Packet Payload Research Articles

CMShark: A NetFlow and machine-learning based crypto-jacking intrusion-detection method

Crypto-jacking attack is a novel type of cyber-attack on the internet that has emerged because of the popularity of digital currencies. These attacks are the most common type of attacks in the cryptocurrency field because of their specific features such as easy scenario, un-traceability, and ease of secrecy. In crypto-jacking attacks, it is common to embed malicious code inside website scripts. Different techniques have been provided to deal with Crypto-jacking attacks, but crypto-jacking attackers bypass them by limiting resources. The crypto-mining services provided on the internet are legal, and due to the anonymous nature of cryptocurrencies, client identification is a challenging task. Improving the accuracy and performance of the Crypto-jacking attack detection methods are the main objectives of this study. In this paper, a hybrid network-based method to identify these attacks to achieve better and more accurate results. The proposed solution (CMShark) is a combination of machine learning (ML) models, IP blacklisting and payload inspection methods. In the ML model, the packets are classified using size patterns; in IP blacklisting, attacks are detected based on known infected addresses and infected scripts. In payload inspection, the provided information on the packet payload is searched for any suspicious keywords. The proposed method relies solely on the network and is deployed on the edge of the network, making it infrastructureindependent. The proposed detection model reaches an accuracy score of 97.02%, an F1-score of 96.90% a ROC AUC score of 97.20% in input NetFlow classification; and a 93.98% accuracy score, 94.30% F1-score and 97.30% ROC AUC score in output NetFlow classification.

Multi-view multi-label network traffic classification based on MLP-Mixer neural network

Network traffic classification is the basis of many network security applications and has received significant attention in the field of cyberspace security. Existing research on deep traffic analysis typically involves converting traffic data into images to extract spatial traffic features using Convolutional Neural Networks (CNNs). However, this approach ignores the semantic differences and details in the various packet structures. In this paper, we propose an MLP-Mixer based multi-view multi-label neural network for network traffic classification. Compared with the existing CNN-based methods, our method adopts the MLP-Mixer structure, which is more in line with the structure of the packet than the conventional convolution operation. In our method, one packet is divided into the packet header and the packet payload, together with the flow statistics of the packet as input from different views. We utilize a multi-label setting to learn different scenarios simultaneously to improve the classification performance by exploiting the correlations between different scenarios. We conduct experiments on three public datasets, and the experimental results show that our method can achieve superior performance. Code is available at https://github.com/ZxuanDang/MV-ML-traffic-classification.

SSH-MAC: Service-Aware and Scheduling-Based Media Access Control Protocol in Underwater Acoustic Sensor Network

In the framework of the space-air-ground-ocean integrated network, the underwater acoustic sensor network (UASN) plays a pivotal role. The design of media access control (MAC) protocols is essential for the UASN to ensure efficient and reliable data transmission. From the perspective of differentiated services in the UASN, a service-aware and scheduling-based hybrid MAC protocol, named the SSH-MAC protocol, is proposed in this paper. In the SSH-MAC protocol, the centralized scheduling strategy is adopted by sensor nodes with environmental monitoring service, and the distributed scheduling strategy is adopted by sensor nodes with target detection service. Considering the time-varying data generation rate of sensor nodes, the sink node will switch the scheduling mode of sensor nodes based on the specific control packet and adjust the resource allocation ratio between centralized scheduling and distributed scheduling. Simulation results show that the performance of the SSH-MAC protocol, in terms of utilization, end-to-end delay, packet delivery ratio, energy consumption, and payload efficiency, is good.

