

network

security

involves

issues

related

to

network

resilience

and

stability

and

can

not

be

addressed

without

a

deep

understanding

of

the

detailed

structure

and

organization

of

the

real

network

Considered

the

relative

recent

deployment

of

and

the

very

limited

access

that

research

groups

have

to

these

networks

it

should

be

no

surprise

that

the

work

in

this

area

has

been

sporadic

Some

exploits

against

network

are

known

and

documented

in

industry

reports

-LRB-

e.g.

-LSB-

-RSB-

-LSB-

-RSB-

-RRB-

while

the

fact

that

a

limited

amount

of

malicious

traffic

can

cause

large-case

troubles

to

a

wireless

cellular

network

has

been

unveiled

in

the

recent

paper

-LSB-

-RSB-

with

reference

to

a

network

supporting

open

SMS

service

But

at

this

stage

what

is

still

missing

is

an

exhaustive

and

systematic

recognition

of

the

potential

risks

threats

and

problems

to

network

security

from

which

a

research

agenda

can

be

drawn

We

provide

here

a

novel

contribution

towards

this

goal

by

introducing

an

issue

that

has

passed

unrecognized

so

far

the

impact

onto

networks

of

unwanted

traffic

and

specifically

large-scale

worm

infections

Remarkably

all

the

cited

previous

works

consider

deliberate

DoS

attack

against

the

network

Instead

here

we

focus

on

a

slightly

more

subtle

issue

namely

the

-LRB-

side

-RRB-

effects

onto

the

network

of

-LRB-

unwanted

-RRB-

traffic

whose

intended

target

is

typically

not

the

network

but

rather

its

terminals

Our

work

was

inspired

by

the

consequences

of

the

Code-Red-II

infection

onto

the

routers

of

the

wired

Internet

reported

in

-LSB-

-RSB-

and

-LSB-

-RSB-

We

claim

that

under

certain

conditions

and

for

certain

network

configuration

scenarios

large-scale

worm

infections

can

cause

sensible

degradation

and

risks

for

the

network

ACM

SIGCOMM

Computer

Communication

Review

Volume

Number

April

Figure

network

structure

performances

and

availability

We

urge

the

research

community

and

network

operators

to

consider

the

issue

of

robustness

to

unwanted

traffic

as

a

prominent

research

area

The

goal

of

this

contribution

is

to

trigger

interest

and

at

the

same

time

move

the

first

pioneering

steps

in

such

direction

The

following

discussion

is

based

on

empirical

observations

from

an

operational

GPRS/UMTS

network

collected

during

an

ongoing

research

project

in

traffic

monitoring

and

modeling

in

the

DARWIN

project

-LSB-

-RSB-

carried

out

in

collaboration

with

mobilkom

austria

AG&C

oKG

-LRB-

the

leading

mobile

operator

in

Austria

EU

-RRB-

and

Kapsch

CarrierCom

-LRB-

provider

of

equipments

and

network

engineering

services

-RRB-

Network

structure

A

network

includes

two

main

sections

a

Packet-Switched

Core

Network

-LRB-

CN

-RRB-

which

is

based

on

IP

and

one

or

more

Radio

Access

Network

-LRB-

RAN

-RRB-

Along

with

the

UMTS

RAN

-LRB-

UTRAN

-RRB-

based

on

W-CDMA

several

operators

maintain

a

parallel

GPRS

RAN

evolved

from

the

legacy

GSM

radio

This

structure

is

sketched

in

Figure

It

is

also

possible

to

connect

additional

separate

RANs

to

the

same

CN

typically

WLAN

-LSB-

-RSB-

and

perhaps

in

the

future

also

WIMAX

Each

RAN

can

evolve

independently

from

the

CN

for

example

in

several

networks

GPRS

has

been

upgraded

to

EDGE

-LSB-

p.

-RSB-

while

UMTS

upgrade

towards

HSDPA

-LSB-

p.

