Traffic analysis attacks on Skype VoIP calls

Skype is one of the most popular voice-over-IP (VoIP) service providers. One of the main reasons for the popularity of Skype VoIP services is its unique set of features to protect privacy of VoIP calls such as strong encryption, proprietary protocols, unknown codecs, dynamic path selection, and the constant packet rate. In this paper, we propose a class of passive traffic analysis attacks to compromise privacy of Skype VoIP calls. The proposed attacks are based on application-level features extracted from VoIP call traces. The proposed attacks are evaluated by extensive experiments over different types of networks including commercialized anonymity networks and our campus network. The experiment results show that the proposed traffic analysis attacks can greatly compromise the privacy of Skype calls. Possible countermeasure to mitigate the proposed traffic analysis attacks are analyzed in this paper.     

Analysis and modelling of traffic produced by adaptive HTTP-based video

The increase of HTTP-based video popularity causes that broadband and Internet service providers’ links transmit mainly multimedia content. Network planning, traffic engineering or congestion control requires an understanding of the statistical properties of network traffic; therefore, it is desirable to investigate the characteristic of traffic traces generated by systems which employ adaptive bit-rate streaming. Our first contribution is an investigation of traffic originating from 120 client-server pairs, situated in an emulated content distribution network, and multiplexed onto a single network link. We show that the structure of the traffic is distinct from the structure generated by the first and second generation of HTTP video systems, and furthermore, not similar to the structure of general Internet traffic. The obtained traffic exhibits negative and positive correlations, anti-persistence, and its distribution function is skewed to the right. Our second contribution is an approximation of the traffic by ARIMA/FARIMA processes blue and artificial neural networks. As we show, the obtained traffic models are able to enhance the performance of an adaptive streaming algorithm.     

Detailed Analysis of Skype Traffic

Skype is beyond any doubt the VoIP application in the current Internet application spectrum. Its amazing success has drawn the attention of telecom operators and the research community, both interested in knowing its internal mechanisms, characterizing its traffic, understanding its users' behavior. In this paper, we investigate the characteristics of traffic streams generated by voice and video communications, and the signaling traffic generated by Skype. Our approach is twofold, as we make use of both active and passive measurement techniques to gather a deep understanding on the traffic Skype generates. From extensive testbed experiments, we devise a source model which takes into account: i) the service type, i.e., SkypeOut calls or calls between two Skype clients, ii) the selected source Codec, iii) the adopted transport layer protocol, and iv) network conditions. Leveraging on the use of an accurate Skype classification engine that we recently proposed, we study and characterize Skype traffic based on extensive passive measurements collected from our campus LAN.     

Skype网络流量测量及特征发现

针对越来越多P2P语音、视频传输应用给底层网络造成巨大通信压力的问题,提出Skype网络拓扑测量方案,分析Skype协议、通信机制、流量及行为特征。通过分析大量主动获取的节点数据和被动获取的Skype通信流量,总结出Skype网络的通信机制,发现部分Skype网络的流量特征、协议行为特征,经测试,在局域网环境下,该项方案能有效识别、管理Skype流量。     

Measurement Based Analysis of One-Click File Hosting Services

It is commonly believed that file sharing traffic on the Internet is mostly generated by peer-to-peer applications. However, we show that HTTP based file sharing services are also extremely popular. We analyzed the traffic of a large research and education network for three months, and observed that a large fraction of the inbound HTTP traffic corresponds to file download services, which indicates that an important portion of file sharing traffic is in the form of HTTP data. In particular, we found that two popular one-click file hosting services are among the top Internet domains in terms of served traffic volume. In this paper, we present an exhaustive study of the traffic generated by such services, the behavior of their users, the downloaded content, and their server infrastructure.     

Identification of adaptive video streams based on traffic correlation

Due to the popularity of Dynamic Adaptive Streaming Over HTTP (DASH), broadband and Internet service providers’ links transmit mainly multimedia content. As the most popular providers encrypt their video services, the attempts to identify their traffic through Deep Packet Inspection (DPI) encounter difficulties. Therefore, encrypted DASH traffic requires new classification methods. In this work, we propose to identify DASH traffic taking into account statistical dependencies among video flows. For this purpose, we employ cluster analysis which can identify groups of traffic flows that show similarity using only the application level information. In our work, we applied three unsupervised clustering algorithms, namely MinMax K-Means, OPTICS and AutoClass, to classify video traces obtained from an emulated environment. The experimental results show that the employed algorithms are able to effectively distinguish video flows generated by different play-out strategies. The classification performance depends on the network conditions and parameters of the learning process.

