arXiv subjects

Matthias Wählisch

Publications and source records attributed to Matthias Wählisch.

At least 19 recordsLinked to original sources

arXiv2026

A Leaner and Faster Web: How CBOR Can Improve Dynamic Content Encoding in JSON and DNS over HTTPS

The Internet community has taken major efforts to decrease latency on the World Wide Web with significant improvements in accelerating content transport and in compressing static content. Less attention, however, has been dedicated to compression of dynamic content. Such content is commonly provided by JSON and DNS over HTTPS. Dynamic content objects continue to grow in size, which increases latency and fosters the digital inequality. In this paper, we propose to mitigate this increase by utilizing Concise Binary Object Representation (CBOR), a standard originally designed for the constrained Internet of Things (IoT) to restrict packet sizes and enable efficient encoding of data objects. We provide protocol design and three new data sets for the evaluation of dynamic content, DNS, and the loading of websites. Our key findings are the following: (i) Switching the data representation from JSON to CBOR reduces data by up to 80%. This size reduction can decrease loading times by up to 13.8% when downloading large objects---even in local setups. (ii) Enabling CBOR for DNS over HTTPS (DoH) and DNS over CoAP (DoC) reduces packet sizes significantly. Compressing only names combined with unpacked CBOR achieves maximum gain of 52.2%, using more complex but still lightweight Packed CBOR allows minimizing packets by up to 95.5%. Our lean decoder for name compression can fit into as little as 314 bytes of build size. Our results clearly show the potential of CBOR outside of IoT scenarios. Parts of this research have already influenced work within the IETF.

cs.NI↗

arXiv2026

Deconstructing BLE Multi-hop: a Model-based Approach to Quantifying the Challenges

Bluetooth Low Energy (BLE) was originally designed for point-to-point communication, but BLE multi-hop networks have attracted academic and industrial interest. Multi-hop communication, however, introduces desynchronized nodes to the network due to the difference in individual clocks. In this paper, we study the impact of clock drift on a BLE multi-hop network. The aim is to find out if a BLE multi-hop network can be properly set up, why, and how. For this goal, we develop a mathematical model to quantify the collision probability among BLE connections managed by a single device. We provide a simplified version of the model for constrained deployment. The impact of clock drift and our mathematical model are validated through practical experiments. Afterward, we find that a BLE multi-hop network cannot eliminate the impact of clock drift in most cases. Moreover, from a long-term point of view, the collision between BLE connections occurs with a fixed frequency. We further analyze the limitation of using BLE to form multi-hop networks, and propose possible solutions, such as topology limitation, changes to BLE stack or hardware. This paper is a clear and quantitative problem statement on the limitations of using BLE in multi-hop networks.

cs.NI↗

arXiv2026

Adaptive Learning Mechanisms for Learning Management Systems: A Scoping Review and Practical Considerations

Background: Traditional Learning Management Systems (LMSs) usually offer one-size-fits-all solutions that cannot be customized to meet specific learner needs. To address this issue, adaptive learning mechanisms (ALMs) are integrated either by LMS-specific approaches into individual LMSs or by system-independent approaches into various existing LMSs. Objective: We conducted a scoping review of the literature addressing the following research questions. How are ALMs integrated into LMSs system-independently? How are they provided, how are they specified, and what data do they process as the basis for adaptation? What are the educational surrounding conditions and outcomes of their application? A priori, we proposed three hypotheses. First, the focused ALMs rarely consider existing data. Second, they usually support a limited number of data processing mechanisms. Third, the users intended to provide them, are rarely given the ability to adapt how they work. Furthermore, to investigate the differences between system-independent and LMS-specific approaches, we also included the latter. Design: We used Scopus, Web of Science, and Google Scholar to identify 3370 papers, excluding duplicates, that had been published between 2003 and 2023 for screening, and conducted a snowball search. Results: We identified 61 relevant approaches and extracted eleven variables for them through in-depth reading. The results support the proposed hypotheses. Conclusion: Based on the challenges raised by these hypotheses with regard to the relevant target user groups, we defined two future research directions - developing a conceptual model for the system-independent specification of ALMs and a corresponding architecture for the provision, and supporting the authoring of these mechanisms.

cs.CY↗

arXiv2026

Secrets Best Not Shared: DNS Privacy Enhancements for the Constrained IoT

Attackers often identify DNS traffic to disrupt or compromise Internet services. While prior work has focused on encrypting queries using DNS over TLS, HTTPS, or QUIC to counter such attacks, we consider IETF protocols designed for resource-constrained IoT devices and empirically analyze the potential of obfuscating DNS traffic in addition to encryption. We create a dataset of machine-to-machine-compatible data objects along with the corresponding DNS resolution processes, evaluating 296 deployment scenarios of resolving host names, including DNS over the Constrained Application Layer Protocol (CoAP) and an onion routing flavor of CoAP under varying link-layer conditions. We compare them to DNS over HTTPS. Using Random Forest and a header field analysis, we identify fields that leak most information. Our findings show that DNS over CoAP with equalized packet lengths, block-wise transfer, and header compression reduces the accuracy of identifying DNS frames to 86% and further to 77% with payload compression. Our approach outperforms DNS over HTTPS, where classifiers always identify DNS frames based on IP addresses. The dataset is publicly available.

cs.CR↗

arXiv2026

Contrastive Learning and Correlation Clustering for Sequences of Network Telescope Data

Understanding activities of Internet scanners is challenging; it often requires identifying relationships between sources, a task for which semantic annotations are scarce. This work investigates whether semantically meaningful pairwise relationships between sequences of network flow records can be estimated by contrastive learning, without pretraining and without annotations. To this end, we propose a transformer model that embeds minimally preprocessed sequences of network flow records and train it using contrastive learning. With the similarities obtained from this model, we state a correlation clustering problem and solve it locally. Experimentally, we show: Learned similarities are higher on average for sequences originating from the same source than for sequences originating from different sources, and this property generalizes to unseen sequences of unseen sources. Moreover, correlation clustering yields clusters consistent with scanner labels. The complete source code of the algorithms and for reproducing the experiments is publicly available.

cs.LG↗

arXiv2026

LZn : Robust LoRa Frame Synchronization Under Frame Collisions and Ultra-Low SNR Conditions

LoRa has become a widely adopted wireless modulation scheme in LPWANs due to its low cost, long range, and minimal transmission power. However, collisions between frames of the same spreading factor -- common in dense LoRa deployments -- prevent conventional LoRa receivers from detecting and correctly decoding frames. Recent work has introduced methods to improve recovery, yet their detection stage degrades sharply under low signal-to-noise ratio (SNR) and high collision rates. In this work, we introduce LZn, a low-complexity synchronization scheme driven by a spectral intersection operation. Our method enables robust frame synchronization even under multiple packet overlaps or extremely low SNR conditions. We evaluate LZn on simulations and three independent, real-world LoRa datasets. LZn improves detection sensitivity by up to 10dB and increases detection probability by up to 1.54x. In real-world datasets, LZn improves decoding by 3.46x in the most challenging single-user scenario and up to 1.22x in collision scenarios compared to the second best collision-tolerant scheme (TnB). These results demonstrate that LZn substantially improves the frame recovery of LoRa receivers, while remaining compatible with real-time requirements.

cs.NI↗

arXiv2025

Scanning the IPv6 Internet Using Subnet-Router Anycast Probing

Identifying active IPv6 addresses is challenging. Various methods emerged to master the measurement challenge in this huge address space, including hitlists, new probing techniques, and AI-generated target lists. In this paper, we apply active Subnet-Router anycast (SRA) probing, a commonly unused method to explore the IPv6 address space. We compare our results with lists of active IPv6 nodes obtained from prior methods and with random probing. Our findings indicate that probing an SRA address reveals on average 10% more router IP addresses than random probing and is far less affected by ICMP rate limiting. Compared to targeting router addresses directly, SRA probing discovers 80% more addresses. We conclude that SRA probing is an important addition to the IPv6 measurement toolbox and may improve the stability of results significantly. We also find evidence that some active scans can cause harmful conditions in current IPv6 deployments, which we started to fix in collaboration with network operators.

cs.NI↗

arXiv2025

Waiting for QUIC: Passive Measurements to Understand QUIC Deployments

QUIC experiences a rapid adoption since its standardization in 2021, and hypergiants configure their infrastructure to optimize for QUIC performance. In this paper, we introduce a passive measurement method to study both the progressive rollout and individual hypergiant configurations during the last five years. By analyzing backscatter traffic of the UCSD network telescope, we are able to make the following observations. First, Meta, Google, and Cloudflare configure significantly different maximal retransmission numbers and timeouts. Second, we can identify different off-net deployments of hypergiants, using packet features, such as QUIC connection IDs, packet coalescence, and packet lengths. Third, we observe changing hypergiant deployment configurations during our different measurement periods. Fourth, connection IDs can allow further insights into load balancer deployments, such as the number of servers. We bolster our results using two orthogonal measurements: passive recording of QUIC flows and active probing.

cs.NI↗

arXiv2025

The SAP Cloud Infrastructure Dataset: A Reality Check of Scheduling and Placement of VMs in Cloud Computing

Allocating resources in a distributed environment is a fundamental challenge. In this paper, we analyze the scheduling and placement of virtual machines (VMs) in the cloud platform of SAP, the world's largest enterprise resource planning software vendor. Based on data from roughly 1,800 hypervisors and 48,000 VMs within a 30-day observation period, we highlight potential improvements for workload management. The data was measured through observability tooling that tracks resource usage and performance metrics across the entire infrastructure. In contrast to existing datasets, ours uniquely offers fine-grained time-series telemetry data of fully virtualized enterprise-level workloads from both long-running and memory-intensive SAP S/4HANA and diverse, general-purpose applications. Our key findings include several suboptimal scheduling situations, such as CPU resource contention exceeding 40%, CPU ready times of up to 220 seconds, significantly imbalanced compute hosts with a maximum CPU~utilization on intra-building block hosts of up to 99%, and overprovisioned CPU and memory resources resulting into over 80% of VMs using less than 70% of the provided resources. Bolstered by these findings, we derive requirements for the design and implementation of novel placement and scheduling algorithms and provide guidance to optimize resource allocations. We make the full dataset used in this study publicly available to enable data-driven evaluations of scheduling approaches for large-scale cloud infrastructures in future research.

cs.DC↗

arXiv2025

Forward to Hell? On the Potentials of Misusing Transparent DNS Forwarders in Reflective Amplification Attacks

The DNS infrastructure is infamous for facilitating reflective amplification attacks. Various countermeasures such as server shielding, access control, rate limiting, and protocol restrictions have been implemented. Still, the threat remains throughout the deployment of DNS servers. In this paper, we report on and evaluate the often unnoticed threat that derives from transparent DNS forwarders, a widely deployed, incompletely functional set of DNS components. Transparent DNS forwarders transfer DNS requests without rebuilding packets with correct source addresses. As such, transparent forwarders feed DNS requests into (mainly powerful and anycasted) open recursive resolvers, which thereby can be misused to participate unwillingly in distributed reflective amplification attacks. We show how transparent forwarders raise severe threats to the Internet infrastructure. They easily circumvent rate limiting and achieve an additional, scalable impact via the DNS anycast infrastructure. We empirically verify this scaling behavior up to a factor of 14. Transparent forwarders can also assist in bypassing firewall rules that protect recursive resolvers, making these shielded infrastructure entities part of the global DNS attack surface.

