SecDroid Proxy: (Contact hjx@umich.edu, tiwana@umich.edu for more details) =============== Design a middle proxy which receives requests from Android clients and redirect them to remote servers. Then will need to redirect the contents back to the clients. For GPS information, we need the middle proxy to implement a duplication algorithm which sends duplicated requests to remote server so that the remote server can't easily group GPS information based on temporal and spacial locality. The implementation requires client and server implementation using Java. Neutrality in 3G networks (Contact hjx@umich.edu, tiwana@umich.edu for more details) ========================= Understanding the port blocking in 3G networks and systematically do a port scanning in 3G network to detect any type of blocking. For example, FTP is blocked in ATT's network. Understanding the metrics used by the ISPs to identity a type of traffic is also important. Cloud computing (Contact zhiyunq@umich.edu for more details if needed) =============== Investigate commercial offerings of various cloud computing services. 1. setup an account for one or more cloud providers (e.g., amazon aws). 2. Configure the cloud to use CDN to host some website. 3. Measure the diversity of the CDN including IP addresses, countries by querying open resolvers (we provide the list for open resolvers?). 4. Measure the latency from clients to CDN node using Planetlab (we provide the account?). 5. Run I/O intensive program and CPU intensive program (benchmark) on different clouds to see which cloud perform better (smaller execution time). 6. Summarize the differences between different cloud providers in terms of the above results (possibly other interesting things about the clouds). FAST HTTP (Contact Gary zgw@umich.edu for more details if needed) ========== Problem: RTT affects browser performance, especially in 3G cellular network where the RTT is very high. Usually one html page contains many objects (e.g.,css files, javascript files, images). To retrieve these objects from server, a naive browser fetch them sequentially by requesting new object after last object has been fully received. So for each object there is a RTT delay between its HTTP request and corresponding HTTP response, which increases the overall download time and severely impacts the browser performance. There are some existing approaches trying to address the problem (e.g., opening multiple connections to request objects simultaneously, adopting HTTP pipelining, encoding objects as part of the html file using Base64 encoding). 1. Try to implement them and evaluate the improvement in 3G network using smartphones. Since some approaches have already been implemented by the browser and some may require both client and server modification, you may set up your own HTTP server or implement a proxy to support your measurement. 2. Compare the measurement results and discuss the pros and cons for each approach. Bonus: Design and implement a new approach to address the problem effectively. A study of streaming traffic pattern (Contact fengqian@umich.edu for more details if needed) ==================================== Multimedia video and audio streaming (e.g., YouTube) is very popular in today's Internet. This project provides you with an opportunity to understand the network behaviors of streaming applications. Task 1 Find two of your favorite streaming applications and use them. There are huge number of such applications such as YouTube and Pandora Radio. Use Tcpdump to collect the some packet traces. Briefly describe your observation. For example, which transport/application protocol is used? Is the throughput constant or changing? Do you observe any special traffic pattern? If necessary, use simple mathematics to model the traffic pattern. Task 2 For each application, discuss the advantages and disadvantages of the traffic pattern you observed. In particular, what are its impacts on (1) Transmission time (2) Friendliness to other applications in terms of bandwidth utilization (3) Responsiveness to user interaction (e.g., if a user adjusts the progress bar of a video) (4) Sensitivity to low bandwidth / high RTT / high loss rate (5) Energy consumption for mobile devices (if a smartphone uses such application) Try to identify some tradeoffs among the above factors. Task 3 (Bonus) Based on your discussions of Task 2, how can you improve the current design or better balance the tradeoff? Describe your idea. Task 4 Build a simple streaming application (both the server and the client) on TCP or UDP. Note that you do not need to implement the codec. Instead, the server generates some random data (assume they are the multimedia content) and transfers them to the client. There are two requirements. (1) The client should be able to control the playing progress (e.g., start, pause, stop, move forward, move backward). (2) The server should smartly decide the traffic pattern based on what you have learned from Task 2 and Task 3. Virtual machine migration (Contact chenxu@umich.edu for more details) ========================= Virtual machine migration is an important management primitive in emerging data center environments. For example, it makes physical maintenance extremely easy - you run a service in a VM on one physical machine, and migrate the VM to another physical machine if the original one needs to be shut down for maintenance, causing almost no external-observable downtime. To migrate a VM, the dumbest way is to pause the original VM, send all the disk state, memory state, register states to the target physical host to duplicate and then resume the VM. This apparently is sub-optimal -- a virtual disk alone could be tens of gigabytes of data. One common solution is to store virtual machine disk images in a network file system (NFS). In this case, VM migration can skip the disk duplication phase, as the disk image can be access on both source and target physical machine. Although this is a neat solution, running a VM on one physical machine with a VM disk image somewhere else in the network may have negative impact on performance. This project is mostly about measuring the impact of NFS on VM performance. Ideally two people, each with a Linux laptop, can work on this project collaboratively. Experimental setup (Please read the whole thing before starting...) 