Network management and security is currently one of the most vibrant research areas, among which, research on detecting and identifying anomalies has attracted a lot of interest. Researchers are still struggling to find an effective and lightweight method for anomaly detection purpose. In this paper, we propose a simple, robust method that detects network anomalous traffic data based on flow monitoring. Our method works based on monitoring the four predefined metrics that capture the flow statistics of the network. In order to prove the power of the new method, we did build an application that detects network anomalies using our method. And the result of the experiments proves that by using the four simple metrics from the flow data, we do not only effectively detect but can also identify the network traffic anomalies.
In this paper, we propose a novel approach, called SENATUS, for joint traffic anomaly detection and root-cause analysis. Inspired from the concept of a senate, the key idea of the proposed approach is divided into three stages: election, voting and decision. At the election stage, a small number of \nop{traffic flow sets (termed as senator flows)}senator flows are chosen\nop{, which are used} to represent approximately the total (usually huge) set of traffic flows. In the voting stage, anomaly detection is applied on the senator flows and the detected anomalies are correlated to identify the m…
One of the central problems in massive Internet of Things (IoT) deployments is the monitoring of the status of a massive number of links. The problem is aggravated by the irregularity of the traffic transmitted over the link, as the traffic intermittency can be disguised as a link failure and vice versa. In this work we present a traffic model for IoT devices running quasi-periodic applications and we present both supervised and unsupervised machine learning methods for monitoring the network performance of IoT deployments with quasi-periodic reporting, such as smart-metering, environmental mo…
Network performance monitoring holds a pivotal role in improving the overall network performance. It is essential to monitor the traffic statistics at Internet eXchange Points (IXPs) to optimize the traffic flows. The existing monitoring system either lacks usability or programmability. We present a Software Defined Networking (SDN) enabled and OpenFlow (OF) compatible network performance monitoring system (SDX-Manager) to improve the usability or programmability of IXP simultaneously. The proposed system integrates traditional IXP-Manager with the SDN controller and Grafana to better visualiz…
Internet users and service providers do not often know when traffic is being watched but desire a way to determine when, where, and by whom. We present NOISE, the Nonce Observatory for Inverse Surveillance of Eavesdroppers, a method and system that detects monitoring by disseminating nonces - unique, pseudorandom values - in traffic and seeing if they are acted upon unexpectedly, indicating that the nonce-laden traffic is being monitored. Specifically, we embed 64-bit nonces innocuously into IPv6 addresses and disseminate these nonces Internet-wide using a modified traceroute-like tool that ma…
This work presents P4TE, an in-band traffic monitoring, load-aware packet forwarding, and flow rate controlling mechanism for traffic engineering in fat-tree topology-based data center networks using PISA switches. It achieves sub-RTT reaction time to change in network conditions, improved flow completion time, and balanced link utilization. Unlike the classical probe-based monitoring approach, P4TE uses an in-band monitoring approach to identify traffic events in the data plane. Based on these events, it re-adjusts the priorities of the paths. It uses a heuristic-based load-aware forwarding p…
The last two decades witnessed tremendous advances in the Information and Communications Technologies. Beside improvements in computational power and storage capacity, communication networks carry nowadays an amount of data which was not envisaged only few years ago. Together with their pervasiveness, network complexity increased at the same pace, leaving operators and researchers with few instruments to understand what happens in the networks, and, on the global scale, on the Internet. Fortunately, recent advances in data science and machine learning come to the rescue of network analysts, an…
The real-time traffic monitoring is a fundamental mission in a smart city to understand traffic conditions and avoid dangerous incidents. In this paper, we propose a reliable and efficient traffic monitoring system that integrates blockchain and the Internet of vehicles technologies effectively. It can crowdsource its tasks of traffic information collection to vehicles that run on the road instead of installing cameras in every corner. First, we design a lightweight blockchain-based information trading framework to model the interactions between traffic administration and vehicles. It guarante…
Technische Universität Chemnitz（开姆尼茨工业大学）；Duy Tan University（维新大学）
Software-Defined Networking (SDN) introduces a centralized network control and management by separating the data plane from the control plane which facilitates traffic flow monitoring, security analysis and policy formulation. However, it is challenging to choose a proper degree of traffic flow handling granularity while proactively protecting forwarding devices from getting overloaded. In this paper, we propose a novel traffic flow matching control framework called Q-DATA that applies reinforcement learning in order to enhance the traffic flow monitoring performance in SDN based networks and …