     

Measurement and Analysis of HTTP Traffic

The usage of Internet is rapidly increasing and a large part of the Internet traffic is generated by the World Wide Web (WWW) and the associated protocol HyperText Transfer Protocol (HTTP). Several important parameters that affect the performance of the WWW are bandwidth, scalability, and latency. To tackle these parameters and to improve the overall performance of the system, it is important to understand and to characterize the application level characteristics. This article is reporting on the measurement and analysis of HTTP traffic collected on the student access network at the Blekinge Institute of Technology in Karlskrona, Sweden. The analysis is done on various HTTP traffic parameters, e.g., inter-session timings, inter-arrival timings, request message sizes, response code, and number of transactions. The reported results can be useful for building synthetic workloads for simulation and benchmarking purposes.     

A measurement-based study on the correlations of inter-domain Internet application flows

Internet traffic characterization has a profound impact on network engineering and traffic identification. Existing studies are often carried out on a per-flow basis, focusing on the properties of individual flows. In this paper, we study the interaction of Internet traffic flows and network features from a complex network perspective, focusing on six types of applications: P2P file sharing, P2P stream, HTTP, instant messaging, online games and abnormal traffic. With large-volume traffic flow records collected through proprietary line-speed hardware-based monitors, we construct flow graphs of these different application types. Based on the flow graphs, we calculate the correlation coefficients on various properties for individual or multiple applications. Our studies on associativity among degree and strength of individual hosts and connected nodes reveal distinct correlative behavior of different types of applications. Especially, the correlations of P2P applications are observed to be much stronger than those of the other applications. We also investigate the correlations between different types of applications, and observe that HTTP has remarkably different correlations from those of the two P2P applications due to the fact that multiple application types rely on HTTP. Finally, we study the dynamics of correlations for a period of 24 h and reveal a few interesting trends. We believe that our work which focuses on the assortativities of Internet applications provides insightful understanding on Internet traffic classification of up-to-date applications and will be helpful for Internet traffic classification and engineering.     

Understanding Skype signaling

Skype is without a doubt today’s VoIP application of choice. Its amazing success has drawn the attention of both telecom operators and the research community. There is a great interest in characterizing Skype’s traffic, understanding its internal mechanisms, and learning about its users’ behavior. One of the most interesting characteristics of Skype is that it relies on a P2P infrastructure for the exchange of signaling information that is distributed between peers.Leveraging the use of an accurate Skype classification engine that we recently designed, we now report the results of our experimental study of Skype signaling based on extensive passive measurements collected from our campus LAN. We avoid the need to reverse-engineer the Skype protocol, and we instead adopt a black-box approach. We focus on signaling traffic in order to infer certain interesting properties regarding overlay maintenance and, possibly, the overlay structure as well.Our results show that, even though the signaling bandwidth used by normal peers is exiguous, it may nonetheless account for a significant portion of the total traffic generated by a single Skype client. Skype performs peer discovery and refresh by using a large number of single packet probes. This may be as effective for the purpose of overlay maintenance as it is costly, at least from the viewpoint of layer-4 network devices. At the same time, single-packet probes account for only a minor fraction of all signaling traffic: therefore, we wish to explore more deeply the traffic that is exchanged among the more stable peers, in an attempt to learn how the peer selection mechanism actually operates.Measurements were collected during April and August 2007. In particular, during the second month of sampling, the Skype network suffered a worldwide service outage. We compare the results collected during the two time periods, and we demonstrate the striking impacts on the signaling network as a result of the outage.     

一种基于SVM的P2P网络流量分类方法

提出一种基于SVM的P2P网络流量分类的方法。这种方法利用网络流量的统计特征和基于统计理论的SVM方法,对不同应用类型的P2P网络流量进行分类研究。主要对文件共享中的BitTorrent,流媒体中的PPLive,网络电话中的Skype,即时通讯中的MSN 4种P2P网络流量进行分类研究。介绍了基于SVM的P2P流量分类的整体框架,描述了流量样本的获取及处理方法,并对分类器的构建及实验结果进行了介绍。实验结果验证了提出方法的有效性,平均分类精确率为92.38%。     

面向移动应用识别的结构化特征提取方法

针对移动应用流量监控及行为分析等需要,为有效识别移动网络流量所属的应用,提出一种超文本传输协议（HTTP）流结构化特征提取方法。采取一款自研的基于虚拟专用网络（VPN）的流量采集工具获取研究数据,该工具能够精确标识每一条数据流归属的应用。在特征提取阶段,不预先设计特征构成,通过流聚类、获取最长公共子序列、字符替换得到应用HTTP流的结构化特征。从42种应用的117 772条HTTP流中提取特征,并对测试集的50 387条HTTP流进行识别,所提方法的平均准确率达99%,平均查全率为90.63%,单个应用最大误报率为0.52%。实验结果表明,该结构化特征提取方法能够有效识别移动应用的流量。     