DE-GNN: Dual embedding with graph neural network for fine-grained encrypted traffic classification

Nowadays, most network traffic is encrypted, which protects user privacy but complicates the task of analyzing and classifying encrypted traffic. Identifying the specific categories of encrypted traffic, such as application type or even the specific application, is of great significance for advanced network services and network security management. Many existing methods for encrypted traffic classification rely on machine learning and deep learning techniques, but they exhibit certain shortcomings. A considerable number of these methods rely on statistical features, which may lose their relevance as networks evolve and lead to the loss of important information. Additionally, Convolutional Neural Networks (CNNs) and Recurrent Neural Networks (RNNs) face limitations in extracting features from encrypted traffic, specifically, their inability to learn traffic interaction information within a network flow.To address these challenges, we propose a model called Dual Embedding with Graph Neural Networks (DE-GNN) for fine-grained encrypted traffic classification. Based on the byte-packet-flow structure of network traffic, we present a dual embedding layer that encodes the packet header and payload separately using raw bytes, which allows subsequent processes to run separately and in parallel. Then, we develop the PacketCNN to extract packet-level features from both the header and payload. Afterwards, we construct a network flow as a Traffic Interaction Graphs (TIG) and utilize Graph Neural Networks (GNNs) to extract flow-level features. Finally, an adaptive deep feature fusion process is applied to combine flow-level features from the header and payload, creating a robust representation for classification. Extensive experiments are conducted on two well-known datasets, ISCX-VPN2016 and ISCX-Tor2016, to verify our approach. The experimental results demonstrate that DE-GNN effectively identifies the type of encrypted traffic, outperforming baselines significantly.

Traffic Fingerprints for Homogeneous IoT Traffic Based on Packet Payload Transition Patterns

Traffic fingerprint was considered an effective security protection mechanism in IoT scenarios because it can be used to automatically identify accessed devices. However, the results of replication experiments show that the classic traffic fingerprints based on simple network traffic attribute features have a significantly lower ability to identify accessed devices in real 5G IoT scenarios compared to what was stated in traditional IoT scenarios. The growing homogenization of IoT traffic caused by the application of 5G is believed to be the reason for the poor ability of traditional traffic fingerprints to identify 5G IoT terminals. Studying an enhanced traffic fingerprint is necessary to accommodate the homogeneous Internet of Things traffic. In addition, during the reproducing experiments, we noticed that the solution of overlap is a key factor that restricts the recognition ability of one-vs-all multi-classifiers, and the efficiency of existing methods still has some room for optimization. Based on targeted improvements to these two issues, we proposed an enhanced IoT terminal traffic fingerprint based on packet payload transition patterns to improve the device recognition ability in homogeneous IoT traffic. Additionally, we designed an improved solution for overlap based on density centers to expedite decision making. According to the experimental results, when compared with the existing traffic fingerprint, the proposed traffic fingerprint in this study demonstrated a Macro-Average Precision of close to 90% for network traffic from real 5G IoT terminals. The proposed overlap solution based on the density centers reduced the decision-making time from hundreds of seconds to tens of seconds while ensuring decision-making accuracy.

An innovative approach for enhancing capacity utilization in point-to-point voice over internet protocol calls

Voice over internet protocol (VoIP) calls are increasingly transported over computer-based networking due to several factors, such as low call rates. However, point-to-point (P-P) calls, as a division of VoIP, are encountering a capacity utilization issue. The main reason for that is the giant packet header, especially when compared to the runt P-P calls packet payload. Therefore, this research article introduced a method to solve the liability of the giant packet header of the P-P calls. The introduced method is named voice segment compaction (VSC). The VSC method employs the unneeded P-P calls packet header elements to carry the voice packet payload. This, in turn, reduces the size of the voice payload and improves network capacity utilization. The preliminary results demonstrated the importance of the introduced VSC method, while network capacity improved by up to 38.33%.

MVF: A Novel Technique to Reduce the Voip Packet Payload Length

Abstract The adoption of the Voice over Internet Protocol (VoIP) system is growing due to several factors, including its meagre rate and the numerous contours that can be joined with VoIP systems. However, the wasteful utilisation of the computer network is an inevitable problem that limits the rapid growth of VoIP systems. The essential explanation behind this wasteful utilisation of the computer network bandwidth (BW) is the considerable preamble length of the VoIP packet. In this study, we invent a technique that addresses the considerable preamble length of the VoIP packet. The designed technique is known as the manikin voice frame (MVF). The primary idea of the MVF technique is to utilise the VoIP packet preamble tuples that are not essential to the voice calls, particularly client-to-client calls (voice calls between only two users). Specifically, these tuples will be utilised for reserving the data of the VoIP packet. In certain instances, this will make the VoIP packet data manikin or even make it empty. The performance assessment of the introduced MVF technique demonstrated that the utilisation of the computer network BW has enhanced by 33%. Along these lines, the MVF technique indicates potential progress in resolving the inefficient usage of the computer network BW.