In this paper, we propose a novel algorithm to detect anomaly in terms of Key Parameter Indicators (KPI)s over live cellular networks based on the combination of Recurrent Neural Networks (RNN), and Convolutional Neural Networks (CNN), as Recurrent Convolutional Neural Networks (R-CNN). CNN models the spatial correlations and information, whereas, RNN models the temporal correlations and information. In this paper, the studied cellular network consists of 2G, 3G, 4G, and 4.5G technologies, and the KPIs include Voice and data traffic of the cells. The data and voice traffic are extremely import…
Network Traffic Monitoring and Analysis (NTMA) represents a key component for network management, especially to guarantee the correct operation of large-scale networks such as the Internet. As the complexity of Internet services and the volume of traffic continue to increase, it becomes difficult to design scalable NTMA applications. Applications such as traffic classification and policing require real-time and scalable approaches. Anomaly detection and security mechanisms require to quickly identify and react to unpredictable events while processing millions of heterogeneous events. At last, …
The Alan Turing Institute（艾伦·图灵研究所）；University of Bristol（布里斯托大学）
Future Connected and Automated Vehicles (CAV), and more generally ITS, will form a highly interconnected system. Such a paradigm is referred to as the Internet of Vehicles (herein Internet of CAVs) and is a prerequisite to orchestrate traffic flows in cities. For optimal decision making and supervision, traffic centres will have access to suitably anonymized CAV mobility information. Safe and secure operations will then be contingent on early detection of anomalies. In this paper, a novel unsupervised learning model based on deep autoencoder is proposed to detect the self-reported location ano…
A wide variety of sensor technologies are recently being adopted for traffic monitoring applications. Since most of these technologies rely on wired infrastructure, the installation and maintenance costs limit the deployment of the traffic monitoring systems. In this paper, we introduce a traffic monitoring approach that exploits physical layer samples in vehicular communications processed by machine learning techniques. We verify the feasibility of our approach with extensive simulations and real-world experiments. First, we simulate wireless channels under realistic traffic conditions using …
Despite the robust structure of the Internet, it is still susceptible to disruptive routing updates that prevent network traffic from reaching its destination. Our research shows that BGP announcements that are associated with disruptive updates tend to occur in groups of relatively high frequency, followed by periods of infrequent activity. We hypothesize that we may use these bursty characteristics to detect anomalous routing incidents. In this work, we use manually verified ground truth metadata and volume of announcements as a baseline measure, and propose a burstiness measure that detects…
The connected vehicle (CV) data could potentially revolutionize the traffic monitoring landscape as a new source of CV data that are collected exclusively from original equipment manufactures (OEMs) have emerged in the commercial market in recent years. Compared to existing CV data that are used by agencies, the new-generation of CV data have certain advantages including nearly ubiquitous coverage, high temporal resolution, high spatial accuracy, and enriched vehicle telematics data (e.g., hard braking events). This paper proposed a traffic profiling framework that target vehicle-level perform…
MamNet: A Novel Hybrid Model for Time-Series Forecasting and Frequency Pattern Analysis in Network Traffic
Columbia University（哥伦比亚大学）；University of California, Irvine（加利福尼亚大学欧文分校）；Washington University in St. Louis（圣路易斯华盛顿大学）；University of Southern California（南加利福尼亚大学）；Meta Platform Inc.（Meta平台公司）；Northeastern University（东北大学）
VINEVI: A Virtualized Network Vision Architecture for Smart Monitoring of Heterogeneous Applications and Infrastructures
Institute of Exact and Technological Sciences (IEP), Federal University of Viçosa（维索萨联邦大学精确与技术科学研究所）；Faculty of Computing (FACOM), Federal University of Uberlândia（Uberlândia联邦大学计算学院）
In this paper, we propose a destination-aware adaptive traffic flow rule aggregation (DATA) mechanism for facilitating traffic flow monitoring in SDN-based networks. This method adapts the number of flow table entries in SDN switches according to the level of detail of traffic flow information that other mechanisms (e.g. for traffic engineering, traffic monitoring, intrusion detection) require. It also prevents performance degradation of the SDN switches by keeping the number of flow table entries well below a critical level. This level is not preset as a hard threshold but learned during oper…
The University of New South Wales（新南威尔士大学）；School of Electrical Engineering and Telecommunications（电气与电信工程学院）
Smart homes, enterprises, and cities are increasingly being equipped with a plethora of Internet of Things (IoT), ranging from smart-lights to security cameras. While IoT networks have the potential to benefit our lives, they create privacy and security challenges not seen with traditional IT networks. Due to the lack of visibility, operators of such smart environments are not often aware of their IoT assets, let alone whether each IoT device is functioning properly safe from cyber-attacks. This thesis is the culmination of our efforts to develop techniques to profile the network behavioral pa…
