Detection of Anomalous Behaviors in Networks From Traffic Measurements

Analysis and monitoring of traffic measurements can provide a useful tool for diagnostics, troubleshooting, and performance analysis in networks. This paper presents a method for traffic analysis based on the theory of extreme values. Numerical time series obtained from traffic measurements are processed to compute statistical indicators and analyze them to detect significant local features, which may point to some critical network behavior.      

Analysis of safety factors for urban expressways considering the effect of congestion in Shanghai,China

Urban expressways are the key components of the urban traffic network. The traffic safety situation on expressways directly influences the efficiency of the whole network. A total of 48,325 crashes were recorded by Shanghai Expressway Surveillance System in a three-year period. Considering the different crash mechanisms under different congestion levels, models for the total crashes, non-congested-flow crashes and congested-flow crashes were respectively formulated based on the real-time traffic condition corresponding to each crash. Moreover, considering the potential spatial correlation among segments, the adjacent-correlated spatial and distance-correlated spatial models were formulated and compared to the traditional non-spatial-correlated model. A Bayesian approach was employed to estimate the parameters. The results showed that the congestion index, merging ratio, ramp density, and average daily traffic significantly affect the crash frequency. The safety factors in non-congested flow and congested flow are different; diverging behavior is more risky in non-congested flow, more lanes tend to increase the risk of crashes in congested flow, and horizontal curves tend to decrease the crash risk in congested flow but cause high risk in non-congested flow. In addition, the distance-correlated spatial model is found to be the best-fitting model. The results of this study suggested that dedicated safety countermeasures can be designed for different traffic situations on urban expressways.     

A Study of Measurement-Based Traffic Models for Network Diagnostics

In this paper, the measurement and analysis of network flows are taken into account as a methodology for characterization and diagnosis of network behavior. The accuracy of flow models will be discussed, reviewing the basic underlying assumptions. A modeling approach based on multidomain analysis will be proposed, where flow measurements can be complemented by a limited amount of protocol data gathered from packet headers. By the analysis of experimental data, we argue that, in several situations, traffic may be more appropriately modeled by the superposition of multiple flows with different characteristics, which results in better measurements and improved diagnostic possibilities.      

Internet Traffic Measurement: A Critical Study of Wavelet Analysis

In communication networks, traffic measurements serve two main purposes: the characterization of traffic-load patterns and the monitoring of performances. This paper is a study of the applicability of traffic-analysis methods as a means of detecting malfunctions and performance changes in packet data networks through measurements of selected parameters. The main contribution is of a methodological nature and is motivated by the fact that wavelet analysis, which has come to be regarded as a standard approach, is by no means a straightforward method. Controversial results can be found that are not always attributable to the complex nature of the measured object. Careful study of the uncertainty of traffic-parameter estimates is also an important issue, which turns out to be somewhat neglected in the literature. The aim of this paper is twofold: on the one hand, to enhance the model validation process and, on the other hand, to provide for objective assessment of the feasibility of network-monitoring procedures that rely on measurement and model-based diagnostics     

城市道路网运行实时动态评价理论和技术研究

从道路网运行的基本特性入手,着重分析了路网运行的随机波动性、递延传导效应和周期规律性。在此基础上,剖析了迄今国内外一直沿用的道路"负荷度"路网评价理论的局限性,提出一套适用于路网整体实时动态评价的理论和技术方法,解决了无盲区实时数据采集与处理、路网运行时空动态分析、评价指标阈值标定等关键技术难题,为交通战略规划、实时动态路网功况诊断等提供了全新的技术手段,北京市的实证研究初步证明了所提出的理论和技术体系科学、有效、实用。     

Aggressiveness propensity index for driving behavior at signalized intersections

The development of a quantitative intersection aggressiveness propensity index (API) is described in this paper. The index is intended to capture the overall propensity for aggressive driving to be experienced at a given signalized intersection. The index is a latent quantity that can be estimated from observed environmental, situational and driving behavior variables using structural equations modeling techniques. An empirical study of 10 major signalized intersections in the greater Washington DC metropolitan area was conducted to illustrate the approach. The API is shown to provide (a) an approach for capturing and quantifying aggressive driving behavior given certain measurements taken at a particular intersection, (b) understanding of the factors and intersection characteristics that may affect aggressiveness, and (c) an index for the cross comparison of different traffic areas with different features. This index has the potential to support safety policy analysis and decision-making.     