Towards Energy Efficient Wireless Sensing by Leveraging Ambient Wi-Fi Traffic

Wireless-based sensing of physical environments has garnered tremendous attention recently, and its applications range from intruder detection to environmental occupancy monitoring. Wi-Fi is positioned as a particularly advantageous sensing medium, due to the ubiquity of Wi-Fi-enabled devices in a more connected world. Although Wi-Fi-based sensing using Channel State Information (CSI) has shown promise, existing sensing systems commonly configure dedicated transmitters to generate packets for sensing. These dedicated transmitters substantially increase the energy requirements of Wi-Fi sensing systems, and hence there is a need for understanding how ambient transmissions from nearby Wi-Fi devices can be leveraged instead. This paper explores the potential of Wi-Fi-based sensing using CSI derived from ambient transmissions of Wi-Fi devices. We demonstrate that CSI sensing accuracy is dependent on the underlying traffic type and the Wi-Fi transceiver architecture, and that control packets yield more robust CSI than payload packets. We also show that traffic containing upload data is more suitable for human occupancy counting, using the Probability Mass Function (PMF) of CSI. We further demonstrate that multiple spatially diverse streams of Wi-Fi CSI can be combined for sensing to an accuracy of 99%. The experimental study highlights the importance of training Wi-Fi sensing systems for multiple transmission sources to improve accuracy. This research has significant implications for the development of energy-efficient Wi-Fi sensing solutions for a range of applications.

Introducing packet-level analysis in programmable data planes to advance Network Intrusion Detection

Programmable data planes offer precise control over the low-level processing steps applied to network packets, serving as a valuable tool for analysing malicious flows in the field of intrusion detection. Albeit with limitations on physical resources and capabilities, they allow for the efficient extraction of detailed traffic information, which can then be utilised by Machine Learning (ML) algorithms responsible for identifying security threats. In addressing resource constraints, existing solutions in the literature rely on compressing network data through the collection of statistical traffic features in the data plane. While this compression saves memory resources in switches and minimises the burden on the control channel between the data and the control plane, it also results in a loss of information available to the Network Intrusion Detection System (NIDS), limiting access to packet payload, categorical features, and the semantic understanding of network communications, such as the behaviour of packets within traffic flows. This paper proposes P4DDLe, a framework that exploits the flexibility of P4-based programmable data planes for packet-level feature extraction and pre-processing. P4DDLe leverages the programmable data plane to extract raw packet features from the network traffic, categorical features included, and to organise them in a way that the semantics of traffic flows are preserved. To minimise memory and control channel overheads, P4DDLe selectively processes and filters packet-level data, so that only the features required by the NIDS are collected. The experimental evaluation with recent Distributed Denial of Service (DDoS) attack data demonstrates that the proposed approach is very efficient in collecting compact and high-quality representations of network flows, ensuring precise detection of DDoS attacks.

Tel-MPLS: a new method for maximizing the utilization of IP telephony over MPLS networks

Currently, the multiprotocol label switching (MPLS) standard is extremely prevalent. By exploiting the features provided by MPLS technology, a range of services, including IP telephony, have enhanced their overall performance. However, due to the size of the packet header, the IP telephony service consumes a significant portion of the MPLS network's available bandwidth. For instance, in IP telephony over MPLS networks, the packet header might account for as much as 80% of lost time and bandwidth. Designers working on IP telephony are making substantial efforts to address this issue. This study contributes to current efforts by proposing a novel approach called Tel-MPLS, which involves IP telephony over MPLS. TelMPLS approach uses the superfluous fields in the IP telephony packet's header to retain the packet data, therefore lowering or zeroing the IP telephony packet's payload. Tel-MPLS is an approach that significantly reduces the bandwidth of IP telephony MPLS networks. According to the findings, the Tel-MPLS approach is capable of reducing the amount of bandwidth that is lost by 12% when using the G.729 codec.

