Network Flow Research Articles

Asynchronous Record Alignment of Network Flows for Incident Detection and Reconstruction

In today's interconnected digital landscape, the distribution of cyber threats presents a significant challenge to cyber security. Moreover, as of 2016, the amount of data in the world exceeds one zettabyte. Because of this, evidence-based network flow analytics is a critical component of modern network management and security. Problems such as anomalies in the network flow, cyber security incidents, alert generation, data pre-processing, network monitoring, network flow complexity, and data flow patterns become difficult to detect in massive network data flows. These specific problems can be addressed using Packet capture (PCAP). PCAP analysis is a standard network forensics process and investigation for assessing network behaviour and identifying anomalies. This work presents a method for analysing network flows for probable alignment of asynchronously recorded communications in heterogeneous networks. Using a proposed method for alignment, we can identify the relevant recordings aligned over two data streams for faster and more conclusive incident analysis. We use synthetic network incident scenarios for research experiments, detailing the generation of cyber event data and impact on cloud network traffic, followed by in-depth PCAP analysis. The automated cyber-attacks are simulated within a network infrastructure generating network flows in a PCAP format. Simulated cyber-attacks range from standard port scans, service scans, and specific scenarios like SQL injection, phishing, DoS or DDoS. We define analysis objectives and criteria for the in-depth PCAP analysis and alignment. The evidence gathered showcases valuable information about network data flow and its behaviour.

Constrained flows in networks

The support of a flow x in a network is the subdigraph induced by the arcs uv for which x(uv)>0. We discuss a number of results on flows in networks where we put certain restrictions on structure of the support of the flow. Many of these problems are NP-hard because they generalize linkage problems for digraphs. For example deciding whether a network N=(D,s,t,c) has a maximum flow x such that the maximum out-degree of the support Dx of x is at most 2 is NP-complete as it contains the 2-linkage problem as a very special case.Another problem which is NP-complete for the same reason is that of computing the maximum flow we can send from s to t along p paths (called a maximum p-path-flow) in N. Baier et al. (2005) gave a polynomial time algorithm which finds a p-path-flow x whose value is at least 23 of the value of a optimum p-path-flow when p∈{2,3}, and at least 12 when p≥4. When p=2, they show that this is best possible unless P=NP. We show for each p≥2 that the value of a maximum p-path-flow cannot be approximated by any ratio larger than 911, unless P=NP. We also consider a variant of the problem where the p paths must be disjoint. For this problem, we give an algorithm which gets within a factor 1H(p) of the optimum solution, where H(p) is the p'th harmonic number (H(p)∼ln⁡(p)). We show that in the case where the network is acyclic, we can find such a maximum p-path-flow in polynomial time for every p.We determine the complexity of a number of related problems concerning the structure of flows. For the special case of acyclic digraphs, some of the results we obtain are in some sense best possible.

Research on the minimum network loss optimization control strategy of the active distribution network based on the distributed power flow controller

With large-scale access to distributed new energy, the power flow form of the distribution network tends to be complex. The distribution loop network rate increases, resulting in serious circulation of the distribution network, which places significant pressure on the loss of the distribution network. The problem of network loss change caused by distributed new energy grid connection, coupled with the inconsistency between load fluctuation and output power change of distributed new energy, will have a significant impact on the safety, reliability, and economic operation of the distribution network. Therefore, it is urgent to have good economic and technical means of power flow control. This paper proposes a minimum network loss optimization control strategy for active distribution networks based on a distributed power flow controller. First, according to the characteristics of the distribution network load and the new energy power supply along the distribution line, the multiple sub-modules of the distributed power flow controller are arranged in sections in the distribution loop network line. The regulation effect of the distributed power flow controller on the voltage and power flow of the distribution loop network is analyzed. The loop network current equation and power loss equation after the distributed power flow controller are constructed, and the power equation with the minimum active loss of the active distribution loop network is derived. Second, the control strategy for minimum network loss of the active distribution network based on the distributed power flow controller is proposed. Finally, the simulation model of the active distribution loop network is constructed by PSCAD/EMTDC. The loss of the loop network before and after the distributed power flow controller is simulated and analyzed, and the effectiveness of the proposed strategy is verified.

