An Adversarial Evaluation of Network Signaling and Control Mechanisms - Information Security and Cryptology-ICISC 2010 - page 259

5.3 Evaluation under Normal Operation
To establish a baseline for our experimental results, we first measured the latency and
control efficiency of the mechanisms without considering a global adversary. For test
topologies of 20,000 nodes, each test instance was measured for 600 seconds of sim-
ulation time. Each test instance contained an alert notification event and the same size
(40KB) of control messages were propagated to all participants. The size is derived
from the average size of Microsoft patches [7]. SN network, implemented for central-
ized mechanism, was configured with different cluster sizes and k-redundancy was fixed
to 2 for all test cases. DHT network was used for the distributed control mechanism and
its successor list size was set to five. Hybrid network inherited parameter from both
systems.
Latency Measurement. The latency results are shown in Figure 1(a). On the X-axis,
from the left to right, we have results for the SN network, Hybrid network, and DHT net-
work. The SN network and hybrid network are configured with different cluster sizes.
For each bar, the dark portion represents the average time for notification and the gray
part represents the time until 99% of the nodes are notified. Large variance was ob-
served for the latency results of SN network. With different cluster sizes, mean latency
ranged from 35 to 230 seconds. Populated sub-networks (lower-layer) accounted for
delays in the case of large cluster size (5,000). For smaller cluster size (50), having
more super-nodes made the upper-layer network the bottleneck. In contrast, for hybrid
network, we observed small variance in latency and less delays. This is because the
secondary, distributed channels masked the errors or failures of the primary channel.
Mean latencies ranged only from 33 to 51 seconds. Not having a secondary channel,
the DHT network took longer than the worst case of hybrid network. However, the
latency remained relatively low (61 seconds).
Control Cost Measurement. Figure 1(b) represents the control cost of different mech-
anisms to propagate alert messages of the same size (40KB). SN network, thanks to
its simple implementation, required the least amount of packets to maintain its control
channel and signaling operations. However, in the case of larger cluster size (5,000),
many number of network errors and retries introduced rapid increase in cost. DHT net-
work required larger amount of control traffic to maintain its distributed data structures.
Hybrid network with large cluster size (5,000) required even more and was the most
expensive control channel due to excessive numbers of network errors from its primary
channel. However, with the proper choice of cluster size, hybrid network could spare
its control cost to become a more efficient solution than the DHT network.
5.4 Evaluation of Adversarial Scenarios
In adversarial scenarios, we again used the topology of 20,000 nodes with longer simu-
lation duration of 1,200 seconds to carefully observe the system's reaction to malicious
activities. Nodes that could not be notified within this time duration were regarded as
a delivery failure. Two different cluster sizes were plotted for SN network and hybrid
network - 50 to represent a small cluster size and 5,000 for large cluster size. During the
experiment, the alert propagation event was triggered at 100 seconds of the simulation
time and the attack from the adversary was launched five seconds prior to the event.