Application layer classification of Internet traffic using ensemble learning models

Accurate application layer classification of Internet traffic has been a necessary requirement for various regulatory, control, and operational purposes of Internet service provider (ISP). Due to the dynamic and ever evolving nature of Internet applications generating a diverse mixture of Internet traffic, it has been necessary to apply deep packet inspection (DPI) techniques for traffic classification. DPI methods offer accuracy but degrade overall network throughput and thus cause problems in ensuring quality of service (QoS) and maintaining service-level agreements. Moreover, Internet traffic is mostly end to end encrypted. This in turn limits the applicability of DPI techniques and renders them useless, unless the encryption tunnel is broken by the service provider which would risk violating user privacy. To address these trade-offs between classification accuracy, performance, and user privacy, we resort to machine learning (ML)-based algorithms. In this article, we apply three ensemble ML algorithms and report their performance metrics in the application layer classification of Internet traffic.     

A novel traffic identification approach based on multifractal analysis and combined neural network

An accurate identification of Internet traffic of different applications is highly relevant for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance monitoring, and security. Traditional traffic identification approaches have become increasingly inaccurate due to restrictions of port numbers, protocol signatures, traffic encryption, and etc. In this paper, a new traffic identification approach based on multifractal analysis of wavelet energy spectrum and classification of combined neural network models is proposed. The proposed approach is able to achieve the identification of different Internet application traffic by performing classification over the wavelet energy spectrum coefficients that were inferred from the original traffic. Without using any payload information, the proposed approach has more advantages over traditional methods. The experiment results illustrate that the proposed approach has satisfactory identification results.     

An overview of routing optimization for internet traffic engineering

Traffic engineering is an important mechanism for Internet network providers seeking to optimize network performance and traffic delivery. Routing optimization plays a key role in traffic engineering, finding efficient routes so as to achieve the desired network performance. In this survey we review Internet traffic engineering from the perspective of routing optimization. A taxonomy of routing algorithms in the literature is provided, dating from the advent of the TE concept in the late 1990s. We classify the algorithms into multiple dimensions: unicast/multicast, intra-/inter- domain, IP-/MPLS-based and offline/online TE schemes. In addition, we investigate some important traffic engineering issues, including robustness, TE interactions, and interoperability with overlay selfish routing. In addition to a review of existing solutions, we also point out some challenges in TE operation and important issues that are worthy of investigation in future research activities.     

What's next for Internet data analysis? Status and challengesfacing the community

Most large providers currently collect basic statistics on the performance of their own infrastructure, typically including measurements of utilization and availability and possibly rudimentary assessments of delay and throughput. In today's commercial Internet, the only baseline against which organizations can calibrate their networks is past performance data. No data or even standard formats are available against which to compare performance with other networks or against an industry norm, nor are there reliable data with which customers can assess the performance of providers. Data characterization and traffic flow analysis also are virtually nonexistent at this time, yet they remain essential for understanding the internal dynamics of the Internet infrastructure. Path performance measurement tools enable users and operators to better evaluate and compare providers and to monitor service quality. Traffic flow characterization tools focus on the behavior and inner workings of these wide-area networks. This paper has two goals. We first provide background on the current Internet architecture and describe how measurements are a key element in the development of a robust and financially successful commercial Internet. We then discuss the current state of Internet metrics analysis and activities within various forums, particularly the Cooperative Association for Internet Data Analysis and the National Laboratory for Applied Network Research, to encourage the development and deployment of Internet performance monitoring and workload characterization tools     

NetCube: a comprehensive network traffic analysis model based on multidimensional OLAP data cube