1) Enable virtual machine support on your machine A: There are multiple virtual machine solutions, Xen, VirtualBox, etc. You need to use your own judgement to pick one - as long as it can fulfill the purpose of the whole experiment. 2) Run a VM with disk image stored locally on machine A: Installing a Linux, say Debian, might be better than installing a Windows. Try to make everything, including network, work in the VM. 3) Gather performance data as a baseline: Think about the key performance metrics you want to test on, then develop a set of experiments to gather data. You may come back to this after you have done step 5 and 6. 4) Set up a NFS server on machine B, copy disk image to B, mount directory via NFS on machine A. 5) Start the VM on A, running with disk image stored on the NFS directory. Gather performance data again. 6) Vary network condition and redo 5): Think about the network conditions that may affect the results gathered in step 6. Use tools to tune the network conditions, and redo step 6. 7) run multiple virtual machines to access the same NFS directory, or multiple VMs on multiple physical machines. In this case, we can experiment different saturation points: 1) VMs contending for computing resources, 2) network bandwidth, 3) nfs server computing. 8) Optional: Can you reason about the causes for performance degradation with NFS solution, if there is any? Can you propose optimization strategies for improving performance in this scenario? Spam/Phishing/Botnet Maps ========================= A technique known as DNS cache snooping allows one to query any DNS server on the internet to determine whether a given hostname is in its cache (eg. queried recently by a client). Using this information, it is possible to determine how wide-spread spam, phishing, and botnet infections are across the internet. Combined with Geo-IP data, very interesting maps can be generated showing affected areas of the world. Appid Integration ================= Current software such as ethereal/wireshark performs dissection of packet payloads based on UDP/TCP port numbers. This is obviously less than optimal as software often utilizes non-standard ports. Arbor Networks is releasing Appid, a deep packet inspection (DPI) framework, which can identify application payloads based on signatures. Appid can be integrated into software such as wireshark to provide hints as to which protocol dissector to invoke. Network Distance Using BGP ========================== Simple distance metrics between network prefixes can be determined by analyzing BGP information available from public repositories such as Routeviews. Software libraries such as libbgpdump and pybgpdump can assist with the parsing of these BGP dumps. AS Relationships Using BGP ========================== Similarly, peering relationships between autonomous systems can be inferred using BGP data. Implementing the algorithms described in "On Inferring Autonomous System Relationships" can provide insight into current internet peering. Aimject Protocol Additions ========================== Aimject is a program that facilitates man-in-the-middle (MITM) attacks against AOL's Instant Messanger OSCAR protocol. This program can be easily extended to perform attacks on similar IM protocols such as Yahoo and MSN. (More information at http://jon.oberheide.org/projects/aimject/) Bayesian Passive TCP Fingerprinting =================================== Current passive TCP fingerprinting (p0f) depends on strict rules-based matching. Due to manual tweaking of network stack parameters, tools such as p0f may fail to match a specific fingerprint and return no information. Utilizing bayesian networks, a trained tool can adapt to such tweaks and provide a probabilistic answer. ARP Spoofing Analysis ===================== Operating systems respond to ARP spoofing attacks in different ways. Analyzing the behavior of numerous open/closed-source operating systems can be very beneficial when protecting a network from ARP spoofing attacks and developing new tools. P2P Poisoning ============= Widespread poisoning and forged search results are prevalent on P2P networks such as Limewire. Investigating the Limewire protocol and the malicious hosts responsible for these forged responses may lead to insightful results. Network Fingerprinting ====================== Abnormalities in network characteristics may indicate improperly deployment honeypots and other network sensors. Developing reconnaissance tools to map networks and potential sensor deployments can lead to better techniques to resist attack fingerprinting. Vulnerable Server Exploitation ============================== Intentionally introduce security vulnerabilities into a network service and develop proof-of-concept exploits to subvert, crash, and gain code execution privledges. Practical experience in vulnerability discovery and exploitation techniques is a very important skill in order to write secure software.