Metaheuristic Optimization of Time Series Models for Predicting NetworksTraffic

Traffic prediction of wireless networks attracted many researchers and practitioners during the past decades. However, wireless traffic frequently exhibits strong nonlinearities and complicated patterns, which makes it challenging to be predicted accurately. Many of the existing approaches for predicting wireless network traffic are unable to produce accurate predictions because they lack the ability to describe the dynamic spatial-temporal correlations of wireless network traffic data. In this paper, we proposed a novel meta-heuristic optimization approach based on fitness grey wolf and dipper throated optimization algorithms for boosting the prediction accuracy of traffic volume. The proposed algorithm is employed to optimize the hyper-parameters of long short-term memory (LSTM) network as an efficient time series modeling approach which is widely used in sequence prediction tasks. To prove the superiority of the proposed algorithm, four other optimization algorithms were employed to optimize LSTM, and the results were compared. The evaluation results confirmed the effectiveness of the proposed approach in predicting the traffic of wireless networks accurately. On the other hand, a statistical analysis is performed to emphasize the stability of the proposed approach.     

Network Traffic Obfuscation System for IIoT-Cloud Control Systems

One of the latest technologies enabling remote control, operational efficiency upgrades, and real-time big-data monitoring in an industrial control system (ICS) is the IIoT-Cloud ICS, which integrates the Industrial Internet of Things (IIoT) and the cloud into the ICS. Although an ICS benefits from the application of IIoT and the cloud in terms of cost reduction, efficiency improvement, and real-time monitoring, the application of this technology to an ICS poses an unprecedented security risk by exposing its terminal devices to the outside world. An adversary can collect information regarding senders, recipients, and prime-time slots through traffic analysis and use it as a linchpin for the next attack, posing a potential threat to the ICS. To address this problem, we designed a network traffic obfuscation system (NTOS) for the IIoT-Cloud ICS, based on the requirements derived from the ICS characteristics and limitations of existing NTOS models. As a strategy to solve this problem wherein a decrease in the traffic volume facilitates traffic analysis or reduces the packet transmission speed, we proposed an NTOS based on packet scrambling, wherein a packet is split into multiple pieces before transmission, thus obfuscating network analysis. To minimize the ICS modification and downtime, the proposed NTOS was designed using an agent-based model. In addition, for the ICS network traffic analyzer to operate normally in an environment wherein the NTOS is applied, a rule-based NTOS was adopted such that the actual traffic flow is known only to the device that is aware of the rule and is blocked for attackers. The experimental results verified that the same time requested for response and level of difficulty of analysis were maintained by the application of an NTOS based on packet scrambling, even when the number of requests received by the server per second was reduced. The network traffic analyzer of the ICS can capture the packet flow by using the pre-communicated NTOS rule. In addition, by designing an NTOS using an agent-based model, the impact on the ICS was minimized such that the system could be applied with short downtime.     

Deriving origin destination data from a mobile phone network

Acquiring high-quality origin-destination (OD) information for traffic in a geographic area is both time consuming and expensive while using conventional methods such as household surveys or roadside monitoring. These methods generally present only a snapshot of traffic situation at a certain point in time, and they are updated in time intervals of up to several years. A technique was developed that makes use of the global system for mobile communications (GSM) mobile phone network. Instead of monitoring the flow of vehicles in a transportation network, the flow of mobile phones in a cell-phone network is measured and correlated to traffic flow. This methodology is based on the fact that a mobile phone moving on a specific route always tends to change the base station nearly at the same position. For a first pilot study, a GSM network simulator has been designed, where network data can be simulated, which is then extracted from the phone network, correlated, processed mathematically and converted into an OD matrix. Primary results show that the method has great potential, and the results inferred are much more cost-effective than those generated with traditional techniques. This is due to the fact that no change has to be made in the GSM network, because the information that is needed can readily be extracted from the base station database, that is the entire infrastructure needed is already in place     

Deterministic network interdiction optimization via an evolutionary approach

This paper introduces an evolutionary optimization approach that can be readily applied to solve deterministic network interdiction problems. The network interdiction problem solved considers the minimization of the maximum flow that can be transmitted between a source node and a sink node for a fixed network design when there is a limited amount of resources available to interdict network links. Furthermore, the model assumes that the nominal capacity of each network link and the cost associated with their interdiction can change from link to link. For this problem, the solution approach developed is based on three steps that use: (1) Monte Carlo simulation, to generate potential network interdiction strategies, (2) Ford-Fulkerson algorithm for maximum s-t flow, to analyze strategies’ maximum source-sink flow and, (3) an evolutionary optimization technique to define, in probabilistic terms, how likely a link is to appear in the final interdiction strategy. Examples for different sizes of networks and network behavior are used throughout the paper to illustrate the approach. In terms of computational effort, the results illustrate that solutions are obtained from a significantly restricted solution search space. Finally, the authors discuss the need for a reliability perspective to network interdiction, so that solutions developed address more realistic scenarios of such problem.     

