Published papers

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Path Aggregate without Labeled data). GAMPAL does not require labeled data to achieve a general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Routing Information Base), GAMPAL introduces path aggregates. The BGP RIB entries are classified into the path aggregates, each of which is identified with the first three AS numbers in the AS_PATH attribute. GAMPAL establishes a prediction model of traffic throughput based on past traffic throughput. It adopts the LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model focusing on periodicity in weekly scale of the Internet traffic pattern. The validity of GAMPAL is evaluated using the real traffic information and the BGP RIB exported from the WIDE backbone network (AS2500), a nation-wide backbone network for research and educational organizations in Japan. As a result, GAMPAL successfully detects traffic increases due to events and DDoS attacks targeted to a stub organization.

For LLNs (Low power and Lossy Networks), RPL (IPv6 Routing Protocol for LLNs) has been standardized by the IETF (Internet Engineering Task Force) as a routing protocol for LLNs. In RPL, each node estimates the link quality to neighboring nodes and selects the parent node by the OF (Objective Function). As a result, a tree structure rooted at the sink is constructed. Existing OFs such as MRHOF (Minimum Rank with Hysteresis OF) adopt active monitoring for link quality estimation, i.e., each node periodically broadcasts control packets, which results in large control overhead. This paper proposes BROF (Broadcast Reception based OF) which employs passive monitoring for link quality estimation, i.e., each node estimates the link quality by the actual number of control packet receptions and the expected number of control packet receptions. This paper also evaluates the basic performance of BROF by comparing with MRHOF implemented in Contiki-NG, which is an OS (Operating System) for IoT devices. As a result, the number of parent node switching in BROF is 20% lower than that in MRHOF and the control overhead in BROF is 65% lower than that in MRHOF although the network construction time in BROF is 15% larger than that in MRHOF. Furthermore, the delay time of UDP packet transmission from each node to the sink in BROF is 1% smaller than that in MRHOF.

This paper proposes a general-purpose anomaly detection mechanism for Internet backbone traffic named GAMPAL (General-purpose Anomaly detection Mechanism using Prefix Aggregate without Labeled data). GAMPAL does not require labeled data to achieve general-purpose anomaly detection. For scalability to the number of entries in the BGP RIB (Border Gateway Protocol Routing Information Base), GAMPAL introduces prefix aggregate. The BGP RIB entries are classified into prefix aggregates, each of which is identified with the first three AS (Autonomous System) numbers in the AS_PATH attribute. GAMPAL establishes a prediction model for traffic sizes based on past traffic sizes. It adopts a LSTM-RNN (Long Short-Term Memory Recurrent Neural Network) model that focuses on the periodicity of the Internet traffic patterns at a weekly scale. The validity of GAMPAL is evaluated using real traffic information, BGP RIBs exported from the WIDE backbone network (AS2500), a nationwide backbone network for research and educational organizations in Japan, and the dataset of an ISP (Internet Service Provider) in Spain. As a result, GAMPAL successfully detects anomalies such as increased traffic due to an event, DDoS (Distributed Denial of Service) attacks targeted at a stub organization, a connection failure, an SSH (Secure Shell) scan attack, and anomaly spam.

In the age of edge/fog computing, it is important to consider not only computing resources but also network resources when hosting services. Since service is composed of multiple small functions in the microservice architecture, we treat a service as a set of BFs (basic functions) that fulfill a single task. It is required to place BFs at edge/fog nodes considering the computing resources and network requirements within a practical time. This paper proposes a MANO (Management and Network Orchestration) for deploying services composed of multiple BFs with requirements to computing and network resources of distributed nodes. The proposed MANO considers the computing resources of edge/fog/cloud as well as the network delay and the bandwidth between them. This paper proposes an optimal method and a heuristic method for calculating the placement of BFs. The evaluation results show that the placement calculation time for a service composed of four BFs is about 10 seconds with the optimal method and about 20 seconds with the heuristic method. The calculation time is within the practical range.

A service in cloud computing is executed in a data center, which may result in large communication delay. To host applications requiring low latency, edge/fog computing has attracted great attention. This paper proposes a mechanism called AFC (Application Function Chaining) for realizing distributed edge/fog computing. In AFC, an application is defined as a Chained-AF, which is composed of one or more AFs (Application Functions) with control structures such as conditional branches. An AF basically fulfills a single task similar to a UNIX command. Thus, a Chained-AF looks like a distributed shell script and the networks look like a single computer from users' viewpoint. A MANO (Management and Network Orchestration) mechanism in AFC places AFs on optimal edge/fog servers which satisfy Chained-AF's requirements when it is launched. Evaluation results of a prototype implementation show that it takes 0.5 seconds and 3 seconds to launch a Chained-AF composed of two and six AFs, respectively, and that the throughput of a Chained-AF is more than 90 % of the line speed, which is independent of the number of AFs. The throughput of an AFC depends on processing performance of AFs, not on the AFC mechanism.

An experimental network environment plays an important role to examine new systems and protocols. We have developed an experimental network construction tool called LiONv1 (Lightweight On-Demand Networking, ver.1). LiONv1 satisfies the following four requirements: programmer-friendly configuration file based on Infrastructure as Code, multiple virtualization technologies for virtual nodes, physical topology conscious virtual node placement, and L3 protocol agnostic virtual networks. None of existing experimental network environments satisfy all the four requirements. In this paper, we develop LiONv2 which satisfies three more requirements: diversity of available network devices, Internet-scale deployment, and disaggregation of network configuration and device configuration. LiONv2 employs NETCONF and YANG to achieve diversity of available network devices and Internet-scale deployment. LiONv2 also defines two YANG models which disaggregate network configuration and device configuration. LiONv2 is implemented in Go and C languages with public libraries for Go. Measurement results show that construction time of a virtual network is irrelevant to the number of virtual nodes if a single virtual node is created per physical node.

