arXiv subjects

Ricky K. P. Mok

Publications and source records attributed to Ricky K. P. Mok.

4 recordsLinked to original sources

arXiv2026

A Multi-Cloud View of Internet Background Radiation

As services are increasingly centralized in public clouds, understanding the nature of Internet Background Radiation (IBR) hitting these particular environments is an important part of understanding their overall security posture. Classical network telescopes, long the cornerstone of IBR research, face hurdles here: their surface area is shrinking, and their well-known address ranges are easily avoided. We present a multi-cloud view of IBR in this paper. We deploy a passive, distributed network telescope with 336 IPs across five major cloud providers. We compare traffic from our cloud telescope with data from two classical telescopes, a large well-known (/9 + /10) and a small unknown /16, to analyze observational biases. To enable a fair comparison across very different telescope sizes, we tune a scan detection algorithm to determine appropriate thresholds. Our findings reveal that IBR in the cloud is strongly provider-dependent rather than geography-dependent, highlighting the necessity of multi-cloud deployments for comprehensive visibility of IBR in the cloud. Our cloud telescope also captures a distinct set of scanners, confirming that scanning activity is not uniform across the IPv4 space, and we confirm that small, distributed telescopes are ill-suited for observing random events like DDoS backscatter. Our work underscores that monitoring must evolve beyond classical telescopes to include diverse, multi-cloud vantage points to accurately capture IBR.

cs.NI↗

arXiv2025

Unveiling IPv6 Scanning Dynamics: A Longitudinal Study Using Large Scale Proactive and Passive IPv6 Telescopes

We introduce new tools and vantage points to develop and integrate proactive techniques to attract IPv6 scan traffic, thus enabling its analysis. By deploying the largest-ever IPv6 proactive telescope in a production ISP network, we collected over 600M packets of unsolicited traffic from 1.9k Autonomous Systems in 10 months. We characterized the sources of unsolicited traffic, evaluated the effectiveness of five major features across the network stack, and inferred scanners' sources of target addresses and their strategies.

cs.NI↗

arXiv2020

QFlow: A Learning Approach to High QoE Video Streaming at the Wireless Edge

The predominant use of wireless access networks is for media streaming applications, which are only gaining popularity as ever more devices become available for this purpose. However, current access networks treat all packets identically, and lack the agility to determine which clients are most in need of service at a given time. Software reconfigurability of networking devices has seen wide adoption, and this in turn implies that agile control policies can be now instantiated on access networks. The goal of this work is to design, develop and demonstrate QFlow, a learning approach to create a value chain from the application on one side, to algorithms operating over reconfigurable infrastructure on the other, so that applications are able to obtain necessary resources for optimal performance. Using YouTube video streaming as an example, we illustrate how QFlow is able to adaptively provide such resources and attain a high QoE for all clients at a wireless access point.

cs.LG↗

arXiv2019

Scalable Traffic Engineering for Higher Throughput in Heavily-loaded Software Defined Networks

Existing traffic engineering (TE) solutions performs well for software defined network (SDN) in average cases. However, during peak hours, bursty traffic spikes are challenging to handle, because it is difficult to react in time and guarantee high performance even after failures with limited flow entries. Instead of leaving some capacity empty to guarantee no congestion happens due to traffic rerouting after failures or path updating after demand or topology changes, we decide to make full use of the network capacity to satisfy the demands for heavily-loaded peak hours. The TE system also needs to react to failures quickly and utilize the priority queue to guarantee the transmission of loss and delay sensitive traffic. We propose TED, a scalable TE system that can guarantee high throughput in peak hours. TED can quickly compute a group of maximum number of edge-disjoint paths for each ingress-egress switch pair. We design two methods to select paths under the flow entry limit. We then input the selected paths to our TE to minimize the maximum link utilization. In case of large traffic matrix making the maximum link utilization larger than 1, we input the utilization and the traffic matrix to the optimization of maximizing overall throughput under a new constrain. Thus we obtain a realistic traffic matrix, which has the maximum overall throughput and guarantees no traffic starvation for each switch pair. Experiments show that TED has much better performance for heavily-loaded SDN and has 10% higher probability to satisfy all (> 99.99%) the traffic after a single link failure for G-Scale topology than Smore under the same flow entry limit.

cs.NI↗