Contrast pattern mining (CPM) aims to discover patterns whose support increases significantly from a background dataset compared to a target dataset. CPM is particularly useful for characterising changes in evolving systems, e.g., in network traffic analysis to detect unusual activity. While most existing techniques focus on extracting either the whole set of contrast patterns (CPs) or minimal sets, the problem of efficiently finding a relevant subset of CPs, especially in high dimensional datasets, is an open challenge. In this paper, we focus on extracting the most specific set of CPs to discover significant changes between two datasets. Our approach to this problem uses closed patterns to substantially reduce redundant patterns. Our experimental results on several real and emulated network traffic datasets demonstrate that our proposed unsupervised algorithm is up to 100 times faster than an existing approach for CPM on network traffic data [2]. In addition, as an application of CPs, we demonstrate that CPM is a highly effective method for detection of meaningful changes in network traffic.
University of Trieste（的里雅斯特大学）；University of Milan（米兰大学）
Encoding methods are employed across several process mining tasks, including predictive process monitoring, anomalous case detection, trace clustering, etc. These methods are usually performed as preprocessing steps and are responsible for transforming complex information into a numerical feature space. Most papers choose existing encoding methods arbitrarily or employ a strategy based on a specific expert knowledge domain. Moreover, existing methods are employed by using their default hyperparameters without evaluating other options. This practice can lead to several drawbacks, such as subopt…
In the last decade, the use of fast flux technique has become established as a common practice to organise botnets in Fast Flux Service Networks (FFSNs), which are platforms able to sustain illegal online services with very high availability. In this paper, we report on an effective fast flux detection algorithm based on the passive analysis of the Domain Name System (DNS) traffic of a corporate network. The proposed method is based on the near-real-time identification of different metrics that measure a wide range of fast flux key features; the metrics are combined via a simple but effective …
Software-Defined Networking (SDN) allows to control the available network resources by an intelligent and centralized authority in order to optimize traffic flows in a flexible manner. However, centralized control may face scalability issues when the network size or the number of traffic flows increases. Also, a centralized controller may form a single point of failure, thereby affecting the network resilience. This article provides an overview of SDN that focuses on (1) scalability concerning the increased control overhead faced by a central controller, and (2) resiliency in terms of protecti…
In this paper, we evaluate and analyze the impact of different network loads and varying no. of nodes on distance vector and link state routing algorithms. We select three well known proactive protocols; Destination Sequenced Distance Vector (DSDV) operates on distance vector routing, while Fisheye State Routing (FSR) and Optimized Link State Routing (OLSR) protocols are based on link state routing. Further, we evaluate and compare the effects on the performance of protocols by changing the routing strategies of routing algorithms. We also enhance selected protocols to achieve high performance…
New York University（纽约大学）；New York Institute of Technology（纽约理工学院）
Edge caching plays an increasingly important role in boosting user content retrieval performance while reducing redundant network traffic. The effectiveness of caching ultimately hinges on the accuracy of predicting content popularity in the near future. However, at the network edge, content popularity can be extremely dynamic due to diverse user content retrieval behaviors and the low-degree of user multiplexing. It's challenging for the traditional reactive caching systems to keep up with the dynamic content popularity patterns. In this paper, we propose a novel Predictive Edge Caching (PEC)…
Usage of mobile wireless Internet has grown very fast in recent years. This radical change in availability of Internet has led to communication of big amount of data over mobile networks and consequently new challenges and opportunities for modeling of mobile Internet characteristics. While the traditional approach toward network modeling suggests finding a generic traffic model for the whole network, in this paper, we show that this approach does not capture all the dynamics of big mobile networks and does not provide enough accuracy. Our case study based on a big dataset including billions o…
Few-Shot Network Intrusion Detection Using Online Triplet Mining