Network traffic monitoring and analysis are essential for effective network operation and resource management. In particular, multidimensional analysis for long‐term traffic data is necessary for comprehensive understanding of the traffic trend and effective quality‐of‐service provision considering the extremely dynamic behavior of the current Internet, where various types of traffic occur from high‐speed network links and greatly increasing number of applications. However, only limited analysis results are provided, as the existing network traffic analysis tools and systems are developed and deployed focusing on their own specialized analysis purposes. Consequently, it is difficult to understand the network comprehensively and deeply, which increases the necessity for multilateral analysis of long‐term traffic data. In this paper, we propose a novel traffic analysis model for large volumes of Internet traffic accumulated over a long period of time. The NetCube, the proposed network traffic analysis model using online analytical processing (OLAP) on a multidimensional data cube, provides an easy and fast way to construct a multidimensional traffic analysis system for comprehensive and detailed analysis of long‐term traffic data by utilizing simple OLAP operations and powerful data‐mining techniques on various abstraction levels of traffic data to complete the analysis purpose. We validate the feasibility and applicability of the proposed NetCube traffic analysis model by implementing a traffic analysis system and applying it to our campus network. Copyright © 2012 John Wiley & Sons, Ltd.     

A Factor Analytic Approach to Inferring Congestion Sharing Based on Flow Level Measurements

Internet traffic primarily consists of packets from elastic flows, i.e., Web transfers, file transfers, and e-mail, whose transmissions are mediated via the Transmission Control Protocol (TCP). In this paper, we develop a methodology to process TCP flow measurements in order to analyze throughput correlations among TCP flow classes that can be used to infer congestion sharing in the Internet. The primary contributions of this paper are: 1) development of a technique for processing flow records suitable for inferring congested resource sharing; 2) evaluation of the use of factor analysis on processed flow records to explore which TCP flow classes might share congested resources; and 3)validation of our inference methodology using bootstrap methods and nonintrusive, flow level measurements collected at a single network site. Our proposal for using flow level measurements to infer congestion sharing differs significantly from previous research that has employed packet level measurements for making inferences. Possible applications of our method include network monitoring and root cause analysis of poor performance     

An investigation on TCP large initial window

Transport layer implicates a position where satellite networks form one integrated component of hybrid Internet architecture in today's advance technology. However, the Internet has emerged with an important new class of applications that exhibits significant variations of transmission rate over time. Variable‐rate traffic poses a new challenge for transmission control protocol that provides congestion control, especially for applications that need to share the limited capacity of a bottleneck over a long delay Internet path (e.g. paths that include satellite links). Variable‐rate traffic can be produced by persistent transmission control protocol connections and can be impacted by the initial window at the start or during the restart of a session. Current transport research issues are identified related to larger initial window to highlight the expected performance benefits and derive the implications on the design of geostationary satellite Internet systems as the network evolves toward a next‐generation Internet. Copyright © 2013 John Wiley & Sons, Ltd.     

利用NetFlow技术构建网络异常监测及分析系统

随着互联网的不断普及,网络已经跟人们的日常生活密不可分,使用者在享受网络所带来的便利的同时,网络上的许多问题也陆续衍生而出,运营商网络正面临着日益严重的安全威胁.作为网络管理者,如何迅速有效地监测网络异常情况,同时准确地掌握整个网络的业务流量模型,供市场部门作决策分析,已成为一项重要的课题.介绍了利用NetFlow技术,构建网络异常监测及分析系统,利用本系统可随时监测网络运行情况,以达到网络稳定顺畅运作及节省经费、人力的目的.     

互联网业务流量监测技术的应用和设计

对互联网业务流量监测技术的应用及现状进行了分析，并针对NetFlow技术，对互联网业务流量监测系统建设方案设计中需要考虑的几个重要问题进行了讨论。     

Using a multiple priority reservation MAC to support differentiated services over HFC systems

The successful commercial deployment of Hybrid Fibre/Coaxial (HFC) access networks in the residential market has so far been driven by demand for faster Internet access and the prospects of a host of new services based on real‐time voice and video. To sustain their growth rates and compete with alternative approaches, such as ADSL, they must be enhanced with the capability to efficiently handle quality‐intensive real‐time services. The new multi‐service paradigm mandates isolation of traffic classes, conditioning of entering traffic and preventive control in addition to traditional closed‐loop control. The differentiated services (DiffServ) architecture with its relevant traffic control tools and the bundling of behaviour aggregates is particularly suited to the H/W‐based MAC of HFC systems. It constitutes a suitable framework enabling the support of proliferating real‐time voice‐ and video‐based services while aligning the system to the emerging Internet strategy of scalable service differentiation. The implementation of such a solution in the ACTS 327AROMA research project is presented in this paper. The performance of the system is evaluated using computer simulation. Copyright © 2002 John Wiley & Sons, Ltd.     