-RSB-

is

ongoing

Each

RAN

is

connected

to

the

legacy

Circuit-Switched

Core-Network

-LRB-

not

shown

in

Figure

-RRB-

for

traditional

services

like

voice

calls

and

to

the

Packet-Switched

Core-Network

-LRB-

CN

for

short

-RRB-

for

data

services

The

CN

embeds

several

elements

SGSN

GGSN

and

a

number

of

information

servers

Some

of

the

latter

are

shared

with

the

Circuit-Switched

Core-Network

of

the

legacy

system

e.g.

the

HLR/AuC

The

SGSNs

perform

functions

such

as

access

control

location

management

paging

route

management

-LSB-

-RSB-

The

GGSN

is

the

logical

gateway

between

the

CN

and

external

packet

networks

-LRB-

Internet

and

private

networks

-RRB-

is

endowed

with

a

full

IP-stack

and

handles

the

IP-level

connectivity

with

the

MS.

The

SGSN

and

GGSN

of

the

same

operator

communicate

through

the

Gn

interface

The

CNs

of

different

Notably

the

close

coupling

between

the

circuit

-LRB-

GSM

-RRB-

and

packet-switched

-LRB-

GPRS/UMTS

-RRB-

sections

is

a

source

of

concern

since

in

principle

troubles

originated

in

the

latter

might

cause

impairments

or

side-effect

to

the

former

as

well

tors

are

interconnected

through

the

Gp

interface

for

support

of

roaming

The

Gn

protocol

stack

-LSB-

p.

-RSB-

shows

that

a

lower

UDP/IP

layer

is

used

to

carry

the

user

data

packets

across

Gn

with

an

intermediate

encapsulation

into

a

protocol

-LRB-

GPRS

Tunnelling

Protocol

GTP

-RRB-

In

fact

the

Gn

interface

is

basically

a

wide-area

IP

network

interconnecting

the

different

SGSN/GGSN

sites

and

as

such

it

embeds

routers

IP

subnets

etc.

Besides

that

the

CN

is

rich

in

IP-based

elements

including

servers

supporting

control

and

management

functions

-LRB-

e.g.

DNS

DHCP

RADIUS

see

-LSB-

-RSB-

-RRB-

and

application

elements

-LRB-

e.g.

WAP

gateway

proxies

internal

servers

-RRB-

The

latter

are

always

located

behind

the

GGSN

on

the

Gi

side

-LRB-

ref

Figure

-RRB-

as

they

operate

directly

on

the

data-plane

Note

also

that

packet

filtering

and

other

restiction

policies

can

be

located

on

separate

dedicated

elements

-LRB-

NAT

IDS

firewalls

-RRB-

at

the

network

boundaries

-LRB-

Gi

Gp

-RRB-

and/or

directly

configured

into

the

GGSNs

terminals

The

population

of

terminals

is

highly

heterogeneous

and

includes

very

different

types

of

device

hand-held

phones

and

PDA

connect-card

pluggable

into

laptops

blackberry

etc.

Additionally

a

broad

range

of

automatic

devices

with

no

human

interaction

is

emerging

taking

advantage

of

the

ubiquity

of

the

GPRS/UMTS

coverage

-LRB-

e.g.

sensors

alarms

presence

indicators

remote

cameras

-RRB-

Presently

the

most

numerous

terminals

are

hand-held

phones

They

span

a

broad

range

of

technological

platforms

a

major

point

of

difference

-LRB-

for

the

moment

-RRB-

from

the

wired

Internet

that

is

essentially

a

monoculture

The

last

aspect

is

critical

when

considering

malware

infections

such

a

bi-ological

variety

intrinsically

limits

the

potential

infection

scope

which

in

turn

reduces

somehow

the

very

appeal

for

programming

new

pieces

of

malware

As

a

result

large-scale

infections

of

cellular

phones

have

not

yet

been

observed

despite

a

growing

number

of

exploits

and

pieces

of

malicious

code

targeting

GPRS/UMTS

phones

have

already

appeared

in

the

wild

-LRB-

e.g.

Cabir

Mosquito

Comwarrior

-RRB-

datacards

for

laptop

Many

datacards

for

laptop

were

sold

starting

in

often

coupled

with

flat-rate

offers

Most

of

these

laptops

are

equipped

with

Microsoft

Windows

note

that

for

some

datacards

drivers

are

not

available

for

other

operating

systems

This

introduced

into

the

environment

a

sub-population

of

homogeneous

terminals

i.e.

Windows

laptops

that

are

intrinsically

exposed

to

all

kinds

of

exploits

and

infections

that

are

found

in

the

wired

Internet

In

case

of

active

infection

-LRB-

e.g.

a

scanning

worm

-RRB-

they

introduce

into

the

network

the

same

unwanted

traffic

patterns

-LRB-

e.g.

probe

SYN

packets

-RRB-

that

are

found

in

wired

LANs

and

in

the

Internet

Unwanted

traffic

The

term

unwanted

traffic

has

been

used

in

-LSB-

-RSB-

to

refer

cumulatively

to

those

traffic

components

originated

directly

or

indirectly

by

malicious

or

anyway

non

productive

activities

It

includes

backscatter

traffic

asso-ciated

to

remote

DoS

attacks

scanning

probes

spam

exploit

attempts

etc.

Unwanted

traffic

might

have

a

negative

impact

onto

the

underlying

network

and

in

extreme

cases

drive

the

network

or

at

least

some

of

its

elements

to

crash

See

ACM

SIGCOMM

Computer

Communication

Review

Volume

Number

April

A

bright

example

was

provided

by

the

spreading

of

Code-Red

II

in

-LSB-

-RSB-

Once

installed

on

a

victim

host

the

worm

started

to

scan

for

new

potential

victims

by

sending

a

high

rate

of

probing

TCP

SYN

packets

to

random

addresses

This

caused

troubles

to

the

packet

forwarding

modules

of

several

edge

routers

all

over

the

Internet

some

of

which

eventually

crashed

-LSB-

-RSB-

In

simple

words

the

problem

is

that

route

caching

mechanisms

were

designed

-LRB-

and

optmized

-RRB-

to

operate

under

normal

-LRB-

i.e.

expected

-RRB-

traffic

conditions

where

most

of

the

packets

are

directed

to

a

relativelly

small

subset

of

popular

subnets

In

such

nominal

condition

route

caching

can

be

very

effective

But

during

the

infection

probing

SYN

packet

were

massively

generated

and

sent

to

randomly

chosen

IP

addresses

thus

driving

the

cache

access

mechanisms

to

explode

In

other

words

the

worm

infection

built-up

a

traffic

aggregate

macroscopically

different

from

the

normal

pattern

and

the

network

proved

to

be

not

robust

enough

to

sustain

such

different

conditions

The

lesson

to

be

learned

is

that

in

terms

of

the

characteristics

of

the

macroscopic

traffic

aggregate

-LRB-

entropy

of

the

destination

IP

address

distribution

packet

size

etc.

-RRB-

large

infections

or

other

unwanted

traffic

components

can

expose

the

network

to

a

different

operating

point

from

what

the

network

was

engineered

and

optmized

for

with

potentially

dramatic

effects

Potential

impact

on

In

principle

the

network

is

exposed

to

the

same

type

of

incidents

and

perhaps

even

more

given

the

higher

functional

complexity

inherited

by

the

wireless

cellular

paradigm

The

network

is

ultimately

an

IP

network

but

with

important

peculiarities

First

the

underlying

transport

stratum

specifically

the

lower

protocols

in

the

RAN

are

endowed

with

very

high

functional

complexity

and

signaling

interactions

mainly

for

the

sake

of

mobility

management

and

efficient

resource

management

Second

the

population

of

internal

hosts

is

extremely

large

-LRB-

from

thousands

to

millions

of

MSs

-RRB-

and

highly

dynamic

-LRB-

activity

periods

can

be

as

short

as

few

seconds

-RRB-

The

potential

impact

of

large-scale

infections

and

unwanted

traffic

in

such

a

system

is

an

intriguing

point

for

research

that

has

not

yet

been

addressed

by

the

research

community

The

existence

of

the

problem

has

been

conjectured

in

a

previous

work

-LSB-

p.

-RSB-

In

lack

of

past

empirical

events

it

is

not

possible

to

claim

that

network

are

exposed

to

serious

damages

from

large

infections

On

the

other

hand

without

a

systematic

risk

assessment

it

is

neither

possible

to

provide

a

priori

guarantees

about

their

robustness

Empirical

evidence

of

the

very

existence

of

unwanted

traffic

in

a

real

network

has

been

reported

in

-LSB-

-RSB-

along

with

initial

but

technically-detailed

speculations

on

the

potential

impact

that

the

observed

traffic

would

have

under

certain

hypothetical

conditions

and

configuration

setting

The

actual

impact

if

any

depends

on

a

combination

of

factors

related

to

the

network

configuration

and

equipment

features

In

the

following

we

illustrate

the

problem

by

discussing

a

few

examplary

forms

of

impact

that

might

take

place

in

a

real

network

Stateful

elements

The

presence

of

massive

amounts

of

TCP

SYN

packets

might

cause

troubles

to

those

stateful

elements

designed

to

reserve

resources

for

each

TCP

In

this

regard

this

is

another

example

of

-LRB-

lack

of

-RRB-

robusteness

to

unanticipated

types

of

events

in

HOT

systems

-LSB-

-RSB-

nection

-LRB-

e.g.

application

layer

proxies

servers

NATs

-RRB-

Note

that

some

stateful

operations

might

be

enabled

also

on

the

GGSNs

In

this

cases

the

GGSN

logic

should

be

robust

to

high

rates

of

SYN

packets

coming

from

the

MSs

Large

volumes

of

SYN

packets

might

be

originated

by

deliberate

DoS/DDoS

or

from

large-scale

infections

of

scanning

worms

In

both

cases

the

source

-LRB-

s

-RRB-

can

be

hosts

in

the

Internet

-LRB-

exogenous

traffic

-RRB-

or

other

MS

in

the

RAN

-LRB-

endogenous

traffic

-RRB-

In

general

exogenous

traffic

can

be

blocked

at

the

external

firewall

as

for

any

other

private

network

The

first

element

to

inspect

the

IP

packets

sent

by

the

MSs

is

the

GGSN

The

latter

generally

embeds

full

router

capabilities

therefore

it

can

be

configured

with

the

same

stateless

stateful

firewalling

policies

and/or

throttling

mechanisms

-LRB-

see

e.g.

-LSB-

-RSB-

-RRB-

to

filter

endogenous

uplink

traffic

For

an

improved

robusteness

against

residual

unblocked

SYNs

all

stateful

elements

should

be

designed

to

resist

massive

SYN

storms

rather

than

just

rely

on

external

filtering

elements

Wastage

of

logical

resources

The

UMTS

radio

bearer

channels

-LRB-

called

Dedicated

Channel

DCH

-RRB-

are

assigned

dy-namically

to

active

MSs

The

assignment

policy

is

implemented

in

the

RNC

and

is

generally

based

on

a

combination

of

timeouts

from

the

last

data

packet

and

thresholds

on

the

recent

sending

receving

rates

The

exact

algorithm

is

vendor-dependent

with

parameters

configurable

by

the

operator

Let

us

consider

here

the

simplest

case

of

a

purely

timeout-based

DCH

assignment

policy

the

DCH

is

assigned

to

the

MS

at

the

time

of

the

first

packet

-LRB-

sent

or

received

-RRB-

and

is

released

after

T

DCH

seconds

from

the

last

packet

T

DCH

being

the

holding

timeout

for

DCH

Note

that

when

the

MS

does

not

have

an

assigned

DCH

packets

are

ex-changed

on

the

common

channels

FACH

or

RACH

-LRB-

see

-LSB-

Ch

-RSB-

-RRB-

Note

also

that

each

channel

switch

operation

involves

a

signaling

procedure

at

the

radio

interface

contributing

to

the

total

transfer

delay

for

the

arriving

packet

The

value

of

T

DCH

must

be

tuned

carefully

Too

short

values

causes

a

high

frequency

of

channel

switch

cycles

and

consequently

-LRB-

i

-RRB-

a

higher

consumption

of

signaling

resources

on

the

radio

link

and

-LRB-

ii

-RRB-

longer

packet

delays

and

hence

worse

user

experience

On

the

other

hand

too

long

values

will

lead

to

wastage

of

logical

resources

i.e.

DCHs

whose

available

number

if

limited

in

each

cell

Therefore

the

optimal

value

of

T

DCH

must

be

chosen

according

to

the

distribution

of

idle-period

duration

for

typical

users

Given

such

framework

consider

what

happen

when

a

number

of

infected

terminals

are

scanning

the

local

address

space

Each

active

MS

-LRB-

not

necessarely

infected

-RRB-

will

be

visited

by

scanning

probes

at

an

average

rate

of

R

v

pkt/sec

The

exact

value

of

R

v

depends

on

several

factors

like

number

of

scanning

MSs

scanning

rate

etc.

-LRB-

see

-LSB-

-RSB-

for

more

details

-RRB-

and

can

typically

be

in

the

order

of

few

seconds

or

below

In

case

that

the

average

probe

interarrival

time

is

smaller

than

the

DCH

holding

timer

i.e.

v

-LRB-

R

v

-RRB-

T

DCH

the

incoming

unwanted

traffic

will

keep

the

DCH

channel

assigned

to

the

target

MSs

indefinitely

until

the

user

switches

off

the

terminal

or

explicitely

close

the

PDP-context

Note

that

the

volume

in

byte

count

of

such

incoming

background

traffic

is

extremely

low

and

would

pass

unnoticed

by

the

user

No

assumption

is

made

about

the

vulnerability

of

the

The

PDP-context

is

the

logical

connection

to

the

network

conceptually

similar

to

a

wired

modem

dial-up

ACM

SIGCOMM

Computer

Communication

Review

Volume

Number

April

target

MS

to

the

specific

exploit

the

only

condition

being

that

it

is

reachable

by

probing

packets

i.e.

it

has

an

active

PDP-context

Such

always-on

spurious

DCH

waste

resources

on

the

radio

interface

Notably

wastage

is

limited

to

the

logical

resources

i.e.

DCH

since

the

physical

bandwidth

is

left

largely

unused

as

only

sporadic

and

small

packets

-LRB-

probe

SYNs

-RRB-

are

transmitted

over

the

air

Such

phenomenon

might

lead

to

logical

congestion

of

some

radio

cells

as

soon

as

the

number

of

active

MSs

in

the

cell

reaches

the

number

of

available

DCHs

Signaling

overhead

One

key

assumption

in

the

above

scenario

is

that

the

average

interarrival

of

background

packets

is

smaller

than

the

DCH

holding

timeour

i.e.

v

T

DCH

Other

problems

arise

in

case

that

v

is

higher

but

close

to

T

DCH

i.e.

v

T

DCH

for

small

particularly

in

the

case

of

low

T

DCH

In

this

case

a

DCH

reassignment

follows

immediately

a

DCH

release

at

rate

DCH

thus

wasting

signaling

bandwidth

in

the

radio

section

Again

the

more

victims

are

present

in

the

same

cell

the

higher

the

impact

We

warn

that

unwanted

-LRB-

or

background

-RRB-

traffic

can

have

an

impact

onto

the

functionally-complex

network

at

least

under

certain

conditions

of

network

configuration

and

setting

Real

measurements

-LSB-

-RSB-

provide

evidence

of

the

presence

of

such

traffic

inside

a

real

GPRS/UMTS

network

We

have

speculated

on

its

potential

impact

under

hypothetical

network

conditions

-LRB-

e.g.

MS-to-MS

communication

enabled

no

firewalling

set

in

the

GGSNs

-RRB-

The

extent

to

which

such

conditions

are

effectively

found

in

a

real

network

is

unknown

as

mobile

operators

do

not

disclose

details

about

the

deployment

and

configuration

of

their

networks

Since

the

actual

impact

if

any

depends

pointedly

on

a

combination

of

factors

related

to

the

network

configuration

and

equipment

features

in

many

cases

the

relevant

countermeasures

and

fixes

are

obvious

or

anyway

simple

to

implement

once

that

the

potential

risk

has

been

identified

Often

preventive

actions

are

as

simple

as

a

careful

and

informed

network

engineering

and

equipment

configuration

For

instance

stateful

firewalling

at

the

GGSN

prevents

probe

packets

to

reach

the

target

MS

thus

avoding

DCH

channels

to

be

spuri-ously

kept

alive

by

background

traffic

Alternatively

a

more

sophisticated

DCH

assignment

strategy

-LRB-

e.g.

based

on

thresholds

on

the

packet

rate

-RRB-

would

alleviate

the

problem

However

such

features

might

never

be

activated

unless

an

explicit

recognition

of

the

problem

of

unwanted

traffic

and

its

consequences

In

summary

the

very

first

problem

is

to

recognize

and

assess

the

potential

risks

which

might

be

hidden

in

the

intricate

web

of

interactions

and

dependencies

embedded

within

the

functionally-complex

network

The

potential

risks

due

to

the

presence

of

unwanted

traffic

must

be

taken

into

account

in

the

design

of

the

network

setting

so

as

to

avoid

the

emergence

of

hazardous

conditions

A

coherent

process

of

risk

assessment

should

be

considered

as

a

natural

component

of

the

network

engineering

process

In

turn

risk

recognition

must

be

based

on

a

thorough

understanding

of

the

specific

traffic

environment

which

is

conti-nously

evolving

following

the

emerging

of

new

services

new

types

of

terminals

new

forms

of

infections

new

attacks

etc.