Low dissipative configuration in flow networks subject to constraints

The homothetic relationships for the design of dendritic networks are examined in terms of minimal size under constant flow resistance, and minimum flow resistance under constant size. Based on a comprehensive methodology, we offer a general approach for the homothety ratios of diameters and lengths that apply to different flow regimes and size constraints. In addition, scaling laws for diameters-lengths, sizes-diameters, and resistances-lengths are provided. Since the dendritic trees designed based on size homothety ratios have prefractal characteristics, a methodology for determining prefractal dimensions in terms of fluid flow and size constraint characteristics is also offered. Among the findings, we show that the homothety ratios are the same regardless of whether the functions we selected are used as the constraint or the cost function. The approaches presented and literature data were compared, and a significant degree of agreement was found.The findings presented here not only serve as a tool for the design of microfluidic chip devices but also deepen our understanding of natural networks such as the ones that support the life of mammals.

Thermal performance enhancement of borehole heat exchanger by thermally induced groundwater convection in fractured rock

Thermal performance enhancement of Borehole Heat Exchanger (BHE) was a key to sustain the high effectiveness of this technology. Many measures have been taken to improve heat transfer efficiency of BHE in the past decades. However, all these changes leaded to slight thermal improvement due to restriction of heat conduction dominated heat transfer process in subsurface. To achieve an alternatively higher heat transfer mode of BHE, this study proposes a novel approach to induce groundwater thermal convection in fractured rock. A borehole was backfilled by gravels to sustain free groundwater flow in fracture network. A series of Thermal Response Tests (TRTs) show the fluid temperature of a gravel-filled BHE is 2.0–––2.4 °C lower than a sand-bentonite mixture grouted BHE, indicating the higher cooling efficiency. Two main factors including fracture dip angle and aperture, determine the flow behavior of a fracture network. The flow speed increases linearly with enlarging dip angle and shows a cubic polynomial relation with fracture aperture. Physical model tests show that the BHE induces groundwater convection flow by forming a circuit which couples with heat convection, mitigates the thermal stagnation around a borehole. As a result, thermal performance of a BHE was improved effectively.

Towards efficient waste management: identification of waste flow chains in micro-regional detail through monitored data

AbstractCountries around the world are gradually implementing the transition to a circular economy in waste management. This effort should be initiated already at the waste producers. It is necessary to plan and monitor waste management in as much detail as possible, i.e. at the level of micro-regions. At present, only indicators at the national level are analysed, as more detailed data at the micro-regional level are often not available or are burdened with significant errors and inconsistencies. The calculation of waste management indicators for micro-regions will allow to identify the potential for increasing material or energy recovery and to plan the necessary infrastructure directly to these locations instead of blanket and often ineffective legislative actions. This paper presents an approach for determining the producer-treatment linkage, i.e., provides information about each produced waste, where it was treated, and in what way. Such information is often not available based on historical waste management data as there are repeated waste transfers and often aggregated within a micro-region. The network flow approach is based on an iterative procedure combining a simulation with multi-criteria optimization. The chosen criteria replicate expert estimates in investigated issue such as minimum flow splitting, and minimum transfer micro-regions. A data reconciliation is performed where the deviation from all simulations is minimized, given that the capacity constraints of nodes and arcs resulting from the database must be satisfied. The approach is tested on a generated sample task to evaluate the precision and time complexity of the developed tool. Finally, the presented approach is applied to address a case study in the Czech Republic, within which it is possible to identify treatment location and methods for waste from individual regions.

Data-driven analysis of optimal repositioning policy in bike sharing systems

In this study, we analyze the impact of optimal repositioning policy on the efficiency of bike sharing systems under several performance measures. We first develop a multi-period network flow model to find the optimal repositioning decisions which consist of the origin, destination, and the time of the repositioning that maximize the total profit of a sharing system. We further extend this model to consider demand uncertainty under a stochastic setting. The proposed model is then implemented on the real-world bike-sharing data of New York City, Toronto, and Vancouver. After finding the optimal repositioning policies, we analyze the effect of repositioning on the profit, fulfilled demand, number of required vehicles, and utilization rates of the vehicles. Through computational experiments, we show that repositioning significantly increases the efficiency of a sharing system under these performance measures. In particular, our analyses show that 32% more profit can be obtained and up to 41% more demand can be satisfied with repositioning. Moreover, it is possible to reduce the required fleet size by up to 61% and increase the average utilization rate of the vehicles by up to 21% by employing repositioning.