Remote access trojan traffic early detection method based on Markov matrices and deep learning

Remote Access Trojan (RAT) allows the attacker to gain remote control of an infected system and steal data from it. Due to over-reliance on expert experience and statistical features, most feature-based RAT detection methods perform inefficiently and can only achieve high accuracy with network traffic collected over a long period of time. Byte-based RAT detection methods often use sequence truncation to process network traffic to meet the uniform-sized input requirements of convolutional neural networks (CNNs). However, the sequence truncation brings a negative impact on detection accuracy for some information loss. Towards effective and efficient RAT detection, we define the early stage from the damage degree caused on victim hosts and propose a new RAT traffic early detection method based on Markov matrices and deep learning (RATMD). In RATMD, the byte sequence of the TCP payloads of the TCP service packets collected in the early stage is represented by a byte transition probability matrix with a fixed size of 256 × 256, and the generated matrices are used to construct a detection model using a CNN architecture. Experiments are conducted on the network traffic of 58 benign applications and 61 RATs. Employing only the byte sequences derived from the TCP payloads of the TCP service packets in the traffic between the first TCP connection established by the application client and the third TCP service packet sent by the application server, RATMD achieves a detection accuracy of 95.5%.

A Self-adaptive and Secure Approach to Share Network Trace Data

A large volume of network trace data are collected by the government and public and private organizations and can be analyzed for various purposes such as resolving network problems, improving network performance, and understanding user behavior. However, most organizations are reluctant to share their data with any external experts for analysis, because they contain sensitive information deemed proprietary to the organization, thus raising privacy concerns. Even if the payload of network packets is not shared, header data may disclose sensitive information that adversaries can exploit to perform unauthorized actions. So network trace data need to be anonymized before being shared. Most of the existing anonymization tools have two major shortcomings: (1) they cannot provide provable protection, and (2) their performance relies on setting the right parameter values such as the degree of privacy protection and the features that should be anonymized, but there is little assistance for a user to optimally set these parameters. This article proposes a self-adaptive and secure approach to anonymize network trace data and provides provable protection and automatic optimal settings of parameters. A comparison of the proposed approach with existing anonymization tools via experimentation demonstrated that the proposed method outperforms the existing anonymization techniques.

An Ensemble of Text Convolutional Neural Networks and Multi-Head Attention Layers for Classifying Threats in Network Packets

Using traditional methods based on detection rules written by human security experts presents significant challenges for the accurate detection of network threats, which are becoming increasingly sophisticated. In order to deal with the limitations of traditional methods, network threat detection techniques utilizing artificial intelligence technologies such as machine learning are being extensively studied. Research has also been conducted on analyzing various string patterns in network packet payloads through natural language processing techniques to detect attack intent. However, due to the nature of packet payloads that contain binary and text data, a new approach is needed that goes beyond typical natural language processing techniques. In this paper, we study a token extraction method optimized for payloads using n-gram and byte-pair encoding techniques. Furthermore, we generate embedding vectors that can understand the context of the packet payload using algorithms such as Word2Vec and FastText. We also compute the embedding of various header data associated with packets such as IP addresses and ports. Given these features, we combine a text 1D CNN and a multi-head attention network in a novel fashion. We validated the effectiveness of our classification technique on the CICIDS2017 open dataset and over half a million data collected by The Education Cyber Security Center (ECSC), currently operating in South Korea. The proposed model showed remarkable performance compared to previous studies, achieving highly accurate classification with an F1-score of 0.998. Our model can also preprocess and classify 150,000 network threats per minute, helping security agents in the field maximize their time and analyze more complex attack patterns.