Numerical fluorescence correlation spectroscopy for the analysis of molecular dynamics under nonstandard conditions

The suitability of mathematical models used to extract kinetic information from correlated data constitutes a significant issue in fluorescence correlation spectroscopy (FCS). Standard FCS equations are derived from a simple Gaussian approximation of the optical detection volume, but some investigations have suggested this traditional practice can lead to inaccurate and misleading conclusions under many experimental circumstances, particularly those encountered in one-photon confocal measurements. Furthermore, analytical models cannot be derived for all measurement scenarios. We describe a novel numerical approach to FCS that circumvents conventional analytical models, enabling meaningful analyses even under extraordinarily unusual measurement conditions. Numerical fluorescence correlation spectroscopy (NFCS) involves quantitatively matching experimental correlation curves with synthetic curves generated via diffusion simulation or direct calculation based on an experimentally determined 3D map of the detection volume. Model parameters are adjusted iteratively to minimize the residual differences between synthetic and experimental correlation curves. In order to reduce analysis time, we distribute calculations across a network of processors. As an example of this new approach, we demonstrate that synthetic autocorrelation curves correspond well with experimental data and that NFCS diffusion measurements of Rhodamine B remain constant, regardless of the distortion present in a confocal detection volume.     

Developing unified rheological curves for polymermodified asphalts-part II. Experimental verification

The theoretical analysis in Part I of the paper has shown that unified curves can be obtained, in principle, if the rheological data obtained by measurements on the dynamic shear rheometer (DSR) are normalized through the use of the material's volumetric-flow rate (MVR) generated from a simple flow measurement device (FMD). In Part II of the paper, experimental verification of the unification process is done through systematic data analysis on selected polymer-modified asphalts. The unified curves have far-reaching implications and these have been brought out explicitly. Since MVR is so simple to determine quite accurately on a relatively inexpensive, easy-to-use flow measurement device (FMD), this parameter can be generated on paving sites or at refineries. The MVR can be used as a quality control/quality assurance parameter to ensure batch-to-batch invariance and also as an excellent indicator of the fundamental rheological parameters through the use of the unified curves.     

Diagnosing Anomalies and Identifying Faulty Nodes in Sensor Networks

In this paper, an anomaly detection approach that fuses data gathered from different nodes in a distributed sensor network is proposed and evaluated. The emphasis of this work is placed on the data integrity and accuracy problem caused by compromised or malfunctioning nodes. The proposed approach utilizes and applies Principal Component Analysis simultaneously on multiple metrics received from various sensors. One of the key features of the proposed approach is that it provides an integrated methodology of taking into consideration and combining effectively correlated sensor data, in a distributed fashion, in order to reveal anomalies that span through a number of neighboring sensors. Furthermore, it allows the integration of results from neighboring network areas to detect correlated anomalies/attacks that involve multiple groups of nodes. The efficiency and effectiveness of the proposed approach is demonstrated for a real use case that utilizes meteorological data collected from a distributed set of sensor nodes     

Cost-Duration Analysis with the Cut Network

A new approach is developed for conducting a cost-duration analysis (trade-off study) for a project denned with a CPM/PERT activity network. The approach utilizes a new graph theory concept, proper oriented cut-set (POCS). It also uses the cut network, a dual-type network defined in this paper for any planar activity network. The cut network implicitly enumerates all POCS's of an original network. The cost-duration problem defined for the original activity network is transformed into a minimum-cost flow problem for the cut network. This approach to cost-duration analysis, developed here for a planar network and linear activity cost-duration relations, is optimal, conceptually direct, and has potential for application to more general cost-functions.     

Evolutionary events in a mathematical sciences research collaboration network

This study examines long-term trends and shifting behavior in the collaboration network of mathematics literature, using a subset of data from Mathematical Reviews spanning 1985–2009. Rather than modeling the network cumulatively, this study traces the evolution of the “here and now” using fixed-duration sliding windows. The analysis uses a suite of common network diagnostics, including the distributions of degrees, distances, and clustering, to track network structure. Several random models that call these diagnostics as parameters help tease them apart as factors from the values of others. Some behaviors are consistent over the entire interval, but most diagnostics indicate that the network’s structural evolution is dominated by occasional dramatic shifts in otherwise steady trends. These behaviors are not distributed evenly across the network; stark differences in evolution can be observed between two major subnetworks, loosely thought of as “pure” and “applied”, which approximately partition the aggregate. The paper characterizes two major events along the mathematics network trajectory and discusses possible explanatory factors.     