The Role of the Logistics Operator in the Network Coordination of Omni-Channels

This research aims to bridge a critical gap within the realm of logistics coordination, specifically targeted at bolstering the coordination of flows in omni-channels. The outcome of this study culminates in the creation of a comprehensive tool for evaluating logistics operators, discerning those who exhibit supreme proficiency in orchestrating network dynamics within omni-channel contexts. To fulfil the objectives of this paper and elucidate pertinent research inquiries, an exhaustive literature review is coupled with meticulous scrutiny of the SCOPUS database via the advanced VOSviewer 1.6.20 software. The research delineates an array of coordination mechanisms accessible to logistics operators, which can be judiciously tailored as a bespoke fusion of market-driven, social, hierarchical, and logistical coordination tactics. These mechanisms expand upon antecedent investigations, encompassing both network coordination paradigms and the pivotal role of logistics operators within omni-channel frameworks. Experts assessed that forecasting network flows is the most significant element in logistical coordination, receiving a weight of 0.1312, while managing network participants’ resources from the logistics operator level received a weight of 0.1148. A tangible contribution to the academic discourse transpires as we introduce a pioneering tool meticulously designed for stakeholders entrenched in omni-channel distribution networks. Termed the ‘Multicriteria Assessment Sheet for Evaluating the Coordination Competence of Logistics Operators within Omni-channel Systems,’ this instrument augments the scholarly landscape.

Identifying hemodynamic factors associated with the rupture of anterior communicating artery aneurysms based on global modeling of blood flow in the cerebral artery network

Anterior communicating artery (ACoA) aneurysms are more prone to rupture compared to aneurysms present in other cerebral arteries. We hypothesize that systemic blood flow in the cerebral artery network plays an important role in shaping intra-aneurysmal hemodynamic environment thereby affecting the rupture risk of ACoA aneurysms. The majority of existing numerical studies in this field employed local modeling methods where the physical boundaries of a model are confined to the aneurysm region, which, though having the benefit of reducing computational cost, may compromise the physiological fidelity of numerical results due to insufficient account of systemic cerebral arterial hemodynamics. In the present study, we firstly carried out numerical experiments to address the difference between the outcomes of local and global modeling methods, demonstrating that local modeling confined to the aneurysm region results in inaccurate predictions of hemodynamic parameters compared with global modeling of the ACoA aneurysm as part of the cerebral artery network. Motivated by this finding, we built global hemodynamic models for 40 ACoA aneurysms (including 20 ruptured and 20 unruptured ones) based on medical image data. Statistical analysis of the computed hemodynamic data revealed that maximum wall shear stress (WSS), minimum WSS divergence, and maximum WSS gradient differed significantly between the ruptured and unruptured ACoA aneurysms. Optimal threshold values of high/low WSS metrics were determined through a series of statistical tests. In the meantime, some morphological parameters of aneurysms, such as large nonsphericity index, aspect ratio, and bottleneck factor, were found to be associated closely with aneurysm rupture. Furthermore, multivariate logistic regression analyses were performed to derive models combining hemodynamic and morphological parameters for discriminating the rupture status of aneurysms. The capability of the models in rupture status discrimination was high, with the area under the receiver operating characteristic curve reaching up to 0.9. The findings of the study suggest that global modeling of the cerebral artery network is essential for reliable quantification of hemodynamics in ACoA aneurysms, disturbed WSS and irregular aneurysm morphology are associated closely with aneurysm rupture, and multivariate models integrating hemodynamic and morphological parameters have high potential for assessing the rupture risk of ACoA aneurysms.

