Continuous monitoring of path performance metrics, such as latency or utilization, has become increasingly important as network operators and webservices use newer network technologies. In particular, the growing popularity of software-defined networks for data centers and globally distributed webservices, require path performance metrics in order to fully utilize their full potential. For instance, software-defined networks allow for network operators to reactively adapt to changing workloads when they have access to up-to-date link utilization information. However, current solutions for monitoring data centers require special instrumentation of the network or impose significant measurement overhead. Similarly, webservices that are globally distributed may monitor a large number of Internet paths to its clients to correctly guide its users to data centers which leads to a large measurement cost due to the usage of active probes.

This dissertation describes systems that focus on lowering measurement cost in the following scenarios: (1) utilization monitoring in software-defined networks, (2) latency measurements in software-defined networks, and (3) multi-tenant data centers used by webservices. First, I will present \flowsense, a utilization monitoring system for software-defined networks that allows for zero-cost utilization monitoring by using control messages to allow the network inform the system of changes. Second, I present \slam, a framework for monitoring latency across any set of switches in a software-defined network by using specific probe messages that trigger control messages which allows \slam to estimate the latency distribution of the path. Finally, I will present \sims, a shared Internet monitoring service that enables websevices to share their measurement information, from both passive and active probing, allowing for the lowering of both measurement cost to the webservices and the aggregate bandwidth needed for the measurements.

In today's world, more and more people are managing every aspect of their lives over the Internet. As a result, the study of Internet traffic, which is undergoing constant evolution as new technologies emerge, has attracted much attention from the research community. In this dissertation, we present a three-pronged approach to help ISPs and network administrators: a) gain insight about the applications that generate traffic in their networks, b) understand the Web browsing behaviors of their users, and c) detect in a timely fashion when external malicious entities seek to compromise their websites.

The first component of our approach is SubFlow, a Machine Learning-based tool that classifies traffic flows into classes of applications that generate them, for example P2P or Web. The key novelty of SubFlow is its ability to learn the characteristics of the traffic from each application class in isolation while traditional approaches simply try to assign flows to predefined categories. This allows SubFlow to exhibit very high classification accuracy even when new applications emerge.

The second component is ReSurf, a tool to reconstruct users' web-surfing activities from Web traffic. ReSurf enables the separation of users' intentional web-browsing (such as the click user makes) from the traffic automatically generated when the website is rendered. ReSurf, then, can be an effective method to study the browsing behaviors of users and gain insights into the evolution of modern Web traffic, which accounts for about 80% of Internet traffic.

The last component of our approach is Scanner Hunter, an algorithm to detect HTTP Scanners, external entities that selectively probe websites for vulnerabilities that may be exploited in subsequent intrusion attempts. Our algorithm is developed in response to the fact that HTTP scanners have not received much attention despite the high risk and danger they pose. Scanner Hunter utilizes a novel combination of graph-mining approaches to expose the community structure of scanners. Using Scanner Hunter, we conduct the first extensive study of scanners in the wild during a half-year period, which we also provide novel insight on this little-studied emerging phenomenon.

Applications and the systems that support them are becoming increasingly more

complex, more powerful and more ubiquitous. Applications ranging from traffic sensing

to online retailers to social networks are part of our every day lives. People have begun

to rely on these systems and expect them to perform their operations in a timely fashion.

Providing a quick response is critical in some applications and has a significant effect in

others. The complexity of modern of applications is not the only challenge of meeting user

expectations, providing a personalized experience requires the processing of huge amounts

of raw data. Although generalized schedulers have shown good results for speeding up

many systems, they are not well suited and cannot provide the most efficient solution in

many situations.

In this dissertation, I design, build and evaluate several different specialized

scheduling system for speeding up and providing quality of service across a range of different

systems. I present RG-EDF, Misco and MiscoRT and Cacheflow. Starting with low

level system, RG-EDF is an efficient storage scheduler for sensor devices equipped with

flash memories. Misco is a distributed data processing system and application framework

for mobile smart-phones, MiscoRT is its failure aware, real-time, application scheduler.

Finally,Cacheflow is a system for improving client response times in internet scale content

delivery networks aimed at social networking sites. Through experimental evaluations,

I show that my systems provide a significant performance improvement over generalized

scheduling mechanisms and existing approaches.

Despite web access on mobile devices becoming commonplace, users continue to experience poor web performance on these devices. Traditional approaches for improving web performance face an uphill battle due to the fundamentally conflicting trends in user expectations of lower load times and richer web content. Embracing the reality that page load times will continue to be higher than user tolerance limits for the foreseeable future, we ask: How can we deliver the best possible user experience?

To establish the positive correlation between rich webpage content and high webpage load times, we perform the first known measurement-driven study of the complexity of web pages and its impact on performance. To mirror a client-side view, we use browser-based measurements of over 2000 websites from 4 geo-diverse vantage points over a 3 week period. We find that we can accurately predict page load times using a handful of metrics, with the number of resources requested (content richness) being the most critical factor.

Given the rising amount of webpage content and webpage load time, strategic reprioritization of content offers a parallel avenue to better the user's page load experience. To this end, we present Klotski, a system that prioritizes the content most relevant to a user's preferences. In designing Klotski, we address several challenges in: (1) accounting for inter-resource dependencies on a page; (2) enabling fast selection and load time estimation for the subset of resources to be prioritized; and (3) developing a practical implementation that requires no changes to websites. Across a range of user preference criteria, Klotski can significantly improve the user experience relative to native websites.