Performance of CDMA/PRMA as an Access Technique for Integrated Services in a UMTS High Altitude Platform System

High Altitude Platforms (HAPs) have gained a great interest in recent years. HAP systems will be global in nature but national in service provision. They will deliver IMT-2000 mobile and fixed wireless access using the proposed IMT-2000 terrestrial component radio transmission technologies and protocols. Under the above consideration, in this paper the performance of a MAC protocol based on the combination of the well-known Packet Reservation Multiple Access (PRMA) scheme with Code Division Multiple Access (CDMA) technologies in a Frequency Division Duplex (FDD) mode is studied, for a HAP operating at the 2 GHz frequency band at an altitude of 22 km. The impact of acknowledgement delay has been examined through computer simulations, along with the selection of suitable channel access functions (CAFs) to control the access of mobile users. Moreover the protocol performance is investigated in a cellular HAP environment and compared to that of a ground-based system. Finally, different traffic scenarios have been considered in order to investigate the access delay for non-real time traffic and the packet dropping performance for real time traffic.Nikolaos Batsios received his diploma degree in electrical & computer engineering (Telecommunication Division) from Aristotle University of Thessaloniki (Greece) in 2000. At the end of his studies, his diploma thesis was awarded from ERICSSON Hellas. He was also one of the six finalists of the IEEE Region 8 Student Paper Contest. He has worked as a Research Engineer in Space Engineering S.p.A. (Rome, Italy) and he was involved in ATB, ROBMOD and VIRTUOUS projects. Currently he is working in Intracom S.A. as Telecom Engineer. His research interests are in the field of satellite and terrestrial communication systems including physical layer design, medium access control layer architectures and protocols.Fotini-Niovi Pavlidou received the PhD degree in electrical engineering from the Aristotle University of Thessaloniki, Greece, in 1988 and the diploma in mechanical-electrical engineering in 1979 from the same institution. She is currently an associate professor at the Department of Electrical and Computer Engineering at the Aristotle University engaged in teaching for the under- and post-graduate program in the areas of mobile communications and telecommunications networks. Her research interests are in the field of mobile and personal communications, satellite and HAP communications, multiple access systems, routing and traffic flow in networks and QoS studies for multimedia applications over the Internet. She is involved in many national and international projects in these areas and she has chaired the European COST262 Action on Spread Spectrum Techniques. She has served as a member of the TPC of many IEEE/IEE conferences. She is a permanent reviewer for many international journals. She has published about 80 papers in refereed journals and conferences. She is a senior member of IEEE, currently chairing the joint IEEE VTS & AESS Chapter in Greece.     

基于5G的车联网体系架构及其应用分析

文中立足于车联网及移动通信技术的发展情况,简略阐述了研究背景,介绍了基于5G移动通信技术的车联网体系架构,并以我国某智慧园区为例,从智慧路况监测、远程驾驶、高精度定位、车联网业务平台主系统以及交通信号优化等方面着手,对其应用实例进行了详细分析,旨在为相关研究人员提供参考。     

Can multiscale traffic analysis be used to differentiate Internet applications?

An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. In this paper we will demonstrate that multiscale traffic analysis based on multi-order wavelet spectrum can be used as a discriminator of Internet applications traffic profiles. By performing clustering analysis over the multiscale wavelet spectrum coefficients that are inferred from the measured traffic, the proposed methodology is able to efficiently differentiate different IP applications without using any payload information. This characteristic will allow the differentiation of traffic flows in unencrypted and encrypted scenarios. In order to compare the differentiating potential of different traffic application data, upload, download and joint upload and download flow statistics are considered to evaluate the identification approach for each selected protocol. Moreover, we also evaluate which timescales and spectrum orders are more relevant for the traffic differentiation. From the analysis of the obtained results we can conclude that the proposed methodology is able to achieve good identification results using a small set of timescales of a single order wavelet spectrum of a general raw traffic statistic.     