Characteristics and prediction of urban interaction networks from the perspective of traffic flow and text information flow

The degree of urban development depends on the degree of closeness between cities, which is reflected in the strength of interactions between cities, such as traffic and information flows. In this research, we compare and analyze the characteristics of urban interaction networks (UINs) at two spatial scales in Shandong Province and the whole country from two different perspectives of traffic flow and information flow and validate the spatial interaction characteristics reflected in the material space traffic flow from the perspective of textual spatial information flow. The UIN is constructed based on Tencent migration big data, and the assortative coefficient method is introduced to explore the assortative and interaction characteristics between core cities and edge cities in the traffic flow network. Introducing deep learning methods on a larger scale, the GCN_CD model is proposed for semi-supervised classification of nodes to realize community discovery for both traffic flow and information flow networks. The spatial interaction intensity prediction model [Formula: see text] is constructed taking into account geographic features, which improves the prediction accuracy. The results show that from the perspectives of traffic flow and text information flow, the urban interactive network in Shandong Province has the characteristics of Scale-Free and Small-World, showing certain homogeneity and strong spatial interaction. Shandong Province’s UIN formed Jinan, Qingdao, and other cities as the core, satellite cities around, the east and west ends of the remote echo structure. From the perspective of traffic flow, the national urban interactive network presents a jumping distribution, with a single core city as the dominant distribution structure. From the perspective of information flow, the dividing line between the eastern and western communities is obvious, and the internal aggregation of the community is strong. Distance attenuation effects have an impact on the strength of spatial interactions.

Monitoring the power flow of a low voltage distribution network using public lighting infrastructure

The production of renewable energy sources can change rapidly in a short period of time, making monitoring the power quality of Low Voltage Distribution Networks (LVDNs) one of the biggest challenges for Distribution System Operators (DSOs). An LVDN can overload some equipment if it does not monitors voltage profiles, voltage unbalance and reverse apparent power flow. Therefore, we propose a monitoring system that uses the Public Lighting Infrastructure (PLI), which is fed directly by the LVDN, to monitor the LVDN. It is based on remote management relays installed in the PLI, and replaces the installation of a power quality analyzer (PQ). The system has been empirically validated and the results show that the proposed system can identify reverse apparent power flow, profiles, and voltage unbalance with an average absolute error of 0.096% compared to a professional PQ analyzer. The proposed system can be a relevant contribution to the challenge of power quality monitoring, with cost savings; for example, DSOs can use the proposed system to access real-time information in the LVDN through a low-cost data acquisition model, without the need to send a team to install a PQ analyzer in the LVDN and then obtain the data.

Regional resilience and the network structure of inter-industry labour flows

ABSTRACT This paper explores how the network structure of local inter-industry labour flows relates to regional economic resilience across 72 local labour markets in Sweden. Drawing on recent advancements in network science, we stress test these networks against the sequential elimination of their nodes, finding substantial heterogeneity in network robustness across regions. Regression analysis with least absolute shrinkage and selection operator (LASSO) in the context of the 2008 financial crisis indicates that labour flow network robustness is a prominent structural predictor of employment change during crisis. These findings elaborate on how variation in the self-organisation of regional economies as complex systems makes for more or less resilient regions.

GNN-Based Network Traffic Analysis for the Detection of Sequential Attacks in IoT

This research introduces a novel framework utilizing a sequential gated graph convolutional neural network (GGCN) designed specifically for botnet detection within Internet of Things (IoT) network environments. By capitalizing on the strengths of graph neural networks (GNNs) to represent network traffic as complex graph structures, our approach adeptly handles the temporal dynamics inherent to botnet attacks. Key to our approach is the development of a time-stamped multi-edge graph structure that uncovers subtle temporal patterns and hidden relationships in network flows, critical for recognizing botnet behaviors. Moreover, our sequential graph learning framework incorporates time-sequenced edges and multi-edged structures into a two-layered gated graph model, which is optimized with specialized message-passing layers and aggregation functions to address the challenges of time-series traffic data effectively. Our comparative analysis with the state of the art reveals that our sequential gated graph convolutional neural network achieves substantial improvements in detecting IoT botnets. The proposed GGCN model consistently outperforms the conventional model, achieving improvements in accuracy ranging from marginal to substantial—0.01% for BoT IoT and up to 25% for Mirai. Moreover, our empirical analysis underscores the GGCN’s enhanced capabilities, particularly in binary classification tasks, on imbalanced datasets. These findings highlight the model’s ability to effectively navigate and manage the varying complexity and characteristics of IoT security threats across different datasets.