Department of Electronics and Electrical Engineering, University of Strathclyde（斯特拉斯克莱德大学电子与电气工程系）；Faculty of Computer and Information Sciences, Ain Shams University（爱思曼大学计算机与信息科学学院）；Faculty of Electrical Engineering, Czech Technical University（捷克技术大学电气工程学院）
Analysis and prediction of network traffic has applications in wide comprehensive set of areas and has newly attracted significant number of studies. Different kinds of experiments are conducted and summarized to identify various problems in existing computer network applications. Network traffic analysis and prediction is a proactive approach to ensure secure, reliable and qualitative network communication. Various techniques are proposed and experimented for analyzing network traffic including neural network based techniques to data mining techniques. Similarly, various Linear and non-linear…
Massive data centers are at the heart of the Internet. The rapid growth of Internet traffic and the abundance of rich data-driven applications have raised the need for enormous network bandwidth. Towards meeting this growing traffic demand, optical interconnects have gained significant attention, as they can provide high throughput, low latency, and scalability. In particular, optical Wavelength Division Multiplexing (WDM) provides the possibility to build data centers comprising of millions of servers, while providing hundreds of terabits per second bandwidth. In this paper, we propose a WDM-…
Peer-to-peer (P2P) computing is currently attracting enormous attention. In P2P systems a very large number of autonomous computing nodes (the peers) pool together their resources and rely on each other for data and services. Peer-to-peer (P2P) Data-sharing systems now generate a significant portion of Internet traffic. Examples include P2P systems for network storage, web caching, searching and indexing of relevant documents and distributed network-threat analysis. Requirements for widely distributed information systems supporting virtual organizations have given rise to a new category of P2P…
As LoRaWAN networks are actively being deployed in the field, it is important to comprehend the limitations of this Low Power Wide Area Network technology. Previous work has raised questions in terms of the scalability and capacity of LoRaWAN networks as the number of end devices grows to hundreds or thousands per gateway. Some works have modeled LoRaWAN networks as pure ALOHA networks, which fails to capture important characteristics such as the capture effect and the effects of interference. Other works provide a more comprehensive model by relying on empirical and stochastic techniques. Thi…
To increase the scalability of Software Defined Networks (SDNs), flow aggregation schemes have been proposed to merge multiple mouse flows into an elephant aggregated flow for traffic engineering. In this paper, we first notice that the user bit-rate requirements of mouse flows are no longer guaranteed in the aggregated flow since the flow rate decided by the TCP allocation is usually different from the desired bit-rate of each user. To address the above issue, we present a novel architecture, named Flexible Flow And Rate Management (F$^2$ARM), to control the rates of only a few flows in order…
Data mining is used to extract hidden information from large databases. In Peer-to-Peer context, a challenging problem is how to find the appropriate Peer to deal with a given query without overly consuming bandwidth. Different methods proposed routing strategies of queries taking into account the P2P network at hand. An unstructured P2P system based on an organization of Peers around Super-Peers that are connected to Super-Super-Peer according to their semantic domains is considered. This paper integrates Decision Trees in P2P architectures for predicting Query-Suitable Super-Peers representi…
Mining pools, the main components of the Bitcoin network, dominate the computing resources and play essential roles in network security and performance aspects. Although many existing measurements of the Bitcoin network are available, little is known about the details of mining pool behaviors (e.g., empty blocks, mining revenue and transaction collection strategies) and their effects on the Bitcoin end users (e.g., transaction fees, transaction delay and transaction acceptance rate). This paper aims to fill this gap with a systematic study of mining pools. We traced over 1.56 hundred thousand …
As the most successful cryptocurrency to date, Bitcoin constitutes a target of choice for attackers. While many attack vectors have already been uncovered, one important vector has been left out though: attacking the currency via the Internet routing infrastructure itself. Indeed, by manipulating routing advertisements (BGP hijacks) or by naturally intercepting traffic, Autonomous Systems (ASes) can intercept and manipulate a large fraction of Bitcoin traffic. This paper presents the first taxonomy of routing attacks and their impact on Bitcoin, considering both small-scale attacks, targeting …
