TY - GEN A1 - Hohlfeld, Oliver A1 - Krude, Johannes A1 - Reelfs, Jens Helge A1 - Rüth, Jan A1 - Wehrle, Klaus T1 - Demystifying the Performance of XDP BPF T2 - IEEE Conference on Network Softwarization, 24-28 June 2019, Paris, France N2 - High packet rates at ≥ 10 GBit/s challenge the packet processing performance of network stacks. A common solution is to offload (parts of) the user-space packet processing to other execution environments, e.g., into the device driver (kernel-space), the NIC or even from virtual machines into the host operating system (OS), or any combination of those. While common wisdom states that offloading optimizes performance, neither benefits nor negative effects are comprehensively studied. In this paper, we aim to shed light on the benefits and shortcomings of eBPF/XDP-based offloading from the user-space to i) the kernel-space or ii) a smart NIC-including VM virtualization. We show that offloading can indeed optimize packet processing, but only if the task is small and optimized for the target environment. Otherwise, offloading can even lead to detrimental performance. Y1 - 2019 UR - https://netsoft2019.ieee-netsoft.org/ U6 - https://doi.org/10.1109/NETSOFT.2019.8806651 ER - TY - GEN A1 - Rüth, Jan A1 - Kunze, Ike A1 - Hohlfeld, Oliver T1 - TCP's Initial Window - Deployment in the Wild and its Impact on Performance T2 - IEEE Transactions on Network and Service Management Y1 - 2019 UR - https://ieeexplore.ieee.org/document/8629948 U6 - https://doi.org/10.1109/TNSM.2019.2896335 SN - 1932-4537 SN - 2373-7379 VL - 16 IS - 2 SP - 389 EP - 402 ER - TY - GEN A1 - Rüth, Jan A1 - Zimmermann, Torsten A1 - Hohlfeld, Oliver T1 - Hidden Treasures - Recycling Large-Scale Internet Measurements to Study the Internet's Control Plane T2 - Passive Active Measurement Conference (PAM 2019), 27-29 March 2019, Puerto Varas, Chile Y1 - 2019 UR - https://arxiv.org/abs/1901.07265 SN - 978-3-030-15985-6 SN - 978-3-030-15986-3 U6 - https://doi.org/10.1007/978-3-030-15986-3_4 SP - 67 PB - Springer CY - New York ER - TY - GEN A1 - Pennekamp, Jan A1 - Henze, Martin A1 - Hohlfeld, Oliver A1 - Panchenko, Andriy T1 - Hi Doppelgänger: Towards Detecting Manipulation in News Comments T2 - Companion Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 4th Workshop on Computational Methods in Online Misbehavior (CyberSafety '19), May 13–17, 2019, San Francisco, CA, USA Y1 - 2019 SN - 978-1-4503-6675-5 U6 - https://doi.org/10.1145/3308560.3316496 SP - 197 EP - 205 PB - ACM CY - New York ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Mohaupt, Timon A1 - Hohlfeld, Oliver A1 - Henckell, Niklas T1 - Hashtag Usage in a Geographically-Local Microblogging App T2 - Proceedings of the 2019 World Wide Web Conference (WWW '19 Companion), 9th International Workshop on Location and the Web (LocWeb '19), May 13–17, 2019, San Francisco, CA, USA Y1 - 2019 UR - https://arxiv.org/abs/1903.04272 SN - 978-1-4503-6675-5 U6 - https://doi.org/10.1145/3308560.3316537 SP - 919 EP - 927 PB - ACM CY - New York ER - TY - GEN A1 - Guse, Dennis A1 - Orefice, Henrique R. A1 - Reimers, Gabriel A1 - Hohlfeld, Oliver T1 - TheFragebogen: A Web Browser-based Questionnaire Framework for Scientific Research T2 - 2019 Eleventh International Conference on Quality of Multimedia Experience (QoMEX 2019), June 5-7 2019, Berlin Y1 - 2019 UR - https://arxiv.org/abs/1904.12568 ER - TY - GEN A1 - Sander, Constantin A1 - Rüth, Jan A1 - Hohlfeld, Oliver A1 - Wehrle, Klaus T1 - DeePCCI: Deep Learning-based Passive Congestion Control Identification T2 - In Proceedings of the ACM SIGCOMM Workshop on Network Meets AI & ML (NetAI '19), August 19-24, 2019, Beijing, China Y1 - 2019 UR - https://arxiv.org/abs/1907.02323 SN - 978-1-4503-6872-8 U6 - https://doi.org/10.1145/3341216.3342211 SP - 37 EP - 43 PB - ACM CY - New York ER - TY - GEN A1 - Fest, Jennifer A1 - Heilmann, Arndt A1 - Hohlfeld, Oliver A1 - Neumann, Stella A1 - Reelfs, Jens Helge A1 - Schmitt, Marco A1 - Vogelgesang, Alina T1 - Determining Response-generating Contexts on Microblogging Platforms T2 - Proceedings of the 15th Conference on Natural Language Processing (KONVENS), October 9–11, 2019, Erlangen Y1 - 2019 UR - https://corpora.linguistik.uni-erlangen.de/data/konvens/proceedings/ SP - 171 EP - 182 ER - TY - GEN A1 - Wolsing, Konrad A1 - Rüth, Jan A1 - Wehrle, Klaus A1 - Hohlfeld, Oliver T1 - A Performance Perspective on Web Optimized Protocol Stacks: TCP+TLS+HTTP/2 vs. QUIC T2 - Proceedings of the Applied Networking Research Workshop (ANRW '19), July 22, 2019, Montreal, QC, Canada Y1 - 2019 UR - https://arxiv.org/abs/1906.07415 SN - 978-1-4503-6848-3 U6 - https://doi.org/10.1145/3340301.3341123 SP - 1 EP - 7 PB - ACM CY - New York ER - TY - GEN A1 - Rüth, Jan A1 - Kunze, Ike A1 - Hohlfeld, Oliver T1 - An Empirical View on Content Provider Fairness T2 - Proceedings of the Network Traffic Measurement and Analysis Conference (TMA '19), June 17-21, 2019, Paris, France Y1 - 2019 UR - https://arxiv.org/abs/1905.07152 U6 - https://doi.org/10.23919/TMA.2019.8784684 PB - IFIP/IEEE ER - TY - GEN A1 - Rüth, Jan A1 - Wolsing, Konrad A1 - Wehrle, Klaus A1 - Hohlfeld, Oliver T1 - Perceiving QUIC: Do Users Notice or Even Care? T2 - CoNEXT '19: International Conference On Emerging Networking Experiments And Technologies, December 9-12, 2019, Orlando, FL, USA. ACM, New York, NY, USA Y1 - 2019 UR - https://arxiv.org/abs/1910.07729 U6 - https://doi.org/10.1145/3359989.3365416 N1 - DOI fehlerhaft PB - ACM CY - New York, NY, USA ER - TY - GEN A1 - Kopp, Daniel A1 - Wichtlhuber, Matthias A1 - Poese, Ingmar A1 - Cardoso de Santanna, José Jair A1 - Hohlfeld, Oliver A1 - Dietzel, Christoph