Complex Network Environment Research Articles

Comparison of Gain Ratio and Chi-Square Feature Selection Methods in Improving SVM Performance on IDS

An intrusion detection system (IDS) is a security technology designed to identify and monitor suspicious activity in a computer network or system and detect potential attacks or security breaches. The importance of accuracy in IDS must be addressed, given that the response to any alert or activity generated by the system must be precise and measurable. However, achieving high accuracy in IDS requires a process that takes work. The complex network environment and the diversity of attacks led to significant challenges in developing IDS. The application of algorithms and optimization techniques needs to be considered to improve the accuracy of IDS. Support vector machine (SVM) is one data mining method with a high accuracy level in classifying network data packet patterns. A feature selection stage is needed for an optimal classification process, which can also be applied to SVM. Feature selection is an essential step in the data preprocessing phase; optimization of data input can improve the performance of the SVM algorithm, so this study compares the performance between feature selection algorithms, namely Information Gain Ratio and Chi-Square, and then classifies IDS data using the SVM algorithm. This outcome implies the importance of selecting the right features to develop an effective IDS.

SYNTROPY: TCP SYN DDoS attack detection for Software Defined Network based on Rényi entropy

The rapidly evolving landscape of network security, particularly in Software Defined Networks (SDNs), presents a critical need for efficient and adaptive DDoS attack detection methods, especially in the face of TCP SYN DDoS attacks. These attacks pose significant threats to network resources and service availability. Current state-of-the-art solutions, predominantly based on Shannon entropy, have inherent limitations, that give equal weightage to all frequency probability. This inherent assumption often leads to inadequate detection in complex and dynamic network environments, where attack patterns are increasingly sophisticated and variable. In this paper, we present a novel framework called SYNTROPY that is designed to detect TCP SYN DDoS attacks in SDN environments. The proposed SYNTROPY framework leverages Rényi entropy to effectively generalize the measurement of uncertainty in the network traffic. Unlike Shannon entropy, Rényi entropy offers the flexibility to adjust sensitivity to varying network conditions and attack patterns, thereby enhancing detection accuracy. It filters benign, flash, and suspicious traffic and employs a min–max threshold to identify attack patterns accurately. Our framework is implemented using the Ryu Controller, thus enabling seamless integration with SDN systems. The experiment is conducted to evaluate the SYNTROPY performance using the CAIDA UCSD DDoS 2007 Attack Dataset. The comparative analysis demonstrates that SYNTROPY performs better across various metrics than state-of-the-art solutions. It includes a 40% reduction in average CPU load, 59% enhancement in average detection time, 13% increase in true positives rate, 34% decrease in false negatives rate, 10% recall improvement, and 8% higher F1-Score. These promising results showcase the potential of SYNTROPY as a robust and effective solution for addressing TCP SYN DDoS attacks in SDNs.

Formal Analysis of DTLS-SRTP Combined Protocol Based on Logic of Events

Security analysis of composite protocols is a critical issue in the field of network security. In complex network environments, the traditional approach of analyzing a single protocol becomes inadequate when dealing with scenarios involving multiple interactions and combinations of protocols. To address this challenge, this paper extends the Logic of Events Theory (LoET) and proposes a method for proving the security of composite protocols. Building upon the Logic of Events Theory, we introduce sequential composition rules, ordering rules, and relevant axioms. We incorporate the concept of invariants and formally abstract the DTLS-SRTP protocol, thereby verifying the mutual authentication and confidentiality of the two sub-protocols. In conclusion, our study demonstrates that the extended Logic of Events Theory offers an effective means of verifying the security of composite protocols.

Big Data Anomaly Prediction Algorithm of Smart City Power Internet of Things Based on Parallel Random Forest

Abstract Conventional power data prediction algorithms easily lead to the loss of key power data in a complex wireless network environment. Therefore, a power big data anomaly prediction algorithm based on parallel random forest is proposed. According to the power big data anomaly prediction algorithm based on parallel random forest, a network power big data anomaly prediction algorithm platform is established, and based on the platform, key data features such as user address and power transmission packet structure are extracted according to the category of power users. According to the relationship between power shunt function value and power data unit density, the parameter value of the system and finally the reasonable anomaly prediction of power big data in wireless network are determined. Finally, filter the classified data through attribute reduction and gene expression programming algorithm to obtain the data to be encrypted and complete the research on the anomaly prediction algorithm of power big data. Experimental results show that the proposed algorithm has better prediction performance and can ensure better data prediction effect.