Wireless sensor networking is a key enabler of Industrial IoT. IETF (Internet Engineering Task Force) has standardized a protocol suite called 6TiSCH (IPv6 over the TSCH mode of IEEE802.15.4e). 6TiSCH builds an IPv6 multi-hop wireless network with the IEEE802.15.4 radio, which achieves low energy consumption and high reliability. Although network formation time is one of key performance indicators of wireless sensor networks, it has not been studied well with 6TiSCH standard protocols such as MSF (6TiSCH Minimal Scheduling Function) and CoJP (Constrained Join Protocol). In this paper, we propose a scheduling function called SF-Fastboot which shortens network formation time of 6TiSCH. We evaluate SF-Fastboot by simulation comparing with MSF, the state-of-the-art scheduling function. The simulation shows SF-Fastboot reduces network formation time by 41 % - 80 %.

TCP/IP, the foundation of the current Internet, assumes a sufficiently low packet loss rate for links in communication path. On the other hand, for communication services such as mobile and wireless communications, communication link tends to be disruptive. In this paper, we propose Layer-5 temporally-spliced path protocol (L5-TSPP), which provides disruption-tolerance in the L5 temporally-spliced path (L5-TSP), as one of the communication paths provided by Layer-5 (L5-paths). We design and implement an API for using L5-paths (L5 API). The L5 API is designed and implemented to support not only POSIX systems but also non-POSIX systems. L5 API and L5-TSPP are implemented in the user space in Go language. The measurement results show that L5-TSP achieves lower and more stable connection establishment time and better end-to-end throughput in the presence of disruption than conventional communication paths.

6TiSCH (IPv6 over the TSCH mode of IEEE 802.15.4e) is a key enabler of Industrial Internet of Things. A 6TiSCH network is an IPv6 wireless multi-hop network built over TSCH (Timeslotted Channel Hopping) links. TSCH is a medium access mode of IEEE 802.15.4 which provides deterministic properties, and increases robustness against external interference. A 6TiSCH scheduling function computes a TSCH communication schedule which determines key performance indicators of the network such as end-to-end latency. We propose a 6TiSCH scheduling function design suite founded on Contiki-NG, an open source and cross-platform operating system for wireless sensor networks. We implement missing pieces of Contiki-NG and other tools for the design suite: a Cooja mote port of TSCH, 6top Protocol (6P) on Contiki-NG, and a 6P dissector for Wireshark. The Cooja mote is a node type of Cooja that is an accompanying simulator of Contiki-NG. We confirm that execution time of a 6TiCSH network simulation with our Cooja mote port is more than 5 times faster than that with Z1 mote. It is confirmed that our 6P implementation is interopeable with other implementations including OpenWSN. All our implementations are publicly available as part of the official releases of Cooja, Contiki-NG, and Wireshark.

Current IoT systems are closed and specialized for specific purposes. In the near future, IoT Service Providers (IoTSPs) will emerge to allow providing sensing data observed by IoTSPs to subscribers. This paper proposes a mechanism called FedIoT, in which IoTSPs federate or namely unite in an autonomous and decentralized manner. Subscribers to an IoTSP in an FedIoT system can obtain sensing data observed by any IoTSPs in the FedIoT system. The design principle of FedIoT is analogous to that of the Internet. A FedIoT system is composed of multiple IoTSPs as the Internet is composed of multiple ASs (Autonomous Systems). FedIoT basically provides only sensing data to IoT applications and it depends on IoT applications how the sensing data is utilized as the Internet basically provides data exchange between applications. IoTSPs are interconnected with a unified interface called Primitive API considering operation policy as ASs exchange routing information considering operation policy. FedIoT defines a domain ontology called OntoFedIoT as the unified representation of locations and types of sensor nodes. A proof of concept system is implemented in Go language. The basic performance evaluation in this paper shows that the time required for obtaining sensing data is short enough for practical use.

There are demands for high-speed and stable ground-totrain optical communication as a network environment for trains. The existing ground-to-train optical communication system developed by the authors uses a camera and a QPD (Quadrant photo diode) to capture beacon light. The problem with the existing system is that it is impossible to identify the ground station. In the system proposed in this paper, a beacon light modulated with the ID of the ground station is transmitted, and the ground station is identified by demodulating the image from the dual-port camera on the opposite side. In this paper, we developed an actual system and conducted experiments using a car on the road. The results showed that only one packet was lost with the ping command every 1 ms near handover. Although the communication device itself has a bandwidth of 100 Mbps, the throughput before and after the handover was about 94 Mbps, and only dropped to about 89.4 Mbps during the handover.

RPL is a standard routing protocol for an IPv6-Based LLN (Low power and Lossy Network). In RPL, each node estimates link quality to neighboring nodes and selects its parent node by an OF (Objective Function) to construct a tree structure rooted at the sink node. Currently, a typical OF is MRHOF (Minimum Rank with Hysteresis OF). MRHOF on Contiki-NG, an operating system for LLN devices, adopts an active monitoring approach for link quality estimation, which consumes much battery power. This paper proposes BROF (Broadcast Reception based OF) based on a passive monitoring approach. BROF listens to control messages transmitted by neighboring nodes and exploits unicast messages transmitted to the parent node. The performance of BROF and MRHOF on Contiki-NG is evaluated with a simulator and a testbed. The evaluation results show that the delivery ratio and delay of data messages in both OFs are almost the same while the number of transmitted L2 frames for control messages in BROF is only 19.7% to 37.8% of that in MRHOF on Contiki-NG for constructing and maintaining a tree structure. This means that BROF can achieve almost the same performance for sensing data collection as MRHOF on Contiki-NG with remarkably less battery consumption.