Jia Wang

• PhD
• Researcher at AT&T

Customer care calls have served as a primary and direct channel for mobile users to communicate their needs with cellular service providers. These customer needs can be quite diverse and usually include provisioning/upgrade, account/billing, device and service performance related issues. The resolution process of these customer needs is largely man...

The explosive increase in cellular network traffic, users, and applications, as well as the corresponding shifts in user expectations, has created heavy needs and demands on cellular data providers. In this paper we address one such need: mining the logs of cellular voice and data traffic to rapidly detect network performance anomalies and other ev...

Cellular network-based machine-to-machine (M2M) communication is fast becoming a market-changing force for a wide spectrum of businesses and applications such as telematics, smart metering, point-of-sale terminals, and home security and automation systems. In this paper, we aim to answer the following important question: Does traffic generated by M...

Customer care calls serve as a direct channel for a service provider to learn feedbacks from their customers. They reveal details about the nature and impact of major events and problems observed by customers. By analyzing the customer care calls, a service provider can detect important events to speed up problem resolution. However, automating eve...

IP Routers use sophisticated forwarding table (FIB) lookup algorithms that minimize lookup time, storage, and update time. This paper presents SMALTA, a practical, near-optimal FIB aggregation scheme that shrinks forwarding table size without modifying routing semantics or the external behavior of routers, and without requiring changes to FIB looku...

Operational network data, management data such as customer care call logs and equipment system logs, is a very important source of information for network operators to detect problems in their networks. Unfortunately, there is lack of efficient tools to automatically track and detect anomalous events on operational data, causing ISP operators to re...

BGP Route Reflectors (RR), which are commonly used to help scale Internal BGP (iBGP), can produce oscillations, forwarding loops, and path inefficiencies. ISPs avoid these pitfalls through careful topology design, RR placement, and link-metric assignment. This paper presents Address-Based Route Reflection (ABRR): the first iBGP solution that comple...

Despite its importance in today’s Internet, network measurement was not an integral part of the original Internet architecture, i.e., there was (and still is) little native support for many essential measurement tasks. Targeting the inadequacy of counting/accounting capabilities of existing routers, many data streaming and sketching techniques have...

Recent advances in residential broadband access technologies have led to a wave of commercial IPTV deployments. As IPTV services are rolled out at scale, it is essential for IPTV systems to maintain ultra-high reliability and performance. A major issue that disrupts IPTV service is the crash of the set-top box (STB) software. The STB directly resid...

Understanding Internet traffic dynamics in large cellular networks is important for network design, troubleshooting, performance evaluation, and optimization. In this paper, we present the results from our study, which is based upon a week-long aggregated flow level mobile device traffic data collected from a major cellular operator's core network....

A cardinal prerequisite for the proper and efficient management of a network, especially an ISP network, is to understand the traffic that it carries. Traffic profiling is a means to obtain knowledge of the traffic behavior. Previous work has been focusing on traffic profiling at the link level or the host level. However, network prefix-level traff...

The 12 papers in this special issue are grouped into three sections: 1) assessments of today's global routing system; 2) techniques to improve the performance of the existing routing system; and 3) new solutions that are designed to address the routing scalability problem by changing the basic model of the Internet routing architecture.

Scalable event detection and trouble shooting capabili-ties are critical for ensuring high levels of network re-liability and performance. Although network operations systems are typically well designed for dealing with hard network outages (e.g., link failures), detecting and ana-lyzing chronic conditions -particularly those associated with short...

Ideally, enterprise administrators could specify fine-grain policies that drive how the underlying switches forward, drop, and measure traffic. However, existing techniques for flow-based networking rely too heavily on centralized controller software that installs rules reactively, based on the first packet of each flow. In this paper, we propose D...

Networks continue to change to support new applications, improve reliability and performance and reduce the operational cost. The changes are made to the network in the form of upgrades such as software or hardware upgrades, new network or service features and network configuration changes. It is crucial to monitor the network when upgrades are mad...

A Shrew attack, which uses a low-rate burst carefully designed to exploit TCP's retransmission timeout mechanism, can throttle the bandwidth of a TCP flow in a stealthy manner. While such an attack can significantly degrade the perfor- mance of all TCP-based protocols and services including Internet routing (e.g., BGP), no existing scheme clearly s...

Router syslogs are messages that a router logs to describe a wide range of events observed by it. They are considered one of the most valuable data sources for monitoring network health and for trou- bleshooting network faults and performance anomalies. However, router syslog messages are essentially free-form text with only a minimal structure, an...

Social media sites such as Twitter continue to grow at a fast pace. People of all generations use social media to exchange messages and share experiences of their life in a timely fashion. Most of these sites make their data available. An intriguing question is can we exploit this real-time and massive data-flow to improve business in a measurable...

IPTV is increasingly being deployed and offered as a commercial service to residential broadband customers. Compared with traditional ISP networks, an IPTV distribution network (i) typically adopts a hierarchical instead of mesh-like structure, (ii) imposes more stringent requirements on both reliability and performance, (iii) has different distrib...

The convergence time of the interdomain routing protocol, BGP, can last as long as 30 minutes [14], [15]. Yet, routing behavior during BGP route convergence is poorly understood. BGP can experience transient loss of reachability during route convergence. We refer to this transient loss of reachability during route convergence as transient routing f...

This paper presents ViAggre (Virtual Aggregation), a "configuration-only" approach to shrinking the routing table on routers. ViAggre does not require any changes to router software and routing protocols and can be deployed independently and autonomously by any ISP. ViAggre is effectively a scalability technique that allows an ISP to modify its int...

Prefix hijacking is one of the top known threats on to- day's Internet. A number of measurement based so- lutions have been proposed to detect prefix hijacking events. In this paper we take these solutions one step fur- ther by addressing the problem of locating the attacker in each of the detected hijacking event. Being able to locate the attacker...

A Shrew attack, which uses a low-rate burst carefully designed to exploit TCP's retransmission timeout mechanism, can throttle the bandwidth of a TCP flow in a stealthy manner. While such an attack can significantly degrade the performance of all TCP-based protocols and services including Internet routing (e.g., BGP), no existing scheme clearly sol...

Understanding the channel popularity or content popularity is an important step in the workload characterization for modern infor- mation distribution systems (e.g., World Wide Web, peer-to-peer file-sharing systems, video-on-demand systems). In this paper, we focus on analyzing the channel popularity in the context of Inter- net Protocol Televisio...

Internet Protocol Television (IPTV) has emerged as a new deliv- ery method for TV. In contrast with native broadcast in traditional cable and satellite TV system, video streams in IPTV are encoded in IP packets and distributed using IP unicast and multicast. This new architecture has been strategically embraced by ISPs across the globe, recognizing...

Recent studies reveal that the routing structures of operational net- works are much more complex than a simple BGP/IGP hierarchy, highlighted by the presence of many distinct instances of routing protocols. However, the glue (how routing protocol instances inter- act and exchange routes among themselves) is still little understood or studied. For...

Abstract—As the Internet steadily increases in importance, it is still based on a quite fragile routing design. From network operators perspective it is therefore crucial to detect end-to- end path performance due to routing outages early to either mitigate them directly or contact other entities to mitigate them. In this work we demonstrate the fe...

Chronic network conditions are caused by performance im- pairing events that occur intermittently over an extended pe- riod of time. Such conditions can cause repeated perfor- mance degradation to customers, and sometimes can even turn into serious hard failures. It is therefore critical to trou- bleshoot and repair chronic network conditions in a...

Today’s Internet routing infrastructure exhibits high homogeneity. This constitutes a serious threat to the resilience of the network, since a bug or security vulnerability in an implementation could make all routers running that implementation become simultaneously unusable. This situation could arise as a result of a defective software upgrade or...

This paper presents ViAggre (Virtual Aggregation), a \congur ation-only" approach to shrinking the routing table on routers. ViAggre applies to legacy routers and can be adopted independently and au- tonomously by any ISP. ViAggre is ee ctively a scal- ability technique that allows an ISP to modify its internal routing such that individual routers...

Prefix hijacking is known as one of the security threats on today’s Internet. A number of measurement based solutions have been proposed to detect prefix hijacking events. In this paper we take these solutions one step further by addressing the problem of locating the attacker in each of the detected hijacking event. Being able to locate an attacke...

As more and more Internet IP prefix hijacking incidents are being reported, the value of hijacking detection services has become evident. Most of the current hijacking detection approaches monitor IP prefixes on the control plane and detect inconsistencies in route advertisements and route qualities. We propose a different approach that utilizes in...

Reliability is a critical requirement of the Internet. The availability and resilience of the Internet under failures can have significant global effects. However, in the current Internet routing architecture, achieving the high level of reliability demanded by many mission critical activities can be costly. In this paper, we first propose a novel...

Achieving design closure is one of the biggest challenges for modern very large-scale integration system designers. This problem is exacerbated by the lack of high-level design-automation tools that consider the increasingly important impact of physical features, such as interconnect, on integrated circuit area, performance, and power consumption....

Traffic application classification is an essential step in the network management process to provide high availability of network ser-vices. However, network management has seen limited use of traf-fic classification because of the significant overheads of existing techniques. In this context we explore the feasibility and perfor-mance of lightweig...

In this work, we present the novel idea of route normalization by correcting on the fly routing traffic on behalf of a local router to protect the local network from malicious and misconfigured routing updates. Analogous to traffic normalization for network intrusion detection systems, the proposed RouteNormalizer patches ambiguities and eliminates...

Packet classification is the foundation of many Internet functions such as QoS and security. A long thread of research has proposed efficient software-based solutions to this problem. Such software solutions are attractive because they require cheap memory systems for implementation, thus bringing down the overall cost of the system. In contrast, h...

We consider a geometric model for the problem of minimiz- ing access control lists (ACLs) in network routers, a model that also has applications to rectilinear picture compression and figure drawing in common graphics software packages. Here the goal is to create a colored rectilinear pattern within an initially white rectangular canvas, and the ba...

Routing dynamics heavily influence Internet data plane performance. Existing studies only narrowly focused on a few destinations and did not consider the predictability of the impact of routing changes on performance metrics such as reachability. In this work, we propose an efficient framework to capture coarse-grained but important performance deg...

Entropy has recently gained considerable signicance as an important metric for network measurement. Previous re- search has shown its utility in clustering trac and detect- ing trac anomalies. While measuring the entropy of the trac observed at a single point has already been studied, an interesting open problem is to measure the entropy of the tra...

Compared to attacks against end hosts, Denial of Ser- vice (DoS) attacks against the Internet infrastructure such as those targeted at routers can be more devastating due to their global impact on many networks. We discover that the recently identied low-rate TCP-targeted DoS attacks can have severe impact on the Border Gateway Protocol (BGP). As t...

The overall efficiency, reliability, and availability of a firewall is crucial in enforcing and administrating securit y, especially when the network is under attack. The continuous growth of th e Internet, coupled with the increasing sophistication of th e attacks, is placing stringent demands on firewall performance. These ch allenges require new...

Per-flow traffic measurement is critical for usage accounting, traffic engineering, and anomaly detection. Previous methodologies are either based on random sampling (e.g., Cisco's NetFlow), which is inaccurate, or only account for the "elephants." We introduce a novel technique for measuring per-flow traffic approximately, for all flows regardless...

IP routing scalability is based on hierarchical routing, which requires that the IP address hierarchy be aligned with the physical topology. Both site multi-homing and switching ISPs without renumbering break this alignment, resulting in large routing tables. This paper presents CRIO: a new approach to IP scalability for both global and VPN routing...

Extensive measurement studies have shown that end-to-end Inter- net path performance degradation is correlated with routing dynam- ics. However, the root cause of the correlation between routing dynamics and such performance degradation is poorly understood. In particular, how do routing changes result in degraded end-to- end path performance in th...

Measurements related to security are being carried out on many sites on the Internet at network ingress points, be- tween specic points on the Internet, and across the wide area Internet. The goals range from identifying sources of and possibly ltering unwanted trafc, to characteriz- ing and coming up with new mechanisms for deterring attacks. Most...

The overall performance of a firewall is crucial in enforcing and administrating security, especially when the network is under attack. The continuous growth of the Internet, coupled with the increasing sophistication of the attacks, is placing stringent demands on firewall performance. In this paper, we describe a traffic-aware optimization framew...

Serving as the core component in many packet forwarding, differentiating and filtering schemes, packet classification continues to grow its importance in today's IP networks. Currently, most vendors use Ternary CAMs (TCAMs) for packet classification. TCAMs usually use brute-force paral- lel hardware to simultaneously check for all rules. One of the...

Estimation of traffic matrices, which provide critical input for network capacity planning and traffic engineering, has recently been recognized us an important research problem. Most of the previous approaches infer traffic matrix from either SNMP link loads or sampled NetFlow records. In this work, we design novel inference techniques that, by st...

The overall performance of a firewall is crucial in enforcing and administrating security, especially when the network is under attack. The continuous growth of the Internet, coupled with the increasing sophistication of the attacks, is placing stringent demands on firewall performance. Under such circumstances it becomes very vital to understand t...

Recent research on data streaming algorithms has provided powerful tools to efficiently monitor various characteristics of traffic passing through a single network link or node. However, it is often desirable to perform data streaming analysis on the traffic aggregated over hundreds or even thousands of links/nodes, which will provide network opera...

Estimation of trafc matrices, which provide critical input for net- work capacity planning and trafc engineering, has recently been recognized as an important research problem. Most of the previ- ous approaches infer trafc matrix from either SNMP link loads or sampled NetFlow records. In this work, we design novel infer- ence techniques that, by st...

The convergence time of the interdomain routing protocol, BGP, can last as long as 30 minutes. Yet, routing behavior during BGP route convergence is poorly understood. BGP can experience transient loss of reachability during route convergence. We refer to this transient loss of reachability during route convergence as transient routing failure. Tra...

Most important commercial Web sites maintain multiple replicas of their server infrastructure to increase both reliability and performance. In this paper, we study how many replicas should be used and where they should be placed in order to improve client network performance, including both the latency (e.g., round-trip time) between clients and th...

The ability to discover the AS-level path between two end-points is valuable for network diagnosis, performance optimization, and reliability enhancement. Virtually all existing techniques and tools for path discovery require direct access to the source. However, the uncooperative nature of the Internet makes it difficult to get direct access to an...

The traffic volume between origin/destination (OD) pairs in a network, known as traffic matrix, is essential for efficient network provisioning and traffic engineering. Existing approaches of estimating the traffic matrix, based on statistical inference and/or packet sampling, usually cannot achieve very high estimation accuracy. In this work, we t...

Recent advances in Internet measurement tools have made it possible to locate bottleneck links that constrain the available bandwidth of Internet paths. In this paper, we provide a detailed study of Internet path bottlenecks. We focus on the following four aspects: the persistence of bottleneck location, the sharing of bottlenecks among destination...

The performance of a backbone network is vulnerable to interdomain routing changes that affect how traffic trav- els to destinations in other Autonomous Systems (ASes). Despite having poor visibility into these routing changes, operators often need to react quickly by tuning the net- work configuration to alleviate congestion or by notify- ing othe...

The ability to locate network bottlenecks along end-to-end paths on the Internet is of great interest to both network operators and researchers. For example, knowing where bottleneck links are, network operators can apply traffic engineering either at the interdomain or intradomain level to improve routing. Existing tools either fail to identify th...

The ability to locate network bottlenecks along end-to-end paths on the Internet is of great interest to both network operators and researchers. For example, knowing where bottleneck links are, network operators can apply traffic engineering either at the interdomain or intradomain level to improve routing. Existing tools either fail to identify th...

Today, most large companies maintain virtual private networks (VPNs) to connect their remote locations into a single secure network. VPNs can be quite large covering more than 1000 locations and in most cases use standard Internet protocols and services. Such VPNs are implemented using a diverse set of technologies such as Frame Relay, MPLS, or IPS...

Knowing the distribution of the sizes of traffic flows passing through a network link helps a network operator to characterize network resource usage, infer traffic demands, detect traffic anomalies, and accommodate new traffic demands through better traffic engineering. Previous work on estimating the flow size distribution has been focused on mak...

The use of peer-to-peer (P2P) applications is growing dramatically, particularly for sharing large video/audio files and software. In this paper, we analyze P2P traffic by measuring flow-level information collected at multiple border routers across a large ISP network, and report our investigation of three popular P2P systems-FastTrack, Gnutella, a...

Per-flow traffic measurement is critical for usage accounting, traffic engineering, and anomaly detection. Previous methodologies are either based on random sampling (e.g., Cisco's NetFlow), which is inaccurate, or only account for the "elephants". We introduce a novel technique for measuring per-flow traffic approximately, for all flows regardless...

Traceroute is used heavily by network operators and researchers to identify the IP forwarding path from a source to a destination. In practice, knowing the autonomous system (AS) associated with each hop in the path is also quite valuable. In previous work we showed that the IP-to-AS mapping extracted from BGP routing tables is not sufficient for d...

Per-flow traffic measurement is critical for usage accounting, traffic engineering, and anomaly detection. Previous methodologies are either based on random sampling (e.g., Cisco's NetFlow), which is inaccurate, or only account for the "elephants". We introduce a novel technique for measuring perflow traffic approximately, for all flows regardless...

Per-flow traffic measurement is critical for usage accounting, traffic engineering, and anomaly detection. Previous methodologies are either based on random sampling (e.g., Cisco's NetFlow), which is inaccurate, or only account for the "elephants". Our paper introduces a novel technique for measuring per-flow traffic approximately, for all flows re...

The Border Gateway Protocol (BGP) plays a crucial role in the delivery of traffic in the Internet. Fluctuations in BGP routes cause degradation in user performance, increased processing load on routers, and changes in the distribution of traffic load over the network. Although earlier studies have raised concern that BGP routes change quite often,...

cTd[e<fhgWigj k eZl.m&kIn;oGpWqVjVfiEqVrZif&f&etsuqViMmIe<nlviMrZwnkIetmIdWxyqVir<r<jzo|{~} A  "'MOQ;`1I^Se<jFmIdWjFg[kIj Ge<npWf&rt3jVf_m;lWnz>liMrZwnkIetmIdWx rZwnkIetmIdW %Ggj k"^p[mIfEe<f 310 m;lWnz>liM eZf&e<nlm&kIjVjf_m&kIpWq"mIp[kIj~l[r<eZj eb^p[mIfVFd[n$^jVj kz^e d[eZq*djViq*dl[n;o[j 70 l[r<eZj 28900-47310 kIj g[kIjVf&jVl.mIfid.Ggj kIgWrZi...

This paper introduces a classification algorithm called HyperCuts. Like the previously best known algorithm, HiCuts, HyperCuts is based on a decision tree structure. Unlike HiCuts, however, in which each node in the decision tree represents a hyperplane, each node in the HyperCuts decision tree represents a k-dimensional hypercube. Using this extra...

Manual configuration of IP routers is an expensive, time-consuming, and error prone process. For large Internet service providers, establishing service for new customers is a major part of the financial cost of running the network. Increasingly, these customers want to exchange routing information with their provider(s) using the Border Gateway Pro...

Longest Prefix Matching (LPM) is the problem of finding which string from a given set is the longest prefix of another, given string. LPM is a core problem in many applications, including IP routing, network data clustering, and telephone network management. These applications typically require very fast matching of bounded strings, i.e., strings t...

Content Distribution Networks (CDNs) attempt to improve Web performance by delivering Web content to end-users from servers located at the edge of the network. An important factor contributing to the performance improvement is the ability of a CDN to select servers in the proximity of the requesting clients. Most CDNs today use the Domain Name Syst...

INTRODUCTION Peer-to-Peer (P2P) applications [4], [6], [2], [3] have increased traffic significantly. We propose application specific peering that allows searches for a resource (using existing or modified P2P protocols) to be directed to a copy of resource on an ISP&apos;s network, using a novel technique that automatically classifies traffic (sho...

Several recent studies have focused on generating Internet topology graphs. Topology graphs have been used to predict growth patterns of prefixes and traffic flow as well as for designing better protocols. Internet topology graphs can be studied at either inter-domain level or router level. For some applications, inter-domain level topology graph i...

The Internet is inc reasingly beingc alled upon to provide di#erent levels of servic e to di#erent applic ations and users. A prac tic al problem in doing so is that although Ethernet is one of the hops for nearly all c ommunic ation in the Internet, it does not provide any QoS guarantees. A natural question, therefore, is the e#ec t of o#ered load...

Being able to identify the groups of clients that are responsible for a significantportionofaWeb site's requests can be helpful to both the Web site and the clients. In a Web application, it is beneficial to movecontent closer to groups of clients that are responsible for large subsets of requests to an origin server. Weintroduce clusters---a group...

As the Internet infrastructure evolves to include quality of service (QoS), a lot of work has been done on how to allocate network resources to satisfy the QoS requirements of IP flows. Less attention is being paid to mapping the network QoS specifications, e.g., network delay and loss rate, to the (perceived) end-to-end performance of user applica...

INTRODUCTION Peer-to-peer applications such as Napster [4], Freenet [1], and Gnutella [2], [7] have gained much attention recently. These applications are mainly designed and used for largescale sharing of MP3 files. In such systems, end-hosts self-organize into an overlay network and share content with each other. Compared to the traditional clien...

As the Internet infrastructure evolves to include Quality of Service (QoS), it is necessary to map application quality requirements to network performance specifications in terms of delay and loss rate. In this paper, we first propose a new testbed by using a combination of simulation and emulation technics. Next, we use this testbed in studying th...

The World Wide Web can be considered as a large distributed information system that provides access to shared data objects. As one of the most popular applications currently running on the Internet, the World Wide Web is of an exponential growth in size, which results in network congestion and server overloading. Web caching has been recognized as...

Regarding the set of all information sources as the universe of discourse, we used a nonnegative monotone set function defined on its power set to describe the importance of each individual information source and their varied combinations. Such a set function is called an importance measure or a fuzzy measure. The Sugeno integral with respect to th...

As the Internet infrastructure evolves to include Quality of Service (QoS), it is necessary to map application quality requirements to the the network performance specifications in terms of delay and loss rate. While past work has addressed the dependency of audio and video applications on these underlying QoS metrics, little work has been done in...

Due to some inherent interactions among diverse information sources, the classical weighted average method is not adequate for information fusion in many real problems. To describe the interactions, an intuitive and effective way is to use an appropriate nonadditive set function. Instead of the weighted average method, which is essentially the Lebe...

As a classical aggregation tool, the weighted average method is widely used in information fusion. It is the Lebesgue integral with respect to the weights essentially. Due to some inherent interaction among diverse information sources, the weighted average method does not work well in many real problems. To describe the interaction, an intuitive an...

Belief measures and plausibility measures are two common types of semicontinuous fuzzy measures used for modeling uncertainty. Utilizing the Choquet integral for describing a multi-input one-output nonlinear system, we describe a method for determining a belief measure or a plausibility measure from given input-output data. A special neural network...

Regarding the Choquet integral as a multi-input single-output system, one can use a set of input-output data to determine the belief measure or plausibility measure for the Choquet integral concerned. The least square method and a genetic algorithm are applied for this purpose

Constructing fuzzy measures in systems is an important topic in system research. Revising a set function to be a desirable fuzzy measure is one of the practicable strategies of the construction. In this paper, the following fitting problem is investigated: given a universal set and a set function, which is not necessarily a λ-fuzzy measure, defined...

If the input-output relation of a multi-input system can be represented by some kind of integral with respect to a nonnegative monotone set function, which is not necessarily additive, then the construction of the system may be entirely described by the monotone set function. After obtaining input-output data from such a system, the set function ca...

Determining some special types of fuzzy measures is an important topic in system research. Some construction strategies, such as statistics from given input-output data, have been developed recently. This paper investigates another strategies of construction - belief measure and plausibility measure - using genetic algorithm. This algorithm is simi...

The World Wide Web can be considered as a large distributed information system that provides access to shared data objects. As one of the most popular applications currently running on the Internet, the World Wide Web is of an exponential growth in size, which results in network congestion and server overloading. Web caching has been recognized as...

We consider a geometric model for the problem of minimizing access control lists (ACLs) in network routers, a model that also has applications to rectilinear picture compression and gure drawing in common graphics software packages. Here the goal is to create a colored rectilinear pattern within an initially white rectangular canvas, and the basic...

This paper presents Virtual Aggregation, an architecture that attempts to tackle the Internet routing scal- ability problem. Our approach does not require any changes to router software and routing protocols and can be deployed by any ISP without the cooperation of other ISPs. Hence, Virtual Aggregation is a configuration-only solution. The key ins...