MVDet: Encrypted malware traffic detection via multi-view analysis

Detecting encrypted malware traffic promptly to halt the further propagation of an attack is critical. Currently, machine learning becomes a key technique for extracting encrypted malware traffic patterns. However, due to the dynamic nature of network environments and the frequent updates of malware, current methods face the challenges of detecting unknown malware traffic in open-world environment. To address the issue, we introduce MVDet, a novel method that employs machine learning to mine the behavioral features of malware traffic based on multi-view analysis. Unlike traditional methods, MVDet innovatively characterizes the behavioral features of malware traffic at 4-tuple flows from four views: statistical view, DNS view, TLS view, and business view, which is a more stable feature representation capable of handling complex network environments and malware updates. Additionally, we achieve a short-time behavioral features construction, significantly reducing the time cost for feature extraction and malware detection. As a result, we can detect malware behavior at an early stage promptly. Our evaluation demonstrates that MVDet can detect a wide variety of known malware traffic and exhibits efficient and robust detection in both open-world and unknown malware scenarios. MVDet outperforms state-of-the-art methods in closed-world known malware detection, open-world known malware detection, and open-world unknown malware detection.

Community relations discovery methods for users in Fancircle based on sentiment analysis in China

PurposeThe identification of network user relationship in Fancircle contributes to quantifying the violence index of user text, mining the internal correlation of network behaviors among users, which provides necessary data support for the construction of knowledge graph.Design/methodology/approachA correlation identification method based on sentiment analysis (CRDM-SA) is put forward by extracting user semantic information, as well as introducing violent sentiment membership. To be specific, the topic of the implementation of topology mapping in the community can be obtained based on self-built field of violent sentiment dictionary (VSD) by extracting user text information. Afterward, the violence index of the user text is calculated to quantify the fuzzy sentiment representation between the user and the topic. Finally, the multi-granularity violence association rules mining of user text is realized by constructing violence fuzzy concept lattice.FindingsIt is helpful to reveal the internal relationship of online violence under complex network environment. In that case, the sentiment dependence of users can be characterized from a granular perspective.Originality/valueThe membership degree of violent sentiment into user relationship recognition in Fancircle community is introduced, and a text sentiment association recognition method based on VSD is proposed. By calculating the value of violent sentiment in the user text, the annotation of violent sentiment in the topic dimension of the text is achieved, and the partial order relation between fuzzy concepts of violence under the effective confidence threshold is utilized to obtain the association relation.

SIM+: A comprehensive implementation-agnostic information model assisting AI-driven optimization for beyond 5G networks

Forthcoming beyond 5G (B5G) network systems are expected to introduce a new era in the mobile networks, supporting new and challenging use cases and applications. This new era will provide ubiquitous connection of up to billions of devices that are estimated to generate vast amounts of data, paving the way towards a data-driven network system design. In such network design, Artificial Intelligence (AI) will act as a key enabler with regard to network system automation and optimizations. One of the biggest challenges for AI in such complex and dynamic network environments, is the interoperability in terms of seamless exchange and analysis of information between two or more systems. Technological interoperability requires that the format in which data is generated or stored is standardized and that interconnected systems are aware of the nature of transmitted information and are able to analyze it. This paper proposes a novel, comprehensive Information Model (IM), named as SIM+, that extends all across the network, describing different network entities, attributes, capabilities and operations in an implementation-agnostic and standardized way towards assisting AI-driven optimizations. Seven key abstraction layers have been identified in an attempt to hide infrastructure complexities. The adaptability of the proposed SIM+ is showcased through its application in two state-of-the-art AI-driven solutions.

Bandwidth estimation in network probing techniques utilizing min-plus algebraic methods

Bandwidth estimation in network probing techniques plays a crucial role in modern networks, particularly in ensuring superior Quality of Service (QoS). This is largely influenced by advancements in IEEE 802.11 standards, which aim to enhance service performance. Existing methodologies are designed to assess the available resources on a given channel, providing valuable support for bandwidth-constrained applications. However, these methods encounter limitations due to potential non-linearities within networks. The current approach leverages min-plus algebra from network calculus, which, although effective, falls short in certain dynamic scenarios. In this research, we propose a novel methodology for bandwidth estimation by integrating other state-of-the-art QoS protocols while maintaining the foundational principles of the min-plus algebra technique. This approach aims to develop a more versatile and adaptable system, better suited for complex network environments.

