We present the Network Traffic Generator (NTG), a framework for perturbing recorded network traffic with the purpose of generating diverse but realistic background traffic for network simulation and what-if analysis in enterprise environments. The framework preserves many characteristics of the original traffic recorded in an enterprise, as well as sequences of network activities. Using the proposed framework, the original traffic flows are profiled using 200 cross-protocol features. The traffic is aggregated into flows of packets between IP pairs and clustered into groups of similar network activities. Sequences of network activities are then extracted. We examined two methods for extracting sequences of activities: a Markov model and a neural language model. Finally, new traffic is generated using the extracted model. We developed a prototype of the framework and conducted extensive experiments based on two real network traffic collections. Hypothesis testing was used to examine the difference between the distribution of original and generated features, showing that 30-100\% of the extracted features were preserved. Small differences between n-gram perplexities in sequences of network activities in the original and generated traffic, indicate that sequences of network activities were well preserved.
We investigate sequence machine learning techniques on raw radio signal time-series data. By applying deep recurrent neural networks we learn to discriminate between several application layer traffic types on top of a constant envelope modulation without using an expert demodulation algorithm. We show that complex protocol sequences can be learned and used for both classification and generation tasks using this approach.
Traffic inspection is a fundamental building block of many security solutions today. For example, to prevent the leakage or exfiltration of confidential insider information, as well as to block malicious traffic from entering the network, most enterprises today operate intrusion detection and prevention systems that inspect traffic. However, the state-of-the-art inspection systems do not reflect well the interests of the different involved autonomous roles. For example, employees in an enterprise, or a company outsourcing its network management to a specialized third party, may require that th…
Treat Traffic Like Trees: A Semantic-Preserving Hierarchical Graph-Based Expert Framework for Encrypted Traffic Analysis
School of Cyber Science and Engineering, Southeast University（东南大学网络安全科学与工程学院）；Purple Mountain Laboratories（紫金山实验室）；Engineering Research Center of Blockchain Application, Supervision and Management (Southeast University)（区块链应用、监督与管理工程研究中心（东南大学））；Engineering Research Center of Security for Ubiquitous Network, Jiangsu Province（江苏省物联网安全工程技术研究中心）
University of Western Ontario（西安大略大学）；Juniper Networks（瞻博网络）
Internet traffic in the real world is susceptible to various external and internal factors which may abruptly change the normal traffic flow. Those unexpected changes are considered outliers in traffic. However, deep sequence models have been used to predict complex IP traffic, but their comparative performance for anomalous traffic has not been studied extensively. In this paper, we investigated and evaluated the performance of different deep sequence models for anomalous traffic prediction. Several deep sequences models were implemented to predict real traffic without and with outliers and s…
Existing distributed denial-of-service attack detection in software defined networks (SDNs) typically perform detection in a single domain. In reality, abnormal traffic usually affects multiple network domains. Thus, a cross-domain attack detection has been proposed to improve detection performance. However, when participating in detection, the domain of each SDN needs to provide a large amount of real traffic data, from which private information may be leaked. Existing multiparty privacy protection schemes often achieve privacy guarantees by sacrificing accuracy or increasing the time cost. A…
Middleboxes in a computer network system inspect and analyse network traffic to detect malicious communications, monitor system performance and provide operational services. However, encrypted traffic hinders the ability of middleboxes to perform such services. A common practice in addressing this issue is by employing a "Man-in-the-Middle" (MitM) approach, wherein an encrypted traffic flow between two endpoints is interrupted, decrypted and analysed by the middleboxes. The MitM approach is straightforward and is used by many organisations, but there are both practical and privacy concerns. Du…
Distributed Virtual Private Networks (dVPNs) are new VPN solutions aiming to solve the trust-privacy concern of a VPN's central authority by leveraging a distributed architecture. In this paper, we first review the existing dVPN ecosystem and debate on its privacy requirements. Then, we present VPN0, a dVPN with strong privacy guarantees and minimal performance impact on its users. VPN0 guarantees that a dVPN node only carries traffic it has "whitelisted", without revealing its whitelist or knowing the traffic it tunnels. This is achieved via three main innovations. First, an attestation mecha…
The recent spate of cyber attacks towards Internet of Things (IoT) devices in smart homes calls for effective techniques to understand, characterize, and unveil IoT device activities. In this paper, we present a new system, named IoTAthena, to unveil IoT device activities from raw network traffic consisting of timestamped IP packets. IoTAthena characterizes each IoT device activity using an activity signature consisting of an ordered sequence of IP packets with inter-packet time intervals. IoTAthena has two novel polynomial time algorithms, sigMatch and actExtract. For any given signature, sig…
Accurate network traffic prediction of base station cell is very vital for the expansion and reduction of wireless devices in base station cell. The burst and uncertainty of base station cell network traffic makes the network traffic nonlinear and non-stationary, which brings challenges to the long-term prediction of network traffic. In this paper, the traffic model LMA-DeepAR for base station network is established based on DeepAR. Acordding to the distribution characteristics of network traffic, this paper proposes an artificial feature sequence calculation method based on local moving avera…
University of Edinburgh（爱丁堡大学）；CNR-IEIIT（意大利国家研究委员会电子、信息与电信工程研究所）
Network slicing is increasingly used to partition network infrastructure between different mobile services. Precise service-wise mobile traffic forecasting becomes essential in this context, as mobile operators seek to pre-allocate resources to each slice in advance, to meet the distinct requirements of individual services. This paper attacks the problem of multi-service mobile traffic forecasting using a sequence-to-sequence (S2S) learning paradigm and convolutional long short-term memories (ConvLSTMs). The proposed architecture is designed so as to effectively extract complex spatiotemporal …