Adaptive Search Radius – Using hop count to reduce P2P traffic

Peer-to-Peer (P2P) file sharing accounts for a very significant part of the Internet’s traffic, affecting the performance of other applications and translating into significant peering costs for ISPs. It has been noticed that, just like WWW traffic, P2P file sharing traffic shows locality properties, which are not exploited by current P2P file sharing protocols.We propose a peer selection algorithm, Adaptive Search Radius (ASR), where peers exploit locality by only downloading from those other peers which are nearest (in network hops). ASR ensures swarm robustness by dynamically adapting the distance according to file part availability. ASR aims at reducing the Internet’s P2P file sharing traffic, while decreasing the download times perceived by users, providing them with an incentive to adopt this algorithm. We believe ASR to be the first locality-aware P2P file sharing system that does not require assistance from ISPs or third parties nor modification to the server infrastructure.We support our proposal with extensive simulation studies, using the eDonkey/eMule protocol on SSFNet. These show a 19 to 29% decrease in download time and a 27 to 70% reduction in the traffic carried by tier-1 ISPs. ASR is also compared (favourably) with Biased Neighbour Selection (BNS), and traffic shaping. We conclude that ASR and BNS are complementary solutions which provide the highest performance when combined. We evaluated the impact of P2P file sharing traffic on HTTP traffic, showing the benefits on HTTP performance of reducing P2P traffic.A plan for introducing ASR into eMule clients is also discussed. This will allow a progressive migration to ASR enabled versions of eMule client software.ASR was also successfully used to download from live Internet swarms, providing significant traffic savings while finishing downloads faster.     

TPII: tracking personally identifiable information via user behaviors in HTTP traffic

It is widely common that mobile applications collect non-critical personally identifiable information(PII)from users'devices to the cloud by application service providers(ASPs)in a positive manner to provide precise and recommending services.Meanwhile,Internet service providers(ISPs)or local network providers also have strong requirements to collect PIIs for finer-grained traffic control and security services.However,it is a challenge to locate PIIs accurately in the massive data of network traffic just like looking a needle in a haystack.In this paper,we address this challenge by presenting an efficient and light-weight approach,namely TPII,which can locate and track PIIs from the HTTP layer rebuilt from raw network traffics.This approach only collects three features from HTTP fields as users'behaviors and then establishes a tree-based decision model to dig PIIs efficiently and accurately.Without any priori knowledge,TPII can identify any types of PIIs from any mobile applications,which has a broad vision of applications.We evaluate the proposed approach on a real dataset collected from a campus network with more than 13k users.The experimental results show that the precision and recall of TPII are 91.72%and 94.51%respectively and a parallel implementation of TPII can achieve 213 million records digging and labelling within one hour,reaching near to support 1Gbps wirespeed inspection in practice.Our approach provides network service providers a practical way to collect PIIs for better services.     

A scalable solution for engineering streaming traffic in the future Internet

As traffic on the Internet continues to grow exponentially, there is a real need to solve scalability and traffic engineering simultaneously – specifically, without using over-provisioning in order to accommodate streaming media traffic. One of the threats to the current operation stability of the Internet comes from UDP-based streaming media applications, such as Skype (which is currently doubling every 6-month) today and video services in the near future. This paper shows how the Internet can benefit from pipeline forwarding in order to: (i) construct ultra-scalable IP switches, (ii) provide predictable quality of service for UDP-based streaming applications, while (iii) preserving elastic TCP-based traffic as is, i.e., without affecting any existing best-effort applications.     

流特征的Skype流量识别

Skype流识别的研究大多局限于在静态载荷特征和通信机制,没有考虑网络流特征在Skype流量识别中的作用.提出了一种基于朴素贝叶斯分类的Skype流量识别模型.选择流的连接特征和实时特征作为分类特征集,根据流的连接特征组织网络流,再进一步根据流的包长度、平均发送间隔和突发带宽消耗等实时流特征识别Skype流量.在北京联通骨干网络上的实验表明该模型能有效地识别Skype流,是一种有效的Skype流识别算法.     

