Network Traffic Behaviour Research Articles

Mobile Botnet Detection A Machine Learning Approach using SVM

The security and privacy of smartphone users are seriously threatened by mobile botnets, which allow malevolent actors to carry out a variety of illegal actions, such as DDoS attacks, data theft, and resource exploitation. These mobile botnets are becoming more and more sophisticated, making it difficult to detect them with conventional signature-based and heuristic methods. This study proposes a machine learning-based method for mobile botnet detection that makes use of Support Vector Machines (SVM).The study focuses on behavioural feature extraction from mobile device system-level data and network traffic. The SVM model is used for classification once feature selection techniques have been used to select the most pertinent and discriminative attributes. The SVM model, making use of its capacity to manage nonlinear classification and high-dimensional data.Tests carried out on a variety of network traffic and system behaviour datasets gathered from mobile devices show encouraging outcomes for the detection of botnets. Compared to conventional detection techniques, the SVM classifier outperforms them in identifying mobile botnet activities with a high degree of accuracy, precision, and recall.The suggested SVM-based method improves mobile device security by offering a flexible and successful mobile botnet detection solution. The results of this study open the door to the development of strong and durable mobile security systems by providing insights into the proactive identification and mitigation of mobile botnet threats through the use of machine learning techniques

Intrusion Detection in Big Data Era: A Multi- Objective Approach for Longer Model Lifespans

Despite highly accurate intrusion detection schemes based on machine learning (ML) reported in the literature, changes in network traffic behaviour quickly yield low accuracy rates. An intrusion detection model update is not easily feasible due to the enormous amount of network traffic to be processed in near real-time for high- speed networks, in particular, under big data settings. In this paper, we propose a new scalable long-lasting intrusion detection architecture for the processing of network content and the building of a reliable ML-based intrusion detection model. Experiments performed through the analysis of five years of network traffic, about 20 TB of data, have shown that our approach extends the lifespan of our model by up to six weeks. That occurs because the average accuracy rate of our proposal lasted eight weeks after the training phase, and traditional ones reached only two weeks after the model building. Additionally, our proposal achieves up to 10 Gbps of detection throughput in a 20-core big data processing cluster. KEYWORDS: Machine Learning, Intrusion Detection, Big Data, High-Speed Networks.

A Hardware-in-the-Loop Water Distribution Testbed Dataset for Cyber-Physical Security Testing

This paper presents a dataset to support researchers in the validation process of solutions such as Intrusion Detection Systems (IDS) based on artificial intelligence and machine learning techniques for the detection and categorization of threats in Cyber Physical Systems (CPS). To this end, data were acquired from a hardware-in-the-loop Water Distribution Testbed (WDT) which emulates water flowing between eight tanks via solenoid-valves, pumps, pressure and flow sensors. The testbed is composed of a real subsystem that is virtually connected to a simulated one. The proposed dataset encompasses both physical and network data in order to highlight the consequences of attacks in the physical process as well as in network traffic behaviour. Simulations data are organized in four different acquisitions for a total duration of 2 hours by considering normal scenario and multiple anomalies due to cyber and physical attacks.

Inline high‐bandwidth network analysis using a robust stream clustering algorithm

High-bandwidth network analysis is challenging, resource consuming, and inaccurate due to the high volume, velocity, and variety characteristics of the network traffic. The infinite stream of incoming traffic forms a dynamic environment with unexpected changes, which requires analysing approaches to satisfy the high-bandwidth network processing challenges such as incremental learning, inline processing, and outlier handling. This study proposes an inline high-bandwidth network stream clustering algorithm designed to incrementally mine large amounts of continuously transmitting network traffic when some outliers can be dropped before determining the network traffic behaviour. Maintaining extended-meta-events as abstracting data structures over a sliding window, enriches the algorithm to address the high-bandwidth network processing challenges. Evaluating the algorithm indicates its robustness, efficiency, and accuracy in analysing high-bandwidth networks.

Individual awareness of cyber-security vulnerability - Citizen and public servant

Cyber-security is not concerned so much with average or median vulnerability in an organization. Rather more important is identifying the weakest links. Individual user susceptibility and user behaviour risk assessment are key to measuring the effectiveness of cyber-security awareness programs and policies. Increasingly, it has been demonstrated that managing individual user susceptibility is as critical to organization well-being as maintaining patched IT infrastructure or responding to specific immediate cyber-threat alerts.
 Despite IT systems audits, human factor studies, training courses, user policies, and user documentation, managing user cyber-security awareness remains one of the weakest links in protecting organizations from cyber-threats. Most employees are not aware of the cyber-threats they are most likely to encounter while performing their work. They are susceptible to malicious manipulation (social engineering threats) and they tend not to follow standard procedures (either through ignorance or in attempting to circumvent security procedures to achieve more productivity). Typically, employees only recognize the importance of cyber-security policies and practices after an incident has happened to themselves.
 With the increasing availability and utility of IT network traffic analysis tools and active user behaviour probes (e.g., fake-phishing), employees can be given direct and individual feedback to increase their cyber-security awareness and improve their cyber-security practices. Beyond an organization’s employees, the same holds for a country’s citizens, or a government’s public servants. At their best, these user behaviour monitoring tools can be used in an open and transparent way to increase awareness of individual vulnerability before actual incidents occur.
 In addition to presenting results from the application of user behaviour monitoring tools to cybersecurity, this paper examines the efficacy of the privacy protection safeguards that they incorporate. These results are applied to public sector approaches to: (a) public awareness of citizen cyber-health; (b) securing online pubic services; and (c) public servant awareness of their own vulnerability to cyber-threats.