Data, modelling and inference in road traffic networks

In this paper, we study UK road traffic data and explore a range of modelling and inference questions that arise from them. For example, loop detectors on the M25 motorway record speed and flow measurements at regularly spaced locations as well as the entry and exit lanes of junctions. An exploratory study of these data helps us to better understand and quantify the nature of congestion on the road network. From a traveller's perspective it is crucially important to understand the overall journey times and we look at methods to improve our ability to predict journey times given access jointly to both real-time and historical loop detector data. Throughout this paper we will comment on related work derived from US freeway data.     

Predicting cycling accident risk in Brussels: A spatial case–control approach

This paper aims at predicting cycling accident risk for an entire network and identifying how road infrastructure influences cycling safety in the Brussels-Capital Region (Belgium). A spatial Bayesian modelling approach is proposed using a binary dependent variable (accident, no accident at location i) constructed from a case–control strategy. Control sites are sampled along the ‘bikeable’ road network in function of the potential bicycle traffic transiting in each ward. Risk factors are limited to infrastructure, traffic and environmental characteristics.     

Malicious Traffic Detection in IoT and Local Networks Using Stacked Ensemble Classifier

Malicious traffic detection over the internet is one of the challenging areas for researchers to protect network infrastructures from any malicious activity. Several shortcomings of a network system can be leveraged by an attacker to get unauthorized access through malicious traffic. Safeguard from such attacks requires an efficient automatic system that can detect malicious traffic timely and avoid system damage. Currently, many automated systems can detect malicious activity, however, the efficacy and accuracy need further improvement to detect malicious traffic from multi-domain systems. The present study focuses on the detection of malicious traffic with high accuracy using machine learning techniques. The proposed approach used two datasets UNSW-NB15 and IoTID20 which contain the data for IoT-based traffic and local network traffic, respectively. Both datasets were combined to increase the capability of the proposed approach in detecting malicious traffic from local and IoT networks, with high accuracy. Horizontally merging both datasets requires an equal number of features which was achieved by reducing feature count to 30 for each dataset by leveraging principal component analysis (PCA). The proposed model incorporates stacked ensemble model extra boosting forest (EBF) which is a combination of tree-based models such as extra tree classifier, gradient boosting classifier, and random forest using a stacked ensemble approach. Empirical results show that EBF performed significantly better and achieved the highest accuracy score of 0.985 and 0.984 on the multi-domain dataset for two and four classes, respectively.     

Fault diagnosis in injection moulding via cavity pressure signals

In this paper we demonstrate the feasibility of applying pattern recognition techniques for monitoring and diagnosis to an injection moulding process. Mould cavity pressure signals collected during the process are utilized for monitoring and diagnosis. Principal component analysis is applied to reduce the dimensionality of multivariate signals to a univariate representative signal, while preserving the characteristics of the original signals. Process ‘fingerprints’ are gleaned through wavelet decomposition and multi-resolution analysis of the ‘reduced’ signal. Feature elements defined from these fingerprints are interpreted by an artificial neural network for process condition monitoring and fault diagnosis. The experimental results indicate that this approach is effective for ‘run to run’ process monitoring, diagnostics and control. The diagnostic system can be updated adaptively as new process faults are identified.     

Interrupted versus uninterrupted flow: A safety propensity index for driver behavior

The objective of this paper is to develop a quantitative safety propensity index (SPI) that captures the overall propensity of a given surrounding environment to cause unsafe driving. The study is conducted in two different flow conditions: interrupted and uninterrupted. Using structural modeling techniques, the index can be estimated from observed geometric, weather-related, vehicular, driver-related, and traffic-related characteristics. To illustrate the adopted approach, extensive effort was conducted to “sync” data from different sources including the Virginia Department of Transportation and the FARS/GES crash data libraries. The Virginia Department of Transportation provided traffic data for 10 freeway sections with interrupted flow and 9 highway sections with interrupted flow in the Northern Virginia area, USA. Two different structural equations models were found allowing insights to the safety impact of different surrounding elements/dimensions. The SPI provides (a) a basis for quantifying the effects of the aforementioned characteristics on safety, (b) a basis for comparing the differences between the factors affecting safety in different flow scenarios and (c) ranking the corresponding roadway sections/locations for improved safety performance. The framework and methodology used to develop this index have the potential to support safety policy analysis and decision making.