An efficient mechanism for dynamic multicast traffic grooming in overlay IP/MPLS over WDM networks

This paper proposes an efficient overlay multicast provisioning (OMP) mechanism for dynamic multicast traffic grooming in overlay IP/MPLS over WDM networks. To facilitate request provisioning, OMP jointly utilizes a data learning (DL) scheme on the IP/MPLS layer for logical link cost estimation, and a lightpath fragmentation (LPF) based method on the WDM layer for improving resource sharing in grooming process. Extensive simulations are carried out to evaluate the performance of OMP mechanism under different traffic loads, with either limited or unlimited port resources. Simulation results demonstrate that OMP significantly outperforms the existing methods. To evaluate the respective influences of the DL scheme and the LPF method on OMP performance, provisioning mechanisms only utilizing either the IP/MPLS layer DL scheme or the WDM layer LPF method are also devised. Comparison results show that both DL and LPF methods help improve OMP blocking performance, and contribution from the DL scheme is more significant when the fixed routing and first-fit wavelength assignment (RWA) strategy is adopted on the WDM layer. Effects of a few other factors, including definition of connection cost to be reported by the WDM layer to the IP/MPLS layer and WDM-layer routing method, on OMP performance are also evaluated.     

PCA算法在P2P加密流量识别中的研究与应用

传统的应用层协议识别方法均从改进匹配算法的角度来提高识别率,但是随着P2P协议的发展,其特征呈现多维化的趋势,算法复杂度也随之提高。鉴于此,在对P2P流量的多维特征进行分析并提取后,采用主成分分析(PCA)算法将提取到的特征降维处理,并通过实验证明了该方法在网络流量识别上的可行性和有效性。     

Protection approaches for dynamic traffic in IP/MPLS-over-WDM networks

Due to the explosive growth of data-related traffic driven by the Internet, network reliability becomes an important issue. We investigate various protection approaches to handle failures for dynamic traffic demands in IP/MPLS-over-WDM networks. An LSP can be protected at either the IP/MPLS layer or the optical layer. In IP/MPLS layer protection, an LSP is protected by providing a link-disjoint backup LSP between its end nodes. In optical layer protection, an LSP is protected by the backup lightpath of each lightpath traversed by the LSP. We present two integrated routing algorithms: hop-based integrated routing algorithm and bandwidth-based integrated routing algorithm (BIRA) to set up the restorable bandwidth-guaranteed paths efficiently. Then we present a multilayer protection scheme for multiclass traffic in such networks. This scheme takes into account the different QoS and recovery requirements of the traffic to provide protection capability either at the MPLS layer or at the optical layer in a cost-effective manner. We use the connection blocking probability and number of optical-electrical-optical conversions as performance metrics to compare various protection approaches.     

一种基于应用层特征的BitTorrent流量测量系统的实现

以BitTorrent为代表的对等网络(P2P)应用已经成为最流行的网络信息共享工具,测量与分析对等网络的流量特性对于认识和提升该网络的性能具有重要的意义,如何准确地在Internet流量中识别出BT流量成为此研究的关键问题。在对BitTorrent的流量识别分析过程中,就基于应用层特征的流量识别方法进行了研究,并采用VC 工具在WinPcap网络工具包的基础上,实现了BT流量的测量系统,并根据实验结果验证了此系统的有效性。     

基于车联网的交通流云处理平台研究

Internet of Car, resulting from the Internet of Things , is a key point for the forthcoming smart city. In this article, GPS technology, 3G wireless technology and cloudprocessing technology are employed to construct a cloudprocessing network platform based on the Internet of Car. By this platform, positions and velocity of the running cars , information of traffic flow from fixed monitoring points and transportation videos are combined to be a virtual traffic flow data platform, which is a parallel system with real traffic flow and is able to supply basic data for analysis and decision of intelligent transportation system.     

无线通信网络中流量分析技术综述

对无线网络流量的分析和准确预测是无线网络管理与安全领域的重要研究内容之一,在网络规划、网络监控、流量趋势分析、网络优化以及入侵检测和异常检测等方面发挥着重要作用。介绍了目前典型的无线网络流量分析的模型与常用流量分析方法,综述了传统无线通信网络(如无线局域网和物联网)中的流量分析技术,指出了流量分析技术应用于无线自组网系统的可能性与面临的几点挑战,以及无线自组网系统与流量分析技术结合的发展方向。