Finally, we investigate the potential to further improve the user experience over that offered by Klotski by pushing all content on a web page to any client attempting to load a page, but find that this offers little to no improvement in page load times due to limited capabilities of the client to consume the pushed content. This result reinforces Klotski's focus on limited resource reprioritization for fixed time period goals.

Security and privacy in distributed systems are long-standing hard problems. On the one hand, solutions for anonymous communications over the Internet are either vulnerable to traffic analysis or offer poor performance. On the other hand, compromises within enterprises remain hard to track down due to complex dependencies between hosts, applications, and their data.

In this thesis, I develop two solutions to improve the anonymity vs. performance trade-off for communications over the Internet. LASTor improves performance of Tor by modifying path selection algorithm and it also mitigate traffic analysis attack by detecting common autonomous system (AS) across the entry and exit segments of a circuit and avoiding using those paths. LASTor reduces median latencies of visiting top 200 websites by 25% while the false negative rate of not detecting a potential snooping AS from 57% to 11%. Next solution, Innominate, is a new framework for anonymous online communication that both offers traffic analysis resistant strong anonymity and scalable performance. Innominate adopts relay-based technique for low latency communication, however instead of a single client servers as a relay, group relay is used to provide strong anonymity.

As of security inside enterprises, I develop DeltaTrack, the first enterprise attack

forensics system that leverages differential dependency tracking to automate the pruning of irrelevant nodes and edges in the backtracking graph. DeltaTrack continuously monitors system call events from all hosts and summarizes their common execution behaviors in a reference model. Then, the reference model is leveraged to prune away frequently observed events across many hosts since they are unlikely to be relevant to the intrusion. DeltaTrack can reduce the number of nodes and edges of the backtracking graph by up to 131x and 512x, respectively, while maintaining its accuracy.

Over the last decade there has been a proliferation of distributed storage systems. These systems handle various types of data (e.g., text, photos, documents, files) in a variety of settings (e.g., enterprise, cloud, mobile). Typically, each system’s design is optimized towards a specific workload and setting. Yet, when designing new applications, developers often face the onerous task of choosing one of these existing solutions to store their workload’s data. This choice can be difficult for two reasons: (1) existing systems may not offer all of the features required by the new application and the development effort to extend an existing system’s implementation can be prohibitive, and (2) choosing a system design which cost-effectively meets a workload’s performance goal(s) is non-trivial and an incorrect choice may significantly inflate the cost to achieve the desired performance.

In this dissertation I design, build, and evaluate two distributed storage systems which, via their flexible implementations, offer improved ease of use and reduced development overhead when implementing data-centric applications.

First, I present Simba, a cloud-based data synchronization service which reduces development complexity of mobile apps. It improves upon existing systems which offer disjoint table- or object-only syncing with eventual consistency. Simba is built around a novel data abstraction that unifies a tabular and object data model, and allows apps to choose from a set of distributed consistency schemes. Mobile apps written to this abstraction can effortlessly sync data with the cloud and other mobile devices while benefiting from end-to-end data consistency.

Second, I present Lego, a modular emulator of distributed object stores. Lego is a tool which aids in the selection of the system design that can most cost-effectively satisfy a workload’s performance goals. It enables developers to construct, deploy, and evaluate the performance of candidate object store designs in the target setting. Lego’s modular architecture enables rapid prototyping, allowing for any object store design to be instantiated as a collection of modules. Since different object store designs often share similarities, this feature enables reuse of code across system implementations, thus significantly reducing development effort.

Online social networks (OSNs) have become a popular new vector for distribution of malware and spam, which we refer to as socware . Unlike email spam - which is mostly sent by spammers directly to intended victims - socware leverages in great part on the "word-of- mouth" propagation of online social networks.

In the dissertation, we study socware through analysis of 173 billions posts collected from 16K users of MyPageKeeper, a Facebook application created by ourselves, for ten months. We uncover not only the ecosystem of socware, but also the incentive mechanisms used by socware to help itself spread through Facebook.

We observe the emergence of AppNets, groups of applications that collaborate in enabling cascades. We found that 44% of cascades are enabled by Facebook applications, i.e., the posts are made by applications that have been installed by luring users. Moreover, we notice that 37% of cascades contains URLs that direct users back to Facebook, either Facebook application installation pages or cooperate pages which want to get an "Like" endorsements.

During the analysis of the provenance of socware posts, we find that more than half of socware cascades were propagate by users clicking Like/Share on websites outside of Facebook, or by users manually posting spam. It not only shows the carelessness of users in online social networks and the importance of user education to eliminate socware from Facebook but also raise our interest about the incentives mechanism used by socware distributors.

Our work provides the first systematic taxonomy of the psychological techniques that socware uses to lure users. We show that socware uses several incentive mechanisms which we group into financial and social incentives. A striking findings is that, much like biological viruses, the most effective socware cascades use multiple incentives to get around our diversity in susceptibility to distinct incentives. Our observations, supported with simulations, show that it an effective strategy to distribute socware in online social networks. Last but not least, we show the very different characteristics of the two generations of online malicious behavior: socware and spam emails. For example, most of spam email focus on earning commission by selling cheap pharmaceutical or counterfeits, socware focus on phishing users' personal information and ask users to complete surveys. Our work is one of the first studies focusing on measuring and modeling socware and the mechanisms, and it can help us better understand its intention and propagation mechanisms that can lead ultimately to stopping it.