T1 - DDoS Hide & Seek: On the Effectiveness of a Booter Services Takedown T2 - Proceedings of the Internet Measurement Conference (IMC 2019), Amsterdam, Netherlands — October 21 - 23, 2019 Y1 - 2019 UR - https://arxiv.org/abs/1909.07455 SN - 978-1-4503-6948-0 U6 - https://doi.org/10.1145/3355369.3355590 SP - 65 EP - 72 PB - ACM CY - New York, NY, USA ER - TY - GEN A1 - Holz, Ralph A1 - Hiller, Jens A1 - Amann, Johanna A1 - Razaghpanah, Abbas A1 - Jost, Thomas A1 - Vallina-Rodriguez, Narseo A1 - Hohlfeld, Oliver T1 - Tracking the deployment of TLS 1.3 on the Web: A story of experimentation and centralization T2 - ACM SIGCOMM Computer Communication Review Y1 - 2020 U6 - https://doi.org/10.1145/3411740.3411742 SN - 0146-4833 VL - 50 IS - 3 ER - TY - GEN A1 - Misa, Chris A1 - Guse, Dennis A1 - Hohlfeld, Oliver A1 - Durairajan, Ramakrishnan A1 - Sperotto, Anna A1 - Dainotti, Alberto A1 - Rejaie, Reza T1 - Lessons Learned Organizing the PAM 2020 Virtual Conference T2 - ACM SIGCOMM Computer Communication Review Y1 - 2020 U6 - https://doi.org/10.1145/3411740.3411747 SN - 0146-4833 VL - 50 IS - 3 ER - TY - GEN A1 - Guse, Dennis A1 - Hohlfeld, Oliver A1 - Wunderlich, Anna A1 - Weiss, Benjamin A1 - Möller, Sebastian T1 - Multi-episodic Perceived Quality of an Audio-on-Demand Service T2 - 2020 Twelfth International Conference on Quality of Multimedia Experience (QoMEX) N2 - Quality of Experience is traditionally evaluated byusing short stimuli usually representing parts orsingleusageepisodes. This opens the question on how the overall serviceperception involvingmultipleusage episodes can be evaluated—a question of high practical relevance to service operators.Despite initial research on this challenging aspect of multi-episodic perceived quality, the question of the underlying qualityformation processes and its factors are still to be discovered.We present a multi-episodic experiment of an Audio-on-Demand service over a usage period of 6 days with 93 par-ticipants. Our work directly extends prior work investigating theimpact of time between usage episodes. The results show similareffects — also the recency effect is not statistically significant.In addition, we extend prediction of multi-episodic judgments byaccounting for the observed saturation. KW - Perceived quality, QoE, Audio streaming Y1 - 2020 SN - 978-1-7281-5965-2 SN - 978-1-7281-5966-9 U6 - https://doi.org/10.1109/QoMEX48832.2020.9123070 SN - 2472-7814 SN - 2372-7179 ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Hohlfeld, Oliver A1 - Strohmaier, Markus A1 - Henckell, Niklas T1 - Word-Emoji embeddings from large scale messaging data reflect real world semantic associations of expressive icons T2 - Conference: ICWSM Workshop on Emoji Understanding and Applications in Social Media 2020 N2 - We train word-emoji embeddings on large scale messagingdata obtained from the Jodel online social network. Our dataset contains more than 40 million sentences, of which 11 million sentences are annotated with a subset of the Unicode13.0 standard Emoji list. We explore semantic emoji associations contained in this embedding by analyzing associations between emojis, between emojis and text, and betweentext and emojis. Our investigations demonstrate anecdotallythat word-emoji embeddings trained on large scale messaging data can reflect real-world semantic associations. To enable further research we release the Jodel Emoji EmbeddingDataset (JEED1488) containing 1488 emojis and their embeddings along 300 dimensions. Y1 - 2020 UR - http://workshop-proceedings.icwsm.org/pdf/2020_02.pdf ER - TY - GEN A1 - Hasslinger, Gerhard A1 - Ntougias, Konstantinos A1 - Hasslinger, Frank A1 - Hohlfeld, Oliver T1 - General Knapsack Bounds of Web Caching Performance Regarding the Properties of each Cacheable Object T2 - 2020 IFIP Networking Conference (Networking), 22-26 June 2020, Paris, France N2 - Caching strategies have been evaluated and compared in many studies, most often via simulation, but also in analytic methods. Knapsack solutions provide a general analytical approach for upper bounds on web caching performance. They assume objects of maximum (value/size) ratio being selected as cache content, with flexibility to define the caching value. Therefore the popularity, cost, size, time-to-live restrictions etc. per object can be included an overall caching goal, e.g., for reducing delay and/or transport path length in content delivery. The independent request model (IRM) leads to basic knapsack bounds for static optimum cache content. We show that a 2-dimensional (2D-)knapsack solution covers arbitrary request pattern, which selects dynamically changing content yielding maximum caching value for any predefined request sequence. Moreover, Belady's optimum strategy for clairvoyant caching is identified as a special case of our 2D-knapsack solution when all objects are unique. We also summarize a comprehensive picture of the demands and efficiency criteria for web caching, including updating speed and overheads. Our evaluations confirm significant performance gaps from LRU to advanced GreedyDual and score-based web caching methods and to the knapsack bounds. Y1 - 2020 UR - https://ieeexplore.ieee.org/document/9142701 SN - 978-3-903176-28-7 SN - 978-1-7281-6710-7 PB - IEEE ER - TY - GEN A1 - Kosek, Mike A1 - Blöcher, Leo A1 - Rüth, Jan A1 - Zimmermann, Torsten A1 - Hohlfeld, Oliver ED - Sperotto, Anna ED - Dainotti, Alberto ED - Stiller, Burkhard T1 - MUST, SHOULD, DON'T CARE: TCP conformance in the Wild T2 - Passive and Active Measurement : 21st International Conference, PAM 2020, Eugene, Oregon, USA, March 30–31, 2020, Proceedings N2 - Standards