Simulation of network traffic risk of enterprise cloud financial system by using deep learning

Traditional network traffic analysis methods fall short in addressing the requirements of complex network environments. Therefore, the introduction of advanced technologies, such as deep learning, is necessary to enhance the accuracy and efficiency of network traffic analysis. This paper designs a risk analysis method of enterprise cloud financial system network traffic based on deep learning to improve the level and effect of network security assurance. A deep learning based traffic analysis framework has been constructed, which includes several main steps such as data preprocessing, feature extraction, model training, and result evaluation. The test results on the experimental data set show that this method can identify network attacks and abnormal traffic more quickly and accurately than the traditional network traffic analysis methods, and has better practicability and application prospects.

Assurance of Network Communication Information Security Based on Cyber-Physical Fusion and Deep Learning

The internet brings high efficiency and convenience to society; however, the issue of information security in network communication has significantly affected every aspect of the society. How to ensure the security of this network communication information has become an important research topic. This paper proposes a diagnosis and prediction method based on cyber-physical fusion and deep learning, such as LSTM and CNN, to diagnose and predict network security in a complex network environment. The experiment results showed that the accuracy of network security diagnosis of the LSTM method in the training set was approximately 80%/ After the CNN training process, it has the highest accuracy rate of 95% on the test data set. This paper analysed the nature of network security problems from the perspective of cyber-physical fusion. CNN-based method to diagnose network security can obtain results with a higher accuracy rate so that technicians can better take measures to protect network security.

VNF Migration in Digital Twin Network for NFV Environment

Network Function Virtualization (NFV) allows for the dynamic provisioning of Virtual Network Functions (VNFs), adapting services to the complex and dynamic network environment to enhance network performance. However, VNF migration and energy consumption pose significant challenges due to the dynamic nature of the physical network. In order to maximize the acceptance rate of Service Function Chain Requests (SFCR), and reduce VNF migration and energy consumption as much as possible, we summarize several related factors such as the node hosting state, link hosting state, energy consumption, migrated nodes, and whether the mapping is successful. We define the Markov decision process by considering the factors mentioned above. Next, we design the VNF migration algorithm utilizing actor–critic models, graph convolution networks, and LSTM networks. In order to reduce the risk of trial and error during training and prediction in deep reinforcement learning scenarios, we designed a network architecture based on a digital twin (DT). In simulation experiments, compared with the FF algorithm that greedily selects the first available node, our AC_GCN algorithm significantly improves the acceptance rate of SFC requests by 2.9 times more than the FF algorithm in small topology experiments, and 27 times more than the FF algorithm in large topology experiments. Compared with the deep reinforcement learning (DRL) algorithm, which does not consider all the above factors together, for the small topology experiment, our AC_GCN algorithm outperforms the DRL algorithm in terms of request acceptance rate by 13%, underperforms compared to the DRL algorithm in terms of energy consumption by 3.8%, and underperforms compared to the DRL algorithm in terms of the number of migrated nodes for 22%; for the large topology experiment, our AC_GCN algorithm outperforms the DRL algorithm in terms of the request acceptance rate by 7.7%, outperforms the DRL algorithm in terms of energy consumption by 0.4%, and outperforms the DRL algorithm in terms of the number of migrated nodes by 1.6%.

Quality of Service Management Solution Becomes a Software-Defined Network Challenge

The use of Software-Defined Networking (SDN) has created a huge leap in the management of computer networks. SDN offers flexibility and the ability to dynamically manage networks, but along with its advantages, it also brings significant challenges in managing quality of service (QoS). QoS is critical to maintaining performance and user experience in increasingly complex and distributed network environments. The research method uses Solution Development to address a quality of service (QoS) management challenge and solution in Software Defined Networking with the approach of designing and developing practical solutions to address QoS management issues and challenges in SDN environments. Control Separation and Data Plane are centralized network control at the SDN controller, while the data plane reside in the networks hardware, both capable of maintaining QoS and a challenges in SDN with a computer network approach that separates the control layer from the data layer, enabling more flexible and centralized network management. Research conclusions related to SDN Software Defined Networking quality of service management problems and solutions, focusing on the problem of separating management and data levels. The separations of control and data plane concept in SDN has great potential to improve flexibility, scalability and more efficient network management.