Characterizing network traffic behaviour using granule‐based association rule mining

SummaryAssociation rule mining is one important technique to characterize the behaviour of network traffic. However, mining association rules from network traffic data still have three obstacles such as efficiency, huge number of results and insufficiency to represent the behaviour of network traffic. Aiming to tackle these issues, this paper presents a granule‐based association rule mining approach, called association hierarchy mining. The proposed approach adopts top‐down rule mining strategy to directly generate interesting rules according to subjectively specified rule template hierarchies, which improves the efficiency of rule generation and subjectively filters user uninterested rules. The approach also proposes to prune a new type of redundant rules defined by this research to reduce the number of rules. Finally, the approach introduces the concept of diversity, aiming to select the interesting rules for better interpreting the behaviour of network traffic. The experiments performed on the MAWI network traffic traces show the efficiency and effectiveness of the proposed approach. Copyright © 2016 John Wiley & Sons, Ltd.

Use of non-linear dinamics methods for researching network traffic behaviour of high-speed networks

An approach that allows to assess the behavior of network traffic of high-speed communication networks, which has self-similarity properties using the nonlinear dynamics methods is proposed in the paper. The number of Internet users is growing every year, which leads to an increase in the load on the communication channels. The works of many researchers have shown that network traffic possesses self-similarity property, caused by the TCP protocol behavior. With the advent of high-speed data transmission technology, this property of the network traffic has become particularly evident. Communication networks of information systems with TCP protocol are considered in the paper as nonlinear systems that exhibit chaotic properties under certain computer network parameters. Studies have shown that in the model network there are unwanted chaotic phenomena, which negatively affect its performance. The results can be used to modify existing networks and design new ones. The proposed technique allows to predict the network traffic behavior under certain values of the computer network parameters at longer time axis intervals through its analysis at relatively small segments.

A hybrid association rule mining approach for characterizing network traffic behaviour

SUMMARYUnderstanding network traffic behaviour is crucial for managing and securing computer networks. One important technique is to mine frequent patterns or association rules from analysed traffic data. On the one hand, association rule mining usually generates a huge number of patterns and rules, many of them meaningless or user‐unwanted; on the other hand, association rule mining can miss some necessary knowledge if it does not consider the hierarchy relationships in the network traffic data. Aiming to address such issues, this paper proposes a hybrid association rule mining method for characterizing network traffic behaviour. Rather than frequent patterns, the proposed method generates non‐similar closed frequent patterns from network traffic data, which can significantly reduce the number of patterns. This method also proposes to derive new attributes from the original data to discover novel knowledge according to hierarchy relationships in network traffic data and user interests. Experiments performed on real network traffic data show that the proposed method is promising and can be used in real applications. Copyright © 2013 John Wiley & Sons, Ltd.

Dealing with network complexity in real-time networked control

This paper addresses complex real-time networked control systems (NCSs). From our recent effort in this area, a general framework is developed to deal with network complexity. When the complex traffic of real-time NCSs are treated as stochastic and bounded variables, simplified yet improved methods for robust stability and control synthesis can be developed to guarantee the stability of the systems. From the perspective of network design, over-provisioning of network capacity is not a general solution as it cannot provide any guarantee for predictive communication behaviour, which is a basic requirement for many real-time applications. Co-design of network and control is an effective approach to simplify the network behaviour and consequently to maximize the performance of the overall NCSs. To implement such a co-design, a queuing protocol is applied to obtain predictable network traffic behaviour. Then, the predictable network-induced delay is compensated through the controller design, and any dropped control packet is also estimated in real-time using past control packets. In this way, the network-induced delay can be limited within a single control period, significantly simplifying the network complexity as well as system analysis and design.

Network traffic behaviour near phase transition point

We explore packet traffic dynamics in a data network model near phase transition point from free flow to congestion. The model of data network is an abstraction of the Network Layer of the OSI (Open Systems Interconnection) Reference Model of packet switching networks. The Network Layer is responsible for routing packets across the network from their sources to their destinations and for control of congestion in data networks. Using the model we investigate spatio-temporal packets traffic dynamics near the phase transition point for various network connection topologies, and static and adaptive routing algorithms. We present selected simulation results and analyze them.

Network traffic behaviour in switched Ethernet systems

Measurements on a high-performance Ethernet are shown to match well a truncated Cauchy probability distribution, with a much better fit over smaller file/request sizes than the commonly used Pareto distribution. We observe self-similar characteristics in the traffic at both file servers and at a CPU server elsewhere in the network, which targets, predominantly, file and web servers. This suggests propagation of self-similarity. A simulation model of a single server with Poisson arrivals and Cauchy service demands yields a departure process that follows a power law and matches closely the observed traffic. The simulation is also used to investigate the link between the power laws in the request size distribution and the network traffic by using Lévy distributions for the request sizes. This suggests a link between file/request size distribution and self-similarity in traffic, leading to the possibility of using conventional queueing network performance models with processor sharing queueing discipline. This idea is further supported by an additional simulation experiment and suitable models are proposed.

Networks security measures using neuro‐fuzzy agents

The growing dependence of modern society on telecommunication and information networks and e‐type systems has become inevitable. However, those types of systems are vulnerable to malicious attacks. The speed and automation in network attack techniques continue to increase. An achievable automated attack or unauthorised access to a particular organization network could lead to devastating effects on its reputation and imminent loss of life. In this paper an innovative way is proposed to detect network attacks of a distributed nature such as denial of service (DoS) attacks. The proposed scheme is mainly based on neuro‐fuzzy intelligence in order to learn and determine the fuzzy parameter functions that represent network traffic behaviour. Neuro‐fuzzy agents combine the features of fuzzy logic and neural networks and they have been proposed to overcome the limitations of human expertise in defining fuzzy membership functions, especially for complex environments, such as information networks.