Packet Payload Research Articles

Packet Size-Aware Broadcasting in VANETs With Fuzzy Logic and RL-Based Parameter Adaptation

Most existing multi-hop broadcast protocols for vehicular ad hoc networks do not consider the problem of how to adapt transmission parameters according to the network environment. Besides the propagation environment that determines the channel bit error rate, packet payload size has a significant effect on the packet loss rate. In this paper, we first discuss the effect of packet size on the packet reception ratio, and then propose a broadcast protocol that is able to specify the best relay node by taking into account the data payload size. The proposed protocol employs a fuzzy logic-based algorithm to jointly consider multiple metrics (link quality, inter-vehicle distance, and vehicle mobility) and uses a redundancy transmission approach to ensure high reliability. Since the fuzzy membership functions are tuned by using reinforcement learning, the protocol can adapt to various network scenarios. We use both real-world experiments and computer simulations to evaluate the proposed protocol.

A comprehensive DCF performance analysis in noisy industrial wireless networks

SummaryThe use of wireless technology in industrial networks is becoming more popular because of its flexibility, reduction of cable cost, and deployment time. Providing an accurate model to study the most important parameters of these networks, the timeliness and reliability, is essential in assessing the network metrics and choosing proper protocol settings. The Institute of Electrical and Electronics Engineers (IEEE) 802.11 is a common and established wireless technology, and several analytical models have been proposed to assess its performance; however, most of them are accurate only for a limited network situation, especially data networks that have large packet payloads and are used at high signal to noise ratios, and cannot be applied to study the performance of industrial networks that have short packet lengths and are used in harsh and noisy environments. In this paper, a novel three‐dimensional discrete‐time Markov chain model has been proposed for the IEEE 802.11‐based industrial wireless networks using the distributed coordination function as the medium access control mechanism in the worst‐case saturated traffic. It considers both causes of the backoff freezing: busy channel and the successive interframe space waiting time. In this way, it provides a much more accurate estimation of the channel access and error probabilities, resulting in a more accurate network parameter calculation. Also, based on the proposed model, a comprehensive packet delay analysis, including average, jitter, