8 results
Now showing1 - 8 of 8
- Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: with files , Simplifying distributed application deployment at the edge through software-defined overlay networks(Elsevier, 2025-10-01); ; ; ; The need for low latency, bandwidth efficiency, and privacy has driven the deployment of distributed applications to the network edge. However, edge environments introduce concrete challenges such as limited infrastructure control, constrained connectivity due to NAT or firewalls, and the heterogeneity of devices and network conditions. This paper introduces a software-defined overlay networking (SDON) middleware that addresses these issues by simplifying the development and deployment of edge applications through centralized control and dynamic overlay management. SDON allows applications to define high-level requirements, such as node and link characteristics and the network topology. These requirements are translated into device-specific configurations and enforced across suitable edge devices. We implemented our SDON middleware as a fully functional software and evaluated it in two edge computing use cases: i) routing for video streaming across middleboxed edge devices and ii) computation offloading on heterogeneous edge devices. Our results show that deployments via SDON, with centrally enforced optimizations, improve application performance by reducing mean streaming latency by 20 % and computation times by 22 %.Publicationtype: Journal Article14 16 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Enhancing privacy through unlinkable data sharing with user-in-the-loop access controlIn our information-driven society, the volume of data generated by individuals has grown significantly. Protecting the privacy of individuals is becoming more challenging, as this data can reveal detailed insights into personal preferences and behavior. To address this challenge, we introduce a user-centric, privacy-preserving data-sharing solution that leverages a central data storage service, hereafter referred to as the data intermediary. By integrating local differential privacy with user-in-the-Ioop access control, our system enables data providers to securely and unlinkably store their data at the intermediary. Data consumers can localize and request data via the intermediary. The data providers are included in access decisions without disclosing their identity nor by enabling the linking of their data. We evaluated our approach using theoretical analysis and simulations. Our findings indicate that our system achieves c-privacy and safeguards data providers against external and internal attackers, malicious data consumers, and an honest-but-curious intermediary. Moreover, our method reduces the message overhead for data discovery in our system by more than half compared to existing approaches.Publicationtype: Conference Paper12 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Unlinkable data sharing with dynamic access control(Association for Computing Machinery (ACM), 2025-03); ; In an increasingly information-driven society, the volume of digital footprints left by individuals has surged significantly. Safeguarding the anonymity of data generated by computing devices is becoming more challenging as these offer deep insights into personal behaviors. We propose a user-centric and privacy-preserving data space for unlinkable data sharing based on a central intermediary. By integrating differential privacy techniques with fine-grained access control, our system allows data providers to store their data confidentially and unlinkable at the intermediary. Data consumers can then locate and request data via this intermediary, ensuring that data providers remain informed without revealing the origin of the data. Additionally, the intermediary facilitates continuous data sharing, requiring only a single data upload. Our approach is designed to protect data providers from both external and internal attackers, as well as from an honest-but-curious intermediary.Publicationtype: Conference Paper12 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , A software-defined overlay networking middleware for a simplified deployment of distributed application at the edge(Association for Computing Machinery (ACM), 2025-03); ; ; ; The demand for low latency, bandwidth efficiency, and privacy has driven distributed applications to the network edge, where heterogeneous, and untrusted, and uncontrolled networks pose challenges. This paper presents a software-defined overlay networking (SDON) middleware that simplifies application development through centralized control of edge resources while addressing many challenges prevalent at the edge. SDON enables applications to specify high-level requirements, such as service placement and communication goals. These are automatically translated into device-specific configurations and deployed on appropriate edge resources. The middleware is implemented as fully functional software, published as open-source, and will be evaluated in multiple edge computing use cases, to demonstrate its application optimization potential.Publicationtype: Conference Paper20 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Adaption via selection: on client selection to counter concept drift in federated learningFederated Learning is a Machine Learning paradigm in which multiple devices jointly train a shared model without the need to share their local data. Most Federated Learning approaches assume that the data remains static. However, this assumption is unrealistic in real-world scenarios where data may change over time. In this paper we study the impact of concept drift on Federated Learning models with heterogeneous data distribution. Client selection directly impacts the model’s performance, and we observe that the local loss of clients under concept drift deviates. Nevertheless, most applications select clients randomly for each training round. Our main contribution therefore is a probabilistic client selection algorithm that introduces a bias towards clients with higher local loss in order to counter concept drift. Extensive evaluations show that our algorithm recovers a drop in accuracy incurred by concept drift up to five times faster than random sampling while retaining competitive performance.Publicationtype: Conference Paper73 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Enhancing privacy through unlinkable data sharing with User-in-the-Loop access controlIn our information-driven society, the volume of data generated by individuals has grown significantly. Protecting the privacy of individuals is becoming more challenging, as this data can reveal detailed insights into personal preferences and behavior. To address this challenge, we introduce a user-centric, privacy-preserving data-sharing solution that leverages a central data storage service, hereafter referred to as the data intermediary. By integrating local differential privacy with user-in-the-Ioop access control, our system enables data providers to securely and unlinkably store their data at the intermediary. Data consumers can localize and request data via the intermediary. The data providers are included in access decisions without disclosing their identity nor by enabling the linking of their data. We evaluated our approach using theoretical analysis and simulations. Our findings indicate that our system achieves c-privacy and safeguards data providers against external and internal attackers, malicious data consumers, and an honest-but-curious intermediary. Moreover, our method reduces the message overhead for data discovery in our system by more than half compared to existing approaches.Publicationtype: Conference Paper41 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Data poisoning detection in federated learning(Association for Computing Machinery (ACM), 2024-04-08); ; ; ; Federated Learning (FL) is an emerging machine learning paradigm in which multiple clients collaboratively train a model without exposing their local datasets. Under this paradigm, numerous clients share the responsibility of model training instead of having a centralized server. However, this enables clients of an FL system to send malicious model updates. An adversary could, e.g., train the local model with incorrect data to insert an adversary-defined objective into the model or cause a severe drop in accuracy.We show that it is possible for a small number of adversaries to considerably reduce the model performance after only one round of FL. Using Shapley Additive Explanation (SHAP) values as indicators, we propose a detection algorithm that pairs SHAP values and Support Vector Machines (SVMs) to derive classifiers that can effectively differentiate malicious from honest clients.Publicationtype: Conference Paper52 - Some of the metrics are blocked by yourconsent settings
Item type:Publication, Access status: without files , Towards efficient reconstruction of attacker lateral movement(Association for Computing Machinery (ACM), 2019); ; ; ; Organization and government networks are a target of Advanced Persistent Threats (APTs), i.e., stealthy attackers that infiltrate networks slowly and usually stay undetected for long periods of time. After an attack has been discovered, security administrators have to manually determine which hosts were compromised to clean and restore them. For that, they have to analyze a large number of hosts. In this paper, we propose an approach to efficiently reconstruct the lateral movement of attackers from a given set of indicators of compromise (IoCs) that can help security administrators to identify and prioritize potentially compromised hosts. To reconstruct attacker paths in a network, we link hosts with IoCs via two methods: k-shortest-paths and biased random walks. To evaluate the accuracy of these approaches in reconstructing attack paths, we introduce three models of attackers that differ in their network knowledge. Our results indicate that we can approximate the lateral movement of the three proposed attacker models, even when the attacker significantly deviates from them. For insider attackers that deviate up to 75% from our models, the method based on k-shortest-paths achieves a true positive rate of 88% and can significantly narrow down the set of nodes to analyse to 5% of all network hosts.Publicationtype: Conference Paper30