Accelerating Pattern Matching Using a Novel Multi-Pattern-Matching Algorithm on GPU

Nowadays, almost all network traffic is encrypted. Attackers hide themselves using this traffic and attack over encrypted channels. Inspections performed only on packet headers and metadata are insufficient for detecting cyberattacks over encrypted channels. Therefore, it is important to analyze packet contents in applications that require control over payloads, such as content filtering, intrusion detection systems (IDSs), data loss prevention systems (DLPs), and fraud detection. This technology, known as deep packet inspection (DPI), provides full control over the communication between two end stations by keenly analyzing the network traffic. This study proposes a multi-pattern-matching algorithm that reduces the memory space and time required in the DPI pattern matching compared to traditional automaton-based algorithms with its ability to process more than one packet payload character at once. The pattern-matching process in the DPI system created to evaluate the performance of the proposed algorithm (PA) is conducted on the graphics processing unit (GPU), which accelerates the processing of network packets with its parallel computing capability. This study compares the PA with the Aho-Corasick (AC) and Wu–Manber (WM) algorithms, which are widely used in the pattern-matching process, considering the memory space required and throughput obtained. Algorithm tables created with a dataset containing 500 patterns use 425 and 688 times less memory space than those of the AC and WM algorithms, respectively. In the pattern-matching process using these tables, the PA is 3.5 and 1.5 times more efficient than the AC and WM algorithms, respectively.

Comparative Analysis of Machine Learning and Deep Learning Techniques for Intrusion Detection

Abstract: This comparative analysis examines the application of both machine learning and deep learning methods in network traffic classification. Network traffic classification holds significant importance in network security, traffic management, and Quality of Service provisioning. The analysis covers a range of popular machine learning techniques, such as Decision Tree, KNearest Neighbours, Naive Bayes, Logistic Regression, Multi-Layer Perceptron, and Feed Forward Neural Network with a sigmoid activation function. Each technique's strengths and weaknesses are discussed, along with the factors that influence the selection of a particular technique. Ultimately, the choice of machine learning approach depends on data characteristics, performance requirements, and available resources. The demand for prompt and accurate classification of Internet traffic has been steadily increasing, driven by the emergence of new applications in the field. Traditional approaches based on port numbers and packet payloads have become insufficient, prompting the adoption of pattern recognition techniques that leverage statistical flow-based features in training samples to classify unknown flows. To ensure real-time identification of traffic types, the chosen method must be capable of swift classification before the entire flow is completed. In this study, a supervised machine learning approach and deep learning techniques are proposed for the identification of various Internet applications. The proposed system exhibits the ability to detect application types based on just a few initial packets within each flow, enabling realtime operation. Promising results were achieved, with the Logistic Regression algorithm attaining the highest accuracy of 80.7%.

DNS tunnelling detection by fusing encoding feature and behavioral feature

For a long time, DNS tunnels have played a pivotal role in advanced persistent threat (APT) attacks, posing a threat to the real-world network environment. Existing approaches either use single packets or grouped packets as the basic unit for detecting DNS tunnelling traffic. Currently, single-packet-based methods usually focus on the encoding features of the DNS packet payload, which results in a high false alarm rate in real-world environments. Approaches using grouped-packets as the basis detection unit are difficult to apply to real-time inspection environments and cannot perform a finer-grained inspection of packets. To address these issues, we propose a DNS tunnelling detection method that uses a combination of encoding and behavioral features on DNS query & response pairs (Q&R). Q&R pairs achieve good balance between the information conveyed and the detection time required. We then train a powerful XGBoost classifier to fuse the features and conduct the classification of benign DNS traffic and DNS tunnelling traffic. We evaluate our approach with an authoritative DNS dataset (the base dataset) and a generalized test dataset that we curated with real-world attack simulations and collections of secure enterprise traffic. Our method achieves 99.68% accuracy on the base dataset and 98.82% accuracy on the generalized test dataset, which is better than the compared state-of-art methods. The efficiency is 66.77% higher than the baseline grouped-packets-based method. We also test our method in a real-world network environment and detect 7 malicious DNS tunnelling events.