govern the SHOULD and MUST requirements for protocol implementers for interoperability. In case of TCP that carries the bulk of the Internets' traffic, these requirements are defined in RFCs. While it is known that not all optional features are implemented and nonconformance exists, one would assume that TCP implementations at least conform to the minimum set of MUST requirements. In this paper, we use Internet-wide scans to show how Internet hosts and paths conform to these basic requirements. We uncover a non-negligible set of hosts and paths that do not adhere to even basic requirements. For example, we observe hosts that do not correctly handle checksums and cases of middlebox interference for TCP options. We identify hosts that drop packets when the urgent pointer is set or simply crash. Our publicly available results highlight that conformance to even fundamental protocol requirements should not be taken for granted but instead checked regularly. Y1 - 2020 SN - 978-3-030-44080-0 SN - 978-3-030-44081-7 U6 - https://doi.org/10.1007/978-3-030-44081-7_8 SN - 0302-9743 SN - 1611-3349 SP - 122 EP - 138 PB - Springer CY - Cham ER - TY - GEN A1 - Kunze, Ike A1 - Rüth, Jan A1 - Hohlfeld, Oliver T1 - Congestion Control in the Wild - Investigating Content Provider Fairness T2 - IEEE Transactions on Network and Service Management N2 - Congestion control (CC) is an indispensable com-ponent of transport protocols to prevent congestion collapseas it distributes the available bandwidth among all competingflows, ideally in a fair manner. It thus has a large impact onperformance and there exists a constantly evolving set of CCalgorithms, each addressing different performance needs. Whilethe algorithms are commonly tested regarding the problemsunderlying their implementation, the interaction with existingalgorithms is often not considered. Additionally considering thefact that content providers (CPs) such as content distributionnetworks (CDNs) are known to tune TCP stacks for performancegains, the large assortment of algorithms opens the door for cus-tom parametrization and potentially unfair bandwidth sharing.In this paper, we thus empirically investigate if current Internettraffic generated by CPs still adheres to the conventional under-standing of fairness. For this, we compare fairness propertiesof testbed hosts to actual traffic of six major CPs subject todifferent queue sizes and queueing disciplines in a home-usersetting. Additionally, we investigate how mice and elephant flowsfrom the different CPs interact. We find that some employedCC algorithms lead to significantly asymmetric bandwidth sharesand very poor flow completion times for mice flows. Fortunately,AQMs such as FQ_CoDel are able to alleviate such unfairness. KW - TCP congestion control KW - Measurements KW - Contentdistribution networks Y1 - 2020 U6 - https://doi.org/10.1109/TNSM.2019.2962607 SN - 1932-4537 VL - 17 IS - 2 SP - 1224 EP - 1238 ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Hohlfeld, Oliver A1 - Poese, Ingmar T1 - Corona-Warn-App: Tracing the Start of the Official COVID-19 Exposure Notification App for Germany N2 - On June 16, 2020, Germany launched an open-source smartphone contact tracing app ("Corona-Warn-App") to help tracing SARS-CoV-2 (coronavirus) infection chains. It uses a decentralized, privacy-preserving design based on the Exposure Notification APIs in which a centralized server is only used to distribute a list of keys of SARS-CoV-2 infected users that is fetched by the app once per day. Its success, however, depends on its adoption. In this poster, we characterize the early adoption of the app using Netflow traces captured directly at its hosting infrastructure. We show that the app generated traffic from allover Germany---already on the first day. We further observe that local COVID-19 outbreaks do not result in noticeable traffic increases. Y1 - 2020 UR - https://conferences.sigcomm.org/sigcomm/2020/ UR - https://arxiv.org/pdf/2008.07370.pdf U6 - https://doi.org/0.1145/3405837.3411378 ER - TY - GEN A1 - Vallina, Pelayo A1 - Le Pochat, Victor A1 - Feal, Álvaro A1 - Paraschiv, Marius A1 - Gamba, Julien A1 - Burke, Tim A1 - Hohlfeld, Oliver A1 - Tapiador, Juan A1 - Vallina-Rodriguez, Narseo T1 - Mis-shapes, Mistakes, Misfits: An Analysis of Domain Classification Services T2 - ACM Internet Measurement Conference 2020, IMC ’20, October 27–29, 2020, Virtual Event, USA N2 - Domain classification services have applications in multiple areas,including cybersecurity, content blocking, and targeted advertising.Yet, these services are often a black box in terms of their method-ology to classifying domains, which makes it difficult to assesstheir strengths, aptness for specific applications, and limitations. Inthis work, we perform a large-scale analysis of 13 popular domainclassification services on more than 4.4M hostnames. Our studyempirically explores their methodologies, scalability limitations,label constellations, and their suitability to academic research aswell as other practical applications such as content filtering. Wefind that the coverage varies enormously across providers, rangingfrom over 90% to below 1%. All services deviate from their docu-mented taxonomy, hampering sound usage for research. Further,labels are highly inconsistent across providers, who show littleagreement over domains, making it difficult to compare or combinethese services. We also show how the dynamics of crowd-sourcedefforts may be obstructed by scalability and coverage aspects aswell as subjective disagreements among human labelers. Finally,through case studies, we showcase that most services are not fitfor