cs.CR↗

arXiv2025

A Detailed Measurement View on IPv6 Scanners and Their Adaption to BGP Signals

Scanners are daily visitors of public IPv4 hosts. Scanning IPv6 nodes successfully is still a challenge, which an increasing crowd of actors tries to master. In this paper, we analyze current IPv6 scanning under various network conditions. We observe scanner behavior during eleven months in four network telescopes, one of which is periodically reconfigured by changing BGP announcements. We analyze and classify the observed scanners w.r.t. their temporal behavior, their target, and network selection strategy, as well as their individual tools, fingerprints, and correlations across categories. We find that silent subnets of larger prefixes remain invisible, whereas BGP prefix announcements quickly attract attention by scanners. Based on our findings, we derive operational guidance on how to deploy network telescopes to increase visibility of IPv6 scanners.

cs.NI↗

arXiv2025

Duty-Cycling is Not Enough in Constrained IoT Networking: Revealing the Energy Savings of Dynamic Clock Scaling

Minimizing energy consumption of low-power wireless nodes is a persistent challenge from the constrained Internet of Things (IoT). In this paper, we start from the observation that constrained IoT devices have largely different hardware (im-)balances than full-scale machines. We find that the performance gap between MCU and network throughput on constrained devices enables minimal energy delay product (EDP) for IoT networking at largely reduced clock frequencies. We analyze the potentials by integrating dynamic voltage and frequency scaling (DVFS) into the RIOT IoT operating system and show that the DVFS reconfiguration overhead stays below the energy saved for a single, downscaled MAC operation. Backed by these findings, we systematically investigate how DVFS further improves energy-efficiency for common networking tasks -- in addition to duty-cycling. We measure IoT communication scenarios between real-world systems and analyze two MAC operating modes -- CSMA/CA and time slotting -- in combination with different CoAP transactions, payload sizes, as well as DTLS transport encryption. Our experiments reveal energy savings between 24% and 52% for MAC operations and up to 37% for encrypted CoAP communication. These results shall encourage research and system design work to integrate DVFS in future IoT devices for performing tasks at their optimal frequencies and thereby significantly extending battery lifetimes.

cs.NI↗

arXiv2025

CoRa: A Collision-Resistant LoRa Symbol Detector of Low Complexity

Long range communication with LoRa has become popular as it avoids the complexity of multi-hop communication at low cost and low energy consumption. LoRa is openly accessible, but its packets are particularly vulnerable to collisions due to long time on air in a shared band. This degrades communication performance. Existing techniques for demodulating LoRa symbols under collisions face challenges such as high computational complexity, reliance on accurate symbol boundary information, or error-prone peak detection methods. In this paper, we introduce CoRa , a symbol detector for demodulating LoRa symbols under severe collisions. CoRa employs a Bayesian classifier to accurately identify the true symbol amidst interference from other LoRa transmissions, leveraging empirically derived features from raw symbol data. Evaluations using real-world and simulated packet traces demonstrate that CoRa clearly outperforms the related state-of-the-art, i.e., up to 29% better decoding performance than TnB and 178% better than CIC. Compared to the LoRa baseline demodulator, CoRa magnifies the packet reception rate by up to 11.53x. CoRa offers a significant reduction in computational complexity compared to existing solutions by only adding a constant overhead to the baseline demodulator, while also eliminating the need for peak detection and accurately identifying colliding frames.

cs.NI↗

arXiv2025

Combating the Effects of Cyber-Psychosis: Using Object Security to Facilitate Critical Thinking

Humanity is currently facing an existential crisis about the nature of truth and reality driven by the availability of information online which overloads and overwhelms our cognitive capabilities, which we call Cyber-Psychosis. The results of this Cyber-Psychosis include the decline of critical thinking coupled with deceptive influences on the Internet which have become so prolific that they are challenging our ability to form a shared understanding of reality in either the digital or physical world. Fundamental to mending our fractured digital universe is establishing the ability to know where a digital object (i.e. a piece of information like text, audio, or video) came from, whether it was modified, what it is derived from, where it has been circulated, and what (if any) lifetime that information should have. Furthermore, we argue that on-by-default object security for genuine objects will provide the necessary grounding to support critical thinking and rational online behavior, even with the ubiquity of deceptive content. To this end, we propose that the Internet needs an object security service layer. This proposition may not be as distant as it may first seem. Through an examination of several venerable (and new) protocols, we show how pieces of this problem have already been addressed. While interdisciplinary research will be key to properly crafting the architectural changes needed, here we propose an approach for how we can already use fallow protections to begin turning the tide of this emerging Cyber-Psychosis today!