Data Exfiltration Detection on Network Metadata with Autoencoders

We designed a Network Exfiltration Detection System (NEDS) to detect data exfiltration as occurring in ransomware attacks. The NEDS operates on aggregated metadata, which is more privacy-friendly and allows analysis of large volumes of high-speed network traffic. The NEDS aggregates metadata from multiple, sequential sessions between pairs of hosts in a network, which captures exfiltration by both stateful and stateless protocols. The aggregated metadata include averages per session of both packet count, request entropy, duration, and payload size, as well as the average time between sequential sessions and the amount of aggregated sessions. The NEDS applies a number of autoencoder models with unsupervised learning to detect anomalies, where each autoencoder model targets different protocols. We trained the autoencoder models with real-life data collected at network sensors in the National Detection Network as operated by the National Cyber Security Centre in the Netherlands, and configured the detection threshold by varying the false positive rate. We evaluated the detection performance by injecting exfiltration over different channels, including DNS tunnels and uploads to FTP servers, web servers, and cloud storage. Our experimental results show that aggregation significantly increases detection performance of exfiltration that happens over longer time, most notably, DNS tunnels. Our NEDS can be applied to detect exfiltration either in near-real-time data analysis with limited false positive rates, or in captured data to aid in post-incident analysis.

Improving VoIP Bandwidth Utilization Using the PldE Technique

Abstract The use of Voice over Internet Protocol (VoIP) innovation is rising due to its various merits. Nevertheless, the ineffective use of bandwidth is a key dilemma that restricts the fast-rising use of VoIP innovation. The main factor behind this ineffective use of the bandwidth is the sizable VoIP packet preamble. This research creates a technique to address this dilemma of packet preamble. The created technique is known as payload elimination (PldE). The fundamental concept of the PldE technique is to exploit the information (elements) of the VoIP packet preamble that is superfluous for point-to-point calls. In general, these elements are utilized to transport the payload of VoIP packets. Consequently, the payload size of VoIP packet will be lowered or removed, preserving the available bandwidth. The performance test of the PldE technique indicated an improvement of up to 41.6% in the exploitation of IP network bandwidth. So, the PldE technique is showing signs that it could help solve the problem of the IP network's inefficient use of bandwidth.

ReLoRaWAN: Reliable data delivery in LoRaWAN networks with multiple gateways

LoRa has emerged as a promising technology to provide low-power and long-range communication for IoT devices. LoRaWAN networks build on top of the LoRa physical layer and adopt a centralized network architecture that supports one or more gateways connected with a large number of end devices. Although LoRa communication is resistant to channel noises, it still frequently suffers data delivery failures in LoRaWAN networks due to packet collisions of the concurrent transmissions. The delivery failures trigger the retransmission procedure in LoRaWAN protocol, which causes additional power consumption on end devices and further exacerbates packet collisions. To solve this issue, we investigate the reliable data delivery mechanism that utilizes with the packet reception of multiple gateways to recover the distorted payload. Firstly, we present a ReLoRaWAN framework, where the central server aggregates distorted packet payload from multi-gateway reception of the same packet and executes the corresponding data recovery operations. Then, we design a Tri-operation Integrated Data Recovery (TIDR) algorithm for recovering the distorted packet payload, which involves exclusive-OR based bitwise inversion operation, majority voting based bitwise inversion operation, and weighted bitwise decision operation. Finally, we implement a ReLoRaWAN testbed and conduct real-world experiments to evaluate the performance of our solution. Compared with existing works, the ReLoRaWAN greatly optimizes the quality of service and power consumption in the network. It improves the packet delivery ratio by 35% and reduces the average power consumption of the end device by 30%.

Low Latency TOE with Double-Queue Structure for 10Gbps Ethernet on FPGA.

The TCP protocol is a connection-oriented and reliable transport layer communication protocol which is widely used in network communication. With the rapid development and popular application of data center networks, high-throughput, low-latency, and multi-session network data processing has become an immediate need for network devices. If only a traditional software protocol stack is used for processing, it will occupy a large amount of CPU resources and affect network performance. To address the above issues, this paper proposes a double-queue storage structure for a 10G TCP/IP hardware offload engine based on FPGA. Furthermore, a TOE reception transmission delay theoretical analysis model for interaction with the application layer is proposed, so that the TOE can dynamically select the transmission channel based on the interaction results. After board-level verification, the TOE supports 1024 TCP sessions with a reception rate of 9.5 Gbps and a minimum transmission latency of 600 ns. When the TCP packet payload length is 1024 bytes, the latency performance of TOE's double-queue storage structure improves by at least 55.3% compared to other hardware implementation approaches. When compared with software implementation approaches, the latency performance of TOE is only 3.2% of the software approaches.