More Than Meets the Eye: A Semantics-Aware Traffic Augmentation Framework for Generalizable Website Fingerprinting
School of Cyberspace Security, Beijing University of Posts and Telecommunications, Beijing, China（北京邮电大学信息安全学院）；School of Computer Science and Engineering, Beihang University, Beijing, China（北京航空航天大学计算机科学与工程学院）；Faculty of Computing, Harbin Institute of Technology, Harbin, China（哈尔滨工业大学计算机学院）；School of Computer Science and Engineering, Guangxi Normal University, Guilin, China（广西师范大学计算机科学与工程学院）；Zhongguancun Laboratory, Beijing, China（中关村实验室）
During network planning phase, optimal network planning implemented through efficient resource allocation and static traffic demand provisioning in IP-over-elastic optical network (IP-over-EON) is significantly challenging compared with the fixed-grid wavelength division multiplexing (WDM) network due to increased flexibility in IP-over-EON. Mathematical optimization models used for this purpose may not provide solution for large networks due to large computational complexity. In this regard, a greedy heuristic may be used that intuitively selects traffic elements in sequence from static traff…
Monitoring network traffic to identify content, services, and applications is an active research topic in network traffic control systems. While modern firewalls provide the capability to decrypt packets, this is not appealing for privacy advocates. Hence, identifying any information from encrypted traffic is a challenging task. Nonetheless, previous work has identified machine learning methods that may enable application and service identification. The process involves high level feature extraction from network packet data then training a robust machine learning classifier for traffic identif…
Compressed video is well known to be self-similar in nature. We model VBR carrying Long-Range Dependent (LRD), multiplexed MPEG-2 video sources. The actual traffic for the model is generated using fast-fourier transform of generate the fractional gaussian noise (FGN) sequence. Our model of compressed video sources bears similarity to an MPEG-2 Transport Stream carrying video, i.e., it is long-range dependent and generates traffic in a piecewise-CBR fashion. We study the effect of such VBR traffic on ABR carrying TCP traffic. The effect of such VBR traffic is that the ABR capacity is highly var…
We propose a three-stage load balancing packet switch and its configuration scheme. The input- and central-stage switches are bufferless crossbars, and the output-stage switches are buffered crossbars. We call this switch ThRee-stage Clos-network swItch with queues at the middle stage and DEtermiNisTic scheduling (TRIDENT), and the switch is cell based. The proposed configuration scheme uses predetermined and periodic interconnection patterns in the input and central modules to load-balance and route traffic, therefore; it has low configuration complexity. The operation of the switch includes …
For the traditional denial-of-service attack detection methods have complex algorithms and high computational overhead, which are difficult to meet the demand of online detection; and the experimental environment is mostly a simulation platform, which is difficult to deploy in real network environment, we propose a real network environment-oriented LDoS attack detection method based on the time-frequency characteristics of traffic data. All the traffic data flowing through the Web server is obtained through the acquisition storage system, and the detection data set is constructed using pre-pro…
We propose a configuration scheme for a load-balancing Clos-network packet switch that has split central modules and buffers in between the split modules. Our split-central-buffered Load-Balancing Clos-network (LBC) switch is cell based. The switch has four stages, namely input, central-input, central-output, and output stages. The proposed configuration scheme uses a pre-determined and periodic interconnection pattern in the input and split central modules to load-balance and route traffic. The LBC switch has low configuration complexity. The operation of the switch includes a mechanism appli…
This paper aims at precisely detecting and identifying anomalous events in IP traffic. To this end, we adopt the link stream formalism which properly captures temporal and structural features of the data. Within this framework, we focus on finding anomalous behaviours with respect to the degree of IP addresses over time. Due to diversity in IP profiles, this feature is typically distributed heterogeneously, preventing us to directly find anomalies. To deal with this challenge, we design a method to detect outliers as well as precisely identify their cause in a sequence of similar heterogeneous…
There was a time when the word security was only confined to the physical protection of things that were valuable which must be guarded against all the odds. Today, in a world where people can do things virtually have emerged the necessity to protect the virtual world. Every single facet of our life is being controlled by the internet one way or another. There is no privacy in the cyberspace as the data which we are browsing on the internet is being monitored on the other side by someone. Each work we are doing on the internet is getting tracked or the data are getting leaked without consent. …
The number of internet-connected devices has been exponentially growing with the massive volume of heterogeneous data generated from various devices, resulting in a highly intertwined cyber-physical system. Currently, the Edge Intelligence System (EIS) concept that leverages the merits of edge computing and Artificial Intelligence (AI) is utilized to provide smart cloud services with powerful computational processing and reduce decision-making delays. Thus, EIS offers a possible solution to realizing future Intelligent Transportation Systems (ITS), especially in a vehicular network framework. …
Naval University of Engineering（海军工程大学）；Xinyang Normal University（信阳师范大学）；Xinyang Vocational and Technical College（信阳职业技术学院）
To address the problem that traditional network traffic anomaly detection algorithms do not suffi-ciently mine potential features in long time domain, an anomaly detection method based on mul-ti-scale residual features of network traffic is proposed. The original traffic is divided into subse-quences of different time spans using sliding windows, and each subsequence is decomposed and reconstructed into data sequences of different levels using wavelet transform technique; the stacked autoencoder (SAE) constructs similar feature space using normal network traffic, and gen-erates reconstructed e…