Automatic

or

semi-automatic

methods

can

be

implemented

to

detect

drifts

in

the

macroscopic

composition

of

the

traffic

including

the

raise

of

new

components

of

unwanted

traffic

borrowing

concepts

and

tools

from

the

recent

achievements

in

the

field

of

anomaly

detection

in

the

Internet

The

prerequisite

for

all

that

is

a

continuous

-LRB-

always-on

-RRB-

process

of

large-scale

traffic

monitoring

and

analysis

from

inside

the

network

i.e.

on

the

internal

interfaces

like

Gn

-LSB-

-RSB-

DARWIN

home

page

ricciato/darwin

-LSB-

-RSB-

A.

Bavosa

Attacks

and

Counter

Measures

in

G

and

Cellular

IP

Networks

Juniper

White

Paper

June

Online

at

-LSB-

-RSB-

C.C.

Zou

W.

Gong

D.

Towsley

Code

Red

Worm

Propagation

Modeling

and

Analysis

ACM

Conf

on

Computer

and

Comm

Security

-LRB-

CCS

-RRB-

-LSB-

-RSB-

Cisco

Dealing

with

mallocfail

and

High

CPU

Utilization

Resulting

From

the

Code

Red

Worm

codred

worm.pdf

-LSB-

-RSB-

E.

Barkan

E.

Biham

N.

Keller

Instant

Ciphertext-Only

Cryptanalysis

of

GSM

Encrypted

Communications

Crypto

Santa

Barbara

CA

August

-LSB-

-RSB-

F.

Ricciato

P.

Svoboda

E.

Hasenleithner

W.

Fleischer

On

the

Impact

of

Unwanted

Traffic

onto

a

Network

Technical

Report

February

Available

online

from

-LSB-

-RSB-

-LSB-

-RSB-

G.

M.

Koien

An

Introduction

ro

Access

Security

in

UMTS

IEEE

Wireless

Communications

-LRB-

-RRB-

-LSB-

-RSB-

H.

Holma

A.

Toskala

WCDMA

for

UMTS

Wiley

-LSB-

-RSB-

H.

Yang

F.

Ricciato

S.

Lu

L.

Zhang

Securing

a

Wireless

World

Proceedings

of

the

IEEE

-LRB-

-RRB-

-LSB-

-RSB-

J.

Bannister

P.

Mather

S.

Coope

Convergence

Technologies

for

Networks

Wiley

-LSB-

-RSB-

J.

M.

Carlson

J.

Doyle

HOT

Robustness

and

design

in

complex

systems

Phys

Rev.

Let.

-LRB-

-RRB-

-LSB-

-RSB-

J.

Twycross

M.

M.

Williamson

Implementing

and

testing

a

virus

throttle

Tech

Report

May

Online

-LSB-

-RSB-

K.

Ahmavaara

H.

Haverinen

R.

Pichna

Interworking

Architecture

Between

and

WLAN

systems

IEEE

Communications

Magazine

November

-LSB-

-RSB-

L.

Kleinrock

The

Internet

History

and

Future

Lectio

Magistralis

at

Politecnico

di

Torino

October

Online

at

nordio/seminars

-LSB-

-RSB-

O.

Whitehouse

GPRS

Wireless

Security

Not

Ready

For

Prime

Time

Research

Report

by

stake

June

Online

at

-LSB-

-RSB-

R.

Pang

et

al.

Characteristics

of

Internet

Background

Radiation

IMC

Taormina

Italy

October

-LSB-

-RSB-

S.

Keshav

Why

Cell

Phones

Will

Dominate

the

Future

Internet

Computer

Communication

Review

-LRB-

-RRB-

April

-LSB-

-RSB-

W.

Enck

P.

Traynor

P.

McDaniel

T.

La

Porta

Exploiting

Open

Functionality

in

SMS

Capable

Cellular

Networks

ACM

Conf

on

Computer

and

Comm

Security

-LRB-

CCS

-RRB-

November

ACM

SIGCOMM

Computer

Communication

Review

Volume

Number

April

B I O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O B O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O B I O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O O