Learning-Based Real-Time Transmission Control for Multi-Path TCP Networks

The evolution of the Internet of Things and 5G/6G networks is ushered in the exponential proliferation of mobile devices with multiple wireless interfaces. Multi-Path TCP (MPTCP) is a widely used protocol that provides reliable connections with multiple parallel paths for these devices. To cope with the increasingly complex multi-path network environments, some learning-based methods have been proposed to achieve better control than existing heuristic methods in congestion control and multi-path scheduling. However, most learning-based efforts use Deep Reinforcement Learning (DRL) requiring the agent and the environment to evolve alternatively, which cannot adapt to the constantly active MPTCP networks. In this paper, we propose Real-time Multi-path Transmission Control (RMTC), a cognitive framework that achieves real-time congestion control and multi-path scheduling in MPTCP networks, allowing the agent and the environment to evolve simultaneously. It adopts the Multi-Agent DRL (MADRL) to improve the granularity of the control and handle the change in the number of sub-flows. Besides, RMTC develops a pacing mechanism in MPTCP connections for all congestion control algorithms to alleviate network fluctuations, which helps the agent make accurate decisions. Extensive experimental results show that RMTC obtains better network performance than existing learning-based or heuristic methods and considers TCP-friendliness and the Head-of-Line (HoL) blocking problems.

Multi-stage data synchronization for public blockchain in complex network environment

The various node connecting ways make the public blockchain live in a complex network environment. Single network model, no matter whether synchronized network, partial asynchronous network, or pure asynchronous network, are failed to accurately describe the practical public network environment. This results in the data synchronization and consensus achievement in public blockchain facing a dilemma, either relies on a weak timing assumption or adopts the strict asynchronous assumption but accepts a complex method.To address this dilemma, in this paper, we propose a multi-stage data synchronization (MSDS) mechanism for the public blockchain. First, we define the complex network for public blockchain in which nodes can join or leave freely. Then, data synchronization is been proven as a sufficient but not necessary condition for consensus. Second, a new kind of block structure called the block abstraction (BA) is proposed to quickly determine the relevance between different blocks. A new epoch-based DAG is proposed in which synchronizations of unrelated per-order blocks are reduced within an epoch. Then, a novel base-address PoW protocol is proposed to screen out nodes who have finished the synchronization and block verification of the previous epoch. Finally, a dual-phase consensus is conducted to achieve consensus that does not rely on timing assumptions on block generation and data synchronization while preventing the adoption of complex asynchronous consensus mechanisms. Extensive experiments are conducted on real data from Bitcoin and Ethereum and the results demonstrate the effectiveness and efficiency of our proposal.

ACC-RL: Adaptive Congestion Control Based on Reinforcement Learning in Power Distribution Networks with Data Centers

Modern data center power distribution networks place greater demands on the stability and reliability of power supply. Growing network computing demands and complex network environments can cause network congestion, which in turn leads to network traffic overload and power supply equipment overload. Therefore, network congestion is one of the most important problems faced by data center power distribution networks. In this paper, we propose an approach called ACC-RL based on reinforcement learning (RL), which can effectively avoid network congestion and improve energy performance. ACC-RL models the congestion control task as a Partially Observable Markov Decision Process (POMDP). It is independent of the estimated value function and supports deterministic policies. It also sets the reward value function using real-time network information such as the transmission rate, RTT, and switch queue length, with the target transmission rate as the target equilibrium point. ACC-RL is highly general, can be trained on datasets running in different network environments, and generates a robust congestion control policy. The experimental results show that ACC-RL can solve the congestion problem without any predefined scenarios in different network environments. It can control the network traffic well, thus ensuring the stability and reliability of the power supply in the distribution network. We conduct network simulation experiments through NS-3. We set up different scenarios for experiments and data analysis in many-to-one, all-to-all, and long–short network environments. Compared with the popular rule-based congestion control algorithms such as TIMELY, DCQCN, and HPCC, ACC-RL shows different degrees of energy performance advantages in network metrics such as fairness, link utilization, and throughput.

Improving the Performance of OLSR in Wireless Networks using Reinforcement Learning Algorithms

The Optimized Link State Routing Protocol is a popular proactive routing protocol used in wireless mesh networks. However, like many routing protocols, OLSR can suffer from inefficiencies and suboptimal performance in certain network conditions. To address these issues, researchers have proposed using reinforcement learning algorithms to improve the routing decisions made by OLSR. This paper explores the use of three RL algorithms - Q-Learning, SARSA, and DQN - to improve the performance of OLSR. Each algorithm is described in detail, and their application to OLSR is explained. In particular, the network is represented as a Markov decision process, where each node is a state, and each link between nodes is an action. The reward for taking an action is determined by the quality of the link, and the goal is to maximize the cumulative reward over a sequence of actions. Q-Learning is a simple and effective algorithm that estimates the value of each possible action in a given state. SARSA is a similar algorithm that takes into account the current policy when estimating the value of each action. DQN uses a neural network to approximate the Q-values of each action in a given state, providing more accurate estimates in complex network environments. Overall, all three RL algorithms can be used to improve the routing decisions made by OLSR. This paper provides a comprehensive overview of the application of RL algorithms to OLSR and highlights the potential benefits of using these algorithms to improve the performance of wireless networks.