Day-to-day behaviour for pedestrians in a circle antipode scenario: experiment and simulation

This study aims to investigate the behavioural evolution patterns of pedestrians who repeatedly traverse the same scenarios. To accomplish this objective, we implemented a repeated circle antipode experiment, ensuring consistent conditions for all participants. This experimental design allows for an effective examination of participant performance across multiple rounds. Our findings revealed that specific walking characteristics experienced significant changes with the progression of successive experiments, and participants demonstrated notable differences in their chosen routes. Recognizing the ability of the day-to-day dynamic model to describe the evolution of network flows and the similarities between traffic and pedestrian flows, we apply the modelling approach of the day-to-day dynamic model to the construction of pedestrian route choice modelling. Consequently, we developed a series of round-to-round pedestrian route choice models to characterize our experiment. These models factored in both historical walking experiences and the influence of neighbours. Our model proved to be reliable, achieving a route choice accuracy of approximately 80% in simulations of circle antipode experiments. The results of this study can provide valuable insights into pedestrian dynamics, aiding in understanding pedestrian behaviour during repetitive walking and facilitating the development of more accurate round-to-round route choice models.

Influence of inertial and centrifugal forces on rate and flow patterns in natural fracture networks

Fluid production from fractured rock masses readily induces fracture flow velocities of meters per second. Yet, most discrete fracture flow models treat flow as laminar creeping flow or account for inertia effects only by single-fracture constitutive relationships.This numeric simulation study investigates water flow patterns and spatial velocity variations in a natural fracture network with mm-wide open fractures, studying the transition from laminar creeping to turbulent flow. After verification with a fracture intersection model, a Reynolds-time-averaged Navier Stokes solver serves to analyse flow regimes and velocity distribution. Our results show that for fracture flow velocities greater than ∼1-cm/s, fluid inertia begins to markedly alter flow patterns and the overall velocity distribution in the network. The pressure-gradient-flow relationship therefore becomes non-linear long before the flow in straight fractures enters the weak inertia regime. This prominence of inertia effects highlights the need to improve fracture network flow models.

Machine learning-enabled hybrid intrusion detection system with host data transformation and an advanced two-stage classifier

Network Intrusion Detection Systems (NIDS) have been extensively investigated by monitoring real network traffic and analyzing suspicious activities. However, there are limitations in detecting specific types of attacks with NIDS, such as Advanced Persistent Threats (APT). Additionally, NIDS is restricted in observing complete traffic information due to encrypted traffic or a lack of authority. To address these limitations, a Host-based Intrusion Detection system (HIDS) evaluates resources in the host, including logs, files, and folders, to identify APT attacks that routinely inject malicious files into victimized nodes. In this study, a hybrid network intrusion detection system that combines NIDS and HIDS is proposed to improve intrusion detection performance. The host data undergoes a Language Processing (NLP)-based Bidirectional Encoder Representations from Transformers (BERT) model from textual representation to a numerical one in order to process host data in a similar way to the network flow data through machine learning models. The feature flattening technique is applied to flatten two-dimensional host-based features that is provided by BERT into one-dimensional vectors so that host-based and network flow-based features can be processed by advanced Machine Learning (ML) models. In order to enhance HIDS effectiveness, a two-stage collaborative classifier is utilized, which applies two tiers of machine learning algorithms, binary and multi-class classifiers, to detect network intrusions. Once a binary classifier is used to detect benign samples to reduce the complexity of the original problem, the attack data are classified by a multi-class supervised learner to identify attack types. Hence, the overall performance of the two-stage collaborative model outperforms the baseline classifier, XGBoost. The proposed method is shown to generalize across two well-known datasets, CICIDS 2018 and NDSec-1. The performance of XGBoost, which represents conventional ML, is evaluated. Combining host and network features enhances attack detection performance (macro average F1 score) by 8.1% under the CICIDS 2018 dataset and 3.7% under the NDSec-1 dataset. Meanwhile, the two-stage collaborative classifier improves detection performance for most single classes, especially for DoS-LOIC-UDP and DoS-SlowHTTPTest, with improvements of 30.7% and 84.3%, respectively, when compared with the traditional ML models.