Effective client-driven three-level rate adaptation (TLRA) approach for adaptive HTTP streaming

Multimedia streaming allows consumers to view multimedia content anywhere. However, quality of service is a major concern amid heightened levels of network traffic caused by increasing user demand. Accordingly, media streaming technology is adopting a new paradigm: adaptive HTTP streaming (AHS). AHS is widely used for real-time streaming content delivery in the Internet environment. In streaming, selection of appropriate bitrate is crucial for adapting media rate to network variations and client processing capabilities while ensuring optimal service for the consumer. We evaluate a proposed client-driven three-level optimized rate adaptation algorithm for adaptive HTTP media streaming. In the first stage, the algorithm chooses a suitable starting bitrate close to the available channel capacity. Next, the algorithm monitors the client parameters in real time, precisely detecting network variations and choosing a likely available bit representation for the next download segment. The algorithm controls and minimizes the effects of buffer stalls and overflow resulting from the brief network variations occurring between consecutive segments. The proposed algorithm is implemented in Dynamic Adaptive Streaming over HTTP (DASH) player and its performance compared to that of commercially available Gstreamer-based HTTP Live Streaming (HLS) and DASH players which use conventional segment fetch time–based adaptation and throughput-based adaptation algorithms respectively. This evaluation uses a real-time cloud server client and test bed streaming setup. The resulting analysis shows that the client-driven three-level rate adaptation (TLRA) approach allows adaptive streaming clients to maximize use of end-to-end network capacity, delivering an ideal user experience by precisely predicting network variations and rapidly adapting to available bandwidth, minimizing rebuffering events and bitrate level changes.     

基于主动测试的HTTP业务性能分析

Web业务在当前Internet流量中占有重要地位,而网络路径对HTTP业务性能的影响直接决定了用户可察觉的Web服务器访问的响应时间和页面下载速率的差异.通过主动业务仿真方法,测量端到端路径HTTP业务的性能表现,分析了业务响应时间的构成与分布特征,发现对同一页面在不同时间访问的下载速率表现出高可变性,证明常用的基于均值－标准差的性能故障检测判别方法并不完全适用于该类性能参数,提出了基于盒式图的端到端路径HTTP业务性能故障检测算法.     

IoTGuardEye:一种面向物联网服务的Web攻击检测方法

在包括物联网(Internet of Things,IoT)设备的绝大部分边缘计算应用中,基于互联网应用技术(通常被称为Web技术)开发的应用程序接口(Application Programming Interface,API)是设备与远程服务器进行信息交互的核心。相比传统的Web应用,大部分用户无法直接接触到边缘设备使用的API,使得其遭受的攻击相对较少。但随着物联网设备的普及,针对API的攻击逐渐成为热点。因此,文中提出了一种面向物联网服务的Web攻击向量检测方法,用于对物联网服务收到的Web流量进行检测,并挖掘出其中的恶意流量,从而为安全运营中心(Security Operation Center,SOC)提供安全情报。该方法在对超文本传输协议(Hypertext Transfer Protocol,HTTP)请求的文本序列进行特征抽取的基础上,针对API请求的报文格式相对固定的特点,结合双向长短期记忆网络(Bidirectional Long Short-Term Memory,BLSTM)实现对Web流量的攻击向量检测。实验结果表明,相比基于规则的Web应用防火墙(Web A...     

Internet traffic modeling by means of Hidden Markov Models

In this work, we propose a Hidden Markov Model for Internet traffic sources at packet level, jointly analyzing Inter Packet Time and Packet Size. We give an analytical basis and the mathematical details regarding the model, and we test the flexibility of the proposed modeling approach with real traffic traces related to common Internet services with strong differences in terms of both applications/users and protocol behavior: SMTP, HTTP, a network game, and an instant messaging platform. The presented experimental analysis shows that, even maintaining a simple structure, the model is able to achieve good results in terms of estimation of statistical parameters and synthetic series generation, taking into account marginal distributions, mutual, and temporal dependencies. Moreover we show how, by exploiting such temporal dependencies, the model is able to perform short-term prediction by observing traffic from real sources.     

Analyzing factors that influence end-to-end Web performance

Web performance impacts the popularity of a particular Web site or service as well as the load on the network, but there have been no publicly available end-to-end measurements that have focused on a large number of popular Web servers examining the components of delay or the effectiveness of the recent changes to the HTTP protocol. In this paper we report on an extensive study carried out from many client sites geographically distributed around the world to a collection of over 700 servers to which a majority of Web traffic is directed. Our results show that the HTTP/1.1 protocol, particularly with pipelining, is indeed an improvement over existing practice, but that servers serving a small number of objects or closing a persistent connection without explicit notification can reduce or eliminate any performance improvement. Similarly, use of caching and multi-server content distribution can also improve performance if done effectively.