detecting specialized content for research or content-blockingpurposes. We conclude with actionable recommendations on theirusage based on our empirical insights and experience. Particularly,we focus on how users should handle the significant disparitiesobserved across services both in technical solutions and in research. KW - Network KW - Network measurement KW - Information systems KW - Clustering and classification KW - Web applications KW - Web searching and information discovery Y1 - 2020 UR - https://eprints.networks.imdea.org/2183/1/paper.pdf SN - 978-1-4503-8138-3 U6 - https://doi.org/10.1145/3419394.3423660 SP - 598 EP - 618 ER - TY - GEN A1 - Hiller, Jens A1 - Amann, Johanna A1 - Hohlfeld, Oliver T1 - The Boon and Bane of Cross-Signing: Shedding Light on a Common Practice in Public Key Infrastructures T2 - CCS '20: Proceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security, October 2020 N2 - Public Key Infrastructures (PKIs) with their trusted Certificate Authorities (CAs) provide the trust backbone for the Internet: CAs sign certificates which prove the identity of servers, applications, or users. To be trusted by operating systems and browsers, a CA has to undergo lengthy and costly validation processes. Alternatively, trusted CAs can cross-sign other CAs to extend their trust to them. In this paper, we systematically analyze the present and past state of cross-signing in the Web PKI. Our dataset (derived from passive TLS monitors and public CT logs) encompasses more than 7 years and 225 million certificates with 9.3 billion trust paths. We show benefits and risks of cross-signing. We discuss the difficulty of revoking trusted CA certificates where, worrisome, cross-signing can result in valid trust paths to remain after revocation; a problem for non-browser software that often blindly trusts all CA certificates and ignores revocations. However, cross-signing also enables fast bootstrapping of new CAs, e.g., Let's Encrypt, and achieves a non-disruptive user experience by providing backward compatibility. In this paper, we propose new rules and guidance for cross-signing to preserve its positive potential while mitigating its risks. KW - Security and privacy KW - Network security Y1 - 2020 U6 - https://doi.org/10.1145/3372297.3423345 SP - 1289 EP - 1306 ER - TY - GEN A1 - Hiller, Jens A1 - Henze, Martin A1 - Zimmermann, Torsten A1 - Hohlfeld, Oliver A1 - Wehrle, Klaus T1 - The Case for Session Sharing: Relieving Clients from TLS Handshake Overheads T2 - 2019 IEEE 44th LCN Symposium on Emerging Topics in Networking (LCN Symposium), 14-17 Oct. 2019, Osnabrück, Germany N2 - In recent years, the amount of traffic protected with Transport Layer Security (TLS) has significantly increased and new protocols such as HTTP/2 and QUIC further foster this emerging trend. However, protecting traffic with TLS has significant impacts on network entities. While the restrictions for middleboxes have been extensively studied, addressing the impact of TLS on clients and servers has been mostly neglected so far. Especially mobile clients in emerging 5G and IoT deployments suffer from significantly increased latency, traffic, and energy overheads when protecting traffic with TLS. In this paper, we address this emerging topic by thoroughly analyzing the impact of TLS on clients and servers and derive opportunities for significantly decreasing latency of TLS communication and downsizing TLS management traffic, thereby also reducing TLSinduced server load. We propose a protocol compatible redesign of TLS session management to use these opportunities and showcase their potential based on mobile device traffic and mobile web-browsing traces. These show promising potentials for latency improvements by up to 25.8% and energy savings of up to 26.3%. KW - TLS Performance, Efficient Secure Communication, TLS Session Resumption, Network Security, Security and Privacy, Mobile Networking, 5G and IoT Y1 - 2019 UR - https://ieeexplore.ieee.org/document/9000667 SN - 978-1-7281-2561-9 SN - 978-1-7281-2562-6 U6 - https://doi.org/10.1109/LCNSymposium47956.2019.9000667 PB - IEEE ER - TY - GEN A1 - Hasslinger, Gerhard A1 - Ntougias, Konstantinos A1 - Hasslinger, Frank A1 - Hohlfeld, Oliver T1 - Fast and Efficient Web Caching Methods Regarding the Size and Performance Measures per Data Object T2 - 2019 IEEE 24th International Workshop on Computer Aided Modeling and Design of Communication Links and Networks (CAMAD), 11-13 Sept. 2019, Limassol, Cyprus N2 - Caching methods are developed since 50 years for paging in CPU and database systems, and since 25 years for web caching as main application areas among others. Pages of unique size are usual in CPU caches, whereas web caches are storing data chunks of different size in a widely varying range. We study the impact of different object sizes on the performance and the overhead of web caching. This entails different caching goals, starting from the byte and object hit ratio to a generalized value hit ratio for optimized costs and benefits of caching regarding traffic engineering (TE), reduced delays and other QoS measures. The selection of the cache contents turns out to be crucial for the web cache efficiency with awareness of the size and other properties in a score for each object. We introduce a new class of rank exchange caching methods and show how their performance compares to other strategies with extensions needed to include the size and scores for QoS and TE caching goals. Finally, we derive bounds on the object, byte and value hit ratio for the independent request model (IRM) based on optimum knapsack solutions of the cache content. KW - Web