Physical and monetary characterization of global nickel flow network

Nickel is a critical material to industrial applications and future low-carbon societies, due to its essential role in the steel industry and batteries. This study employs a combination of material flow analysis and complex network analysis to delve into the global nickel resource - its production, trade, and usage patterns, as well as their associated impacts. Results reveal an uneven global nickel trade distribution in 2021, necessitating an expansive trade network involving 232 countries and regions. Most trade activity was seen in intermediate nickel products, especially from Indonesia to China. Key commodities traded included ferronickel, nickel metal, stainless steel, and engineering products. Twenty core countries, including China, the U.S., and Indonesia, emerged as key nodes, dominating 74% of global nickel trade value, indicating concentrated production and trade activities. Developed countries typically occupied high value-added links in the industry chain. In terms of unit price of nickel, China benefited most per unit exported, while Australia incurred the highest import cost. Drawing on these findings, the study proposes several policy recommendations to enhance the sustainability of the nickel supply.

Normalized flow networks and generalized information aided PR dynamic analysis

This paper introduces a novel approach utilizing normalized flow networks (NFNs) for dynamic personal risk (PR) analysis, specifically focusing on the assessment of two-way data rates at network nodes. NFNs, a sophisticated paradigm in data processing and modeling derived from machine learning principles, serve as the foundational framework for our analysis. Leveraging NFNs, we develop a generalized method that integrates information transmission techniques into PR dynamics, enabling a comprehensive examination of communication efficacy within network structures. Our study entails the formulation of dynamic models tailored to capture the evolving nature of PR interactions, facilitating the evaluation of data rates exchanged between network nodes. Through extensive simulations and empirical validation, we demonstrate the effectiveness of our approach in elucidating the intricate dynamics of PR campaigns and quantifying the impact on the network performance. The findings underscore the significance of leveraging NFNs for dynamic PR analysis, offering valuable insights into optimizing communication strategies and enhancing network efficiency in diverse domains.

Unpacking the effects of R&D strategy proximity on inter-firm knowledge flow: evidence from the global 3D printing industry

ABSTRACT The determinants of inter-organisational knowledge flow have shifted from bilateral and static factors to network and dynamic factors. Therefore, this paper aims to explore the impact mechanism of firms’ dynamic behaviours on knowledge flow in a multiplex inter-firm strategy proximity network. The paper proposes a conceptual model to examine how the different research and development (R&D) dynamic strategies impact the inter-firm knowledge flow from a network-to-network lens, considering the moderating effect of the firm size heterogeneity. To test the hypotheses, we conducted an empirical study on 150 listed firms in the global 3D printing industry from 2005 to 2016 using multi-source heterogeneous data and Quadratic Assignment Procedure (QAP) regression model. Results show that the proximities of the R&D internationalisation strategy and R&D domain strategy are positively associated with the inter-firm knowledge flow. Firm size heterogeneity plays a moderating role, and these effects vary at different stages of industrialisation.

Modeling MobilityCoins—Charges, Incentives and Multi-period Budgets in Multimodal Transportation Networks

MobilityCoins are a tradable mobility credit (TMC) scheme variant. TMC schemes are a cap-and-trade scheme for managing mobility that are designed to limit negative externalities, e.g., congestion, of traffic. Next to having link-specific or origin–destination-specific charges for cars as in the common TMC scheme, the MobilityCoin scheme’s distinctive elements are accommodating link-specific and origin-and-destination-specific charges and incentives for all modes of transport as well as being considered a mobility currency that can be earned, saved, and spent in multiple time periods. These distinctive features of the MobilityCoin scheme does not alter the core behavioral mechanism of TMC schemes of increasing car travel costs, but these features interfere with the credit market in terms of market volume and market price that ultimately affects traffic outcomes, e.g., an uncontrolled market volume increase can lower the market price that in turns increases the attractiveness of using the car. In this paper, we develop a mathematical model of multimodal macroscopic network flows and a MobilityCoin market to investigate the impacts of charges, incentives, and multi-period budgets. The model is implemented as a single-day model with an integration of sensitivity for multi-period budgets to study how the outcomes in the transportation system change with charges, incentives, and multi-period budgets. Further, we discuss implications for the policy design of MobilityCoins schemes.