Hier-SFL: Client-edge-cloud collaborative traffic classification framework based on hierarchical federated split learning

Network traffic classification technology is widely noticed by internet service providers(ISP), in order to monitor network security status, improving knowledge of users’ traffic demands and then ulterior design policing and prioritization mechanisms. With the continuous development of deep learning technology, network traffic classification technology starts to use supervised learning paradigm to automate traffic identification by extracting some features. However, due to the continuous emergence of new private protocols, network services and access devices, the overall distribution of network traffic data is constantly changing. The training of network traffic classification models usually relies on the labeled data collected by academic organizations, institutions and companies. These data are usually generated in a fixed network environment, and the types of labels collected are limited. Models trained in this way are difficult to adapt to the open and complex network environment. Furthermore, the unevenly distributed computing resources affect the model training efficiency because the collected traffic data is usually concentrated in the end system but the computing power is generally concentrated in the edge computing nodes and cloud centers. Federated learning technology can coordinate data holders to train globally adapted models from discrete data. At the same time, split learning technology can realize more efficient model separation training. In this paper, we designed a new three-tier algorithm Hier-SFL combining and improving these two learning frameworks according to the common client-edge-cloud structure. Hier-SFL algorithm allocated the training task of neural network to each level network device with different computing resources. Also, it took the advantage of federated learning to periodically aggregate network parameters. Thus, we significantly improved the training efficiency of the deep learning model of traffic classification.

Energy‐efficient data transmissions in heterogeneous ultra‐dense networks using a hybrid metaheuristic optimization

SummaryThe heterogeneous ultra‐dense network (UDN) is a complex network environment where the small cells (SCs) are densely populated to acquire data transmission. The UDN is mainly adopted to deal with the explosive growth of mobile data and its consequential energy consumption issues. The UDN consists of mobile users, restricting the SCs from offering seamless services as the movement may disrupt the transmissions. To provide an effective solution, this paper introduces an energy‐efficient framework that enables effective data transmissions irrespective of the users' mobility. The proposed model considers the clustered SC deployment where the four‐tiered architecture is adopted. The architecture includes a macro base station (BS), microcells, picocells, and femtocells. The SCs are responsible for transferring the data received from the mobile users to the macro BS. The proposed model introduces the hybrid algorithm called the firefly oriented multiverse optimization (FF‐MVO) algorithm to identify the most optimal path for data transmission. This algorithm works iteratively to identify the optimal path to reach the macro BS for each transmission from the user. The proposed model is simulated in the network simulator 3 (NS3) platform, and the results are evaluated with the existing models. The outcomes proved that the proposed algorithm is more optimal than the other models in finding the optimal path to result in energy‐efficient transmissions. The proposed method achieved an average energy consumption of 0.24 J, an average energy efficiency of 10.965 bits/s/J and an average network throughput of 33.907 Gbps.

Retracted: Application of Punitive Damages in Intellectual Property Law in Complex Network Environment.

[This retracts the article DOI: 10.1155/2022/4806045.].

Collaborative cloud-edge-end task offloading with task dependency based on deep reinforcement learning

With the explosive growth of the Internet of Things (IoT), IoT devices generate massive amounts of data and demand, which poses a huge challenge to IoT devices with limited CPU computing capability and battery capacity. Due to the dependency relationship in complex applications and network environments, effective offloading in such scenarios is complicated. In this paper, we address the problem of computation offloading with task dependency in the cloud–edge-end collaboration scenario including multi-user, multi-core edge servers, and a cloud server. We model multiple task dependencies using the directed acyclic graph (DAG) and formalize the offloading problem as a multi-objective mixed integer optimization problem. To solve this problem, a Task Priority and Deep Reinforcement learning-based Task Offloading algorithm (TPDRTO) is proposed. The task offloading decision is represented as a Markov Decision Process (MDP). Meanwhile, based on the task priority, an optimized Deep Reinforcement Learning (DRL) method with action-mask is proposed to leverage the computing resources of the cloud and edge servers and obtain the optimal policies of computation offloading. Experimental results show that the TPDRTO algorithm can effectively tradeoff and reduce the average energy consumption and time delay of IoT devices.