cs.HC↗

arXiv2024

A Call to Reconsider Certification Authority Authorization (CAA)

Certification Authority Authentication (CAA) is a safeguard against illegitimate certificate issuance. We show how shortcomings in CAA concepts and operational aspects undermine its effectiveness in preventing certificate misissuance. Our discussion reveals pitfalls and highlights best practices when designing security protocols based on DNS.

cs.CR↗

arXiv2024

ReACKed QUICer: Measuring the Performance of Instant Acknowledgments in QUIC Handshakes

In this paper, we present a detailed performance analysis of QUIC instant ACK, a standard-compliant approach to reduce waiting times during the QUIC connection setup in common CDN deployments. To understand the root causes of the performance properties, we combine numerical analysis and the emulation of eight QUIC implementations using the QUIC Interop Runner. Our experiments comprehensively cover packet loss and non-loss scenarios, different round trip times, and TLS certificate sizes. To clarify instant ACK deployments in the wild, we conduct active measurements of 1M popular domain names. For almost all domain names under control of Cloudflare, Cloudflare uses instant ACK, which in fact improves performance. We also find, however, that instant ACK may lead to unnecessary retransmissions or longer waiting times under some network conditions, raising awareness of drawbacks of instant ACK in the future.

cs.NI↗

arXiv2024

The Age of DDoScovery: An Empirical Comparison of Industry and Academic DDoS Assessments

Motivated by the impressive but diffuse scope of DDoS research and reporting, we undertake a multistakeholder (joint industry-academic) analysis to seek convergence across the best available macroscopic views of the relative trends in two dominant classes of attacks - direct-path attacks and reflection-amplification attacks. We first analyze 24 industry reports to extract trends and (in)consistencies across observations by commercial stakeholders in 2022. We then analyze ten data sets spanning industry and academic sources, across four years (2019-2023), to find and explain discrepancies based on data sources, vantage points, methods, and parameters. Our method includes a new approach: we share an aggregated list of DDoS targets with industry players who return the results of joining this list with their proprietary data sources to reveal gaps in visibility of the academic data sources. We use academic data sources to explore an industry-reported relative drop in spoofed reflection-amplification attacks in 2021-2022. Our study illustrates the value, but also the challenge, in independent validation of security-related properties of Internet infrastructure. Finally, we reflect on opportunities to facilitate greater common understanding of the DDoS landscape. We hope our results inform not only future academic and industry pursuits but also emerging policy efforts to reduce systemic Internet security vulnerabilities.

cs.CR↗

arXiv2024

From the Beginning: Key Transitions in the First 15 Years of DNSSEC

When the global rollout of the DNS Security Extensions (DNSSEC) began in 2005, a first-of-its-kind trial started: The complexity of a core Internet protocol was magnified in favor of better security for the overall Internet. Thereby, the scale of the loosely-federated delegation in DNS became an unprecedented cryptographic key management challenge. Though fundamental for current and future operational success, our community lacks a clear notion of how to empirically evaluate the process of securely transitioning keys. In this paper, we propose two building blocks to formally characterize and assess key transitions. First, the anatomy of key transitions, i.e., measurable and well-defined properties of key changes; and second, a novel classification model based on this anatomy for describing key transition practices in abstract terms. This abstraction allows for classifying operational behavior. We apply our proposed transition anatomy and transition classes to describe the global DNSSEC deployment. Specifically, we use measurements from the first 15 years of the DNSSEC rollout to detect and understand which key transitions have been used to what degree and which rates of errors and warnings occurred. In contrast to prior work, we consider all possible transitions and not only 1:1 key rollovers. Our results show measurable gaps between prescribed key management processes and key transitions in the wild. We also find evidence that such noncompliant transitions are needed in operations.

cs.CR↗