caching strategies, rank exchange caching (REC), LRU, LFU, score-gated polling (SGP), Greedy-Dual, hit ratio optimization and bounds, simulative evaluation Y1 - 2019 UR - https://ieeexplore.ieee.org/document/8858459 SN - 978-1-7281-1016-5 SN - 978-1-7281-1017-2 U6 - https://doi.org/10.1109/CAMAD.2019.8858459 SN - 2378-4873 SN - 2378-4865 PB - IEEE ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Bergmann, Max A1 - Hohlfeld, Oliver A1 - Henckell, Niklas T1 - Understanding & Predicting User Lifetime with Machine Learning in an Anonymous Location-Based Social Network T2 - Companion Proceedings of the Web Conference 2021 N2 - In this work, we predict the user lifetime within the anonymous and location-based social network Jodel in the Kingdom of Saudi Arabia. Jodel's location-based nature yields to the establishment of disjoint communities country-wide and enables for the first time the study of user lifetime in the case of a large set of disjoint communities. A user's lifetime is an important measurement for evaluating and steering customer bases as it can be leveraged to predict churn and possibly apply suitable methods to circumvent potential user losses. We train and test off the shelf machine learning techniques with 5-fold crossvalidation to predict user lifetime as a regression and classification problem; identifying the Random Forest to provide very strong results. Discussing model complexity and quality trade-offs, we also dive deep into a time-dependent feature subset analysis, which does not work very well; Easing up the classification problem into a binary decision (lifetime longer than timespan ) enables a practical lifetime predictor with very good performance. We identify implicit similarities across community models according to strong correlations in feature importance. A single countrywide model generalizes the problem and works equally well for any tested community; the overall model internally works similar to others also indicated by its feature importances. Y1 - 2021 UR - https://arxiv.org/abs/2103.01300 SN - 978-1-4503-8313-4 U6 - https://doi.org/10.1145/3442442.3451887 VL - 2021 PB - ACM CY - Ljubljana, Slovenia ER - TY - GEN A1 - Kopp, Daniel A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver T1 - DDoS Never Dies? An IXP Perspective on DDoS Amplification Attacks T2 - Proceedings of the Passive and Active Measurement (PAM) conference 2021 N2 - DDoS attacks remain a major security threat to the continuous operation of Internet edge infrastructures, web services, and cloud platforms. While a large body of research focuses on DDoS detection and protection, to date we ultimately failed to eradicate DDoS altogether. Yet, the landscape of DDoS attack mechanisms is even evolving, demanding an updated perspective on DDoS attacks in the wild. In this paper, we identify up to 2608 DDoS amplification attacks at a single day by analyzing multiple Tbps of traffic flows at a major IXP with a rich ecosystem of different networks. We observe the prevalence of well-known amplification attack protocols (e.g., NTP, CLDAP), which should no longer exist given the established mitigation strategies. Nevertheless, they pose the largest fraction on DDoS amplification attacks within our observation and we witness the emergence of DDoS attacks using recently discovered amplification protocols (e.g., OpenVPN, ARMS, Ubiquity Discovery Protocol). By analyzing the impact of DDoS on core Internet infrastructure, we show that DDoS can overload backbone-capacity and that filtering approaches in prior work omit 97% of the attack traffic. Y1 - 2021 UR - https://arxiv.org/abs/2103.04443 UR - https://www.springerprofessional.de/ddos-never-dies-an-ixp-perspective-on-ddos-amplification-attacks/19017760 ER - TY - GEN A1 - Feal, Álvaro A1 - Vallina, Pelayo A1 - Gamba, Julien A1 - Pastrana, Sergio A1 - Nappa, Antonio A1 - Hohlfeld, Oliver A1 - Vallina-Rodriguez, Narseo A1 - Tapiador, Juan T1 - Blocklist Babel: On the Transparency and Dynamics of Open Source Blocklisting T2 - IEEE Transactions on Network and Service Management N2 - Blocklists constitute a widely-used Internet security mechanism to filter undesired network traffic based on IP/domain reputation and behavior. Many blocklists are distributed in open source form by threat intelligence providers who aggregate and process input from their own sensors, but also from thirdparty feeds or providers. Despite their wide adoption, many open-source blocklist providers lack clear documentation about their structure, curation process, contents, dynamics, and interrelationships with other providers. In this paper, we perform a transparency and content analysis of 2,093 free and open source blocklists with the aim of exploring those questions. To that end, we perform a longitudinal 6-month crawling campaign yielding more than 13.5M unique records. This allows us to shed light on their nature, dynamics, inter-provider relationships, and transparency. Specifically, we discuss how the lack of consensus on distribution formats, blocklist labeling taxonomy, content focus, and temporal dynamics creates a complex ecosystem that complicates their combined crawling, aggregation and use. We also provide observations regarding their generally low overlap as well as acute differences in terms of liveness (i.e., how frequently records get indexed and removed from the list) and the lack of documentation about their data collection processes, nature and intended purpose. We conclude the paper with recommendations in terms of transparency, accountability, and standardization. Y1 - 2021 U6 - https://doi.org/10.1109/TNSM.2021.3075552 SN - 1932-4537 PB - IEEE ER - TY - GEN A1 - Hohlfeld, Oliver A1 - Guse, Dennis A1 - De Moor, Katrien T1 - A Questionnaire to Assess Virtual Conference Participation Experience T2 - 2021 Thirteenth International Conference on Quality of Multimedia Experience (QoMEX) N2 - This tools track paper presents the design of a questionnaire methodology to assess the participants experience of virtual conferences. This survey approach consists of a preconference questionnaire assessing participation goals and expectations and a post-conference questionnaire assessing the actual participation and related experiences. It enables a data-driven investigation of participants' expectations, goals, attitudes, actual experiences, and general feedback about virtual conferences. As such, it can help to better understand how virtual conference experiences can be improved in the future and how the virtual format can become a more attractive alternative, also in non-pandemic times. The questionnaire was used at three conferences and two workshops. Despite a missing validation, we released it early to foster research on virtual conferences. Y1 - 2021 UR - https://ieeexplore.ieee.org/document/9465406 SN - 978-1-6654-3589-5 SN - 978-1-6654-1183-7 U6 - https://doi.org/10.1109/QoMEX51781.2021.9465406 SN - 2472-7814 SN - 2372-7179 PB - IEEE ER - TY - GEN A1 - Kopp, Daniel A1 - Strehle, Eric A1 - Hohlfeld, Oliver T1 - CyberBunker 2.0 - A Domain and Traffic Perspective on a Bullet Proof Hoster T2 - CCS '21: Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, November 2021 Y1 - 2021 U6 - https://doi.org/10.1145/3460120.3485352 ER - TY - GEN A1 - Wagner, Daniel A1 - Kopp, Daniel A1 - Wichtlhuber, Matthias A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver A1 - Smaragdakis, Georgios A1 - Feldmann, Anja T1 - United We Stand: Collaborative Detection and Mitigation of Amplification DDoS Attacks at Scale T2 - ACM CCS 2021 - November 15-19, Virtual Conference Y1 - 2021 UR - https://sigsac.org/ccs/CCS2021/accepted-papers.html U6 - https://doi.org/10.1145/3460120.3485385 ER - TY - GEN A1 - Doan, Trinh Viet A1 - van Rijswijk-Deij, Roland A1 - Hohlfeld, Oliver A1 - Bajpai, Vaibhav T1 - An Empirical View on Consolidation of the Web T2 - ACM Transactions on Internet Technology (TOIT) N2 - The majority of Web content is delivered by only a few companies that provide Content Delivery Infrastructuress (CDIss) such as Content Delivery Networkss (CDNss) and cloud hosts. Due to increasing concerns about trends of centralization, empirical studies on the extent and implications of resulting Internet consolidation are necessary. Thus, we present an empirical view on consolidation of the Web by leveraging datasets from two different measurement platforms. We first analyze Web consolidation around CDIs at the level of landing webpages, before narrowing down the analysis to a level of embedded page resources. The datasets cover 1(a) longitudinal measurements of DNS records for 166.5 M Web domains over five years, 1(b) measurements of DNS records for Alexa Top 1 M over a month and (2) measurements of page loads and renders for 4.3 M webpages, which include data on 392.3 M requested resources. We then define CDIs penetration as the ratio of CDI-hosted objects to all measured objects, which we use to quantify consolidation around CDIs. We observe that CDI penetration has close to doubled since 2015, reaching a lower bound of 15% for all .com, .net, and .org Web domains as of January 2020. Overall, we find a set of six CDIss to deliver the majority of content across all datasets, with these six CDIss being responsible for more than 80% of all 221.9 M CDI-delivered resources (56.6% of all resources in total). We find high dependencies of Web content on a small group of CDIss, in particular, for fonts, ads, and trackers, as well as JavaScript resources such as jQuery. We further observe CDIss to play important roles in rolling out IPv6 and TLS 1.3 support. Overall, these observations indicate a potential oligopoly, which brings both benefits but also risks to the future of the Web. Y1 - 2022 UR - https://dl.acm.org/doi/full/10.1145/3503158 U6 - https://doi.org/10.1145/3503158 SN - 1557-6051 SN - 1533-5399 VL - 22 IS - 3 SP - 1 EP - 30 ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Hohlfeld, Oliver A1 - Henckell, Niklas T1 - Geographic Differences in Social Media Interactions Exist Between Western and Middle-East Countries T2 - Passive and Active Measurement Conference 2022 N2 - In this paper, we empirically analyze two examples of a Western (DE) versus Middle-East (SA) Online Social Messaging App. By focusing on the system interactions over time in comparison, we identify inherent differences in user engagement. We take a deep dive and shed light onto differences in user attention shifts and showcase their structural implications to the user experience. Our main findings show that in comparison to the German counterparts, the Saudi communities prefer creating content in longer conversations, while voting more conservative. Y1 - 2022 SN - 978-3-030-98785-5 SN - 978-3-030-98784-8 U6 - https://doi.org/10.1007/978-3-030-98785-5_18 SP - 411 EP - 425 PB - Springer CY - Cham ER - TY - GEN A1 - Mehner, Stefan A1 - Schuster, Franka A1 - Hohlfeld, Oliver T1 - Lights on Power Plant Control Networks T2 - Passive and Active Measurement : 23rd International Conference, PAM 2022, Virtual Event, March 28–30, 2022, Proceedings N2 - Industrial Control Systems (ICS) are critical systems to our society. Yet they are less studied given their closed nature and often the unavailability of data. While few studies focus on wide-area SCADA systems, e.g., power or gas distribution networks, mission critical networks that control power generation are not yet studied. To address this gap, we perform the first measurement study of Distributed Control System (DCS) by analyzing traces from all network levels from several operational power plants. We show that DCS networks feature a rather rich application mix compared to wide-area SCADA networks and that applications and sites can be fingerprinted with statistical means. While traces from operational power plants are hard to obtain, we analyze to which extent easier to access training facilities can be used as vantage points. Our study aims to shed light on traffic properties of critical industries that were not yet analyzed given the lack of data. Y1 - 2022 SN - 978-3-030-98784-8 SN - 978-3-030-98785-5 U6 - https://doi.org/10.1007/978-3-030-98785-5_21 SN - 0302-9743 SN - 1611-3349 SP - 470 EP - 484 PB - Springer ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Hohlfeld, Oliver A1 - Henckell, Niklas T1 - Anonymous Hyperlocal Communities: What do they talk about? T2 - 12th International Workshop on Location and the Web (LocWeb'22) N2 - In this paper, we study what users talk about in a plethora of independent hyperlocal and anonymous online communities in a single country: Saudi Arabia (KSA). We base this perspective on performing a content classification of the Jodel network in the KSA. To do so, we first contribute a content classification schema that assesses both the intent (why) and the topic (what) of posts. We use the schema to label 15k randomly sampled posts and further classify the top 1k hashtags. We observe a rich set of benign (yet at times controversial in conservative regimes) intents and topics that dominantly address information requests, entertainment, or dating/flirting. By comparing two large cities (Riyadh and Jeddah), we further show that hyperlocality leads to shifts in topic popularity between local communities. By evaluating votes (content appreciation) and replies (reactions), we show that the communities react differently to different topics; e.g., entertaining posts are much appreciated through votes, receiving the least replies, while beliefs & politics receive similarly few replies but are controversially voted. Y1 - 2022 UR - https://arxiv.org/abs/2203.05657 U6 - https://doi.org/10.48550/arXiv.2203.05657 ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Hohlfeld, Oliver A1 - Strohmaier, Markus A1 - Henckell, Niklas T1 - Characterizing the country-wide adoption and evolution of the Jodel messaging app in Saudi Arabia T2 - arXiv N2 - Social media is subject to constant growth and evolution, yet little is known about their early phases of adoption. To shed light on this aspect, this paper empirically characterizes the initial and country-wide adoption of a new type of social media in Saudi Arabia that happened in 2017. Unlike established social media, the studied network Jodel is anonymous and location-based to form hundreds of independent communities country-wide whose adoption pattern we compare. We take a detailed and full view from the operators perspective on the temporal and geographical dimension on the evolution of these different communities—from their very first the first months of establishment to saturation. This way, we make the early adoption of a new type of social media visible, a process that is often invisible due to the lack of data covering the first days of a new network. Y1 - 2022 UR - https://arxiv.org/abs/2205.04544 U6 - https://doi.org/10.48550/arXiv.2205.04544 ER - TY - GEN A1 - Reelfs, Jens Helge A1 - Mohaupt, Timon A1 - Sikdar, Sandipan A1 - Strohmaier, Markus A1 - Hohlfeld, Oliver T1 - Interpreting Emoji with Emoji: 🏖️ => ☀️😎🌊 T2 - 5th International Workshop on Emoji Understanding and Applications in Social Media 2022 N2 - We study the extent to which emoji can be used to add interpretability to embeddings of text and emoji. To do so, we extend the POLAR-framework that transforms word embeddings to interpretable counterparts and apply it to word-emoji embeddings trained on four years of messaging data from the Jodel social network. We devise a crowdsourced human judgement experiment to study six usecases, evaluating against words only, what role emoji can play in adding interpretability to word embeddings. That is, we use a revised POLAR approach interpreting words and emoji with words, emoji or both according to human judgement. We find statistically significant trends demonstrating that emoji can be used to interpret other emoji very well. Y1 - 2022 UR - https://aiisc.ai/emoji2022/#section-agenda ER - TY - GEN A1 - Bajpai, Vaibhav A1 - Hohlfeld, Oliver A1 - Crowcroft, Jon A1 - Keshav, Srinivasan A1 - Schulzrinne, Henning A1 - Ott, Jörg A1 - Ferlin, Simone A1 - Carle, Georg A1 - Hines, Andrew A1 - Raake, Alexander T1 - Recommendations for Designing Hybrid Conferences T2 - ACM SIGCOMM Computer Communication Review N2 - During the COVID-19 pandemic, many smaller conferences have moved entirely online and larger ones are being held as hybrid events. Even beyond the pandemic, hybrid events reduce the carbon footprint of conference travel and makes events more accessible to parts of the research community that have difficulty traveling long distances, while preserving most advantages of in-person gatherings. While we have developed a solid understanding of how to design virtual events over the last two years, we are still learning how to properly run hybrid events. We present guidelines and considerations-spanning technology, organization and social factors-for organizing successful hybrid conferences. This paper summarizes and extends the discussions held at the Dagstuhl seminar on "Climate Friendly Internet Research" held in July 2021. Y1 - 2022 U6 - https://doi.org/10.1145/3544912.3544920 SN - 0146-4833 SN - 1943-5819 VL - 52 IS - 2 SP - 63 EP - 69 ER - TY - GEN A1 - Wichtlhuber, Matthias A1 - Strehle, Eric A1 - Kopp, Daniel A1 - Prepens, Lars A1 - Stegmueller, Stefan A1 - Rubina, Alina A1 - Dietzel, Christoph A1 - Hohlfeld, Oliver T1 - IXP Scrubber: Learning from Blackholing Traffic for ML-Driven DDoS Detection at Scale T2 - ACM SIGCOMM 2022 Conference, 2022 N2 - Distributed Denial of Service (DDoS) attacks are among the most critical cybersecurity threats, jeopardizing the stability of even the largest networks and services. The existing range of mitigation services predominantly filters at the edge of the Internet, thus creating unnecessary burden for network infrastructures. Consequently, we present IXP Scrubber, a Machine Learning (ML) based system for detecting and filtering DDoS traffic at the core of the Internet at Internet Exchange Points (IXPs) which see large volumes and varieties of DDoS. IXP Scrubber continuously learns DDoS traffic properties from neighboring Autonomous Systems (ASes). It utilizes BGP signals to drop traffic for certain routes (blackholing) to sample DDoS and can thus learn new attack vectors without the operator’s intervention and on unprecedented amounts of training data. We present three major contributions: i) a method to semi-automatically generate arbitrarily large amounts of labeled DDoS training data from IXPs’ sampled packet traces, ii) the novel, controllable, locally explainable and highly precise two-step IXP Scrubber ML model, and iii) an evaluation of the IXP Scrubber ML model, including its temporal and geographical drift, based on data from 5 IXPs covering a time span of up to two years. KW - Machine Learning, Traffic Classification, Denial of Service Y1 - 2022 UR - https://dl.acm.org/doi/pdf/10.1145/3544216.3544268 SP - 707 EP - 722 ER - TY - GEN A1 - Moreno, José Miguel A1 - Pastrana, Sergio A1 - Reelfs, Jens Helge A1 - Vallina, Pelayo A1 - Panchenko, Andriy A1 - Smaragdakis, Georgios A1 - Hohlfeld, Oliver A1 - Vallina-Rodriguez, Narseo A1 - Tapiador, Juan T1 - Reviewing War: Unconventional User Reviews as a Side Channel to Circumvent Information Controls N2 - During the first days of the 2022 Russian invasion of Ukraine, Russia’s media regulator blocked access to many global social media platforms and news sites, including Twitter, Facebook, and the BBC. To bypass the information controls set by Russian authorities, pro-Ukrainian groups explored unconventional ways to reach out to the Russian population, such as posting war-related content in the user reviews of Russian business available on Google Maps or Tripadvisor. This paper provides a first analysis of this new phenomenon by analyzing the creative strategies to avoid state censorship. Specifically, we analyze reviews posted on these platforms from the beginning of the conflict to September 2022. We measure the channeling of war messages through user reviews in Tripadvisor and Google Maps, as well as in VK, a popular Russian social network. Our analysis of the content posted on these services reveals that users leveraged these platforms to seek and exchange humanitarian and travel advice, but also to disseminate disinformation and polarized messages. Finally, we analyze the response of platforms in terms of content moderation and their impact. KW - Side Channels KW - Disinformation KW - Propaganda KW - User-Generated Content KW - Russia KW - Ukraine KW - Tripadvisor KW - Google Maps KW - VKontakte Y1 - 2023 UR - https://arxiv.org/abs/2302.00598 U6 - https://doi.org/10.48550/arXiv.2302.00598 ER - TY - GEN A1 - Schweissguth, Eike A1 - Parzyjegla, Helge A1 - Danielis, Peter A1 - Mühl, Gero A1 - Timmermann, Dirk A1 - Mehner, Stefan A1 - Hohlfeld, Oliver A1 - Hellmanns, David A1 - Falk, Jonathan T1 - TSN Scheduler Benchmarking T2 - 2023 IEEE 19th International Conference on Factory Communication Systems (WFCS) N2 - Time-Sensitive Networking (TSN) disrupts realtime communication technology by making IEEE Ethernet realtime-capable. For time-triggered, hard realtime traffic, TSN provides standardized mechanisms to reserve communication paths as well as individual transmission time slots for data frames. By leveraging these means in a precomputed network schedule, TSN allows for bounded end-to-end delays and minimal jitter. Not being part of the IEEE standard, corresponding scheduling algorithms are an active field of research. Unfortunately, due to differing model assumptions, evaluation setups, and key metrics, a fair comparison of schedulers is impossible so far. In this paper, we present a systematic and reproducible approach to benchmark TSN schedulers. First, we provide a scheduler taxonomy that enables to cluster schedulers by their characteristics. Second, we analyze interactions of input parameters and scheduler results to derive a benchmarking parcour for quantitative comparisons. Finally, we use the approach to benchmark existing schedulers and show subtle interaction effects. This way, our approach enables—for the first time-comparability between schedulers, fueled by the public availability of our benchmarking scenarios. KW - Schedules KW - Systematics KW - Scheduling algorithms KW - Taxonomy KW - Process control KW - Standardization KW - Benchmark testing Y1 - 2023 UR - https://ieeexplore.ieee.org/document/10144227/authors#full-text-header SN - 978-1-6654-6432-1 SN - 978-1-6654-6433-8 U6 - https://doi.org/10.1109/WFCS57264.2023.10144227 SN - 2835-8414 SN - 2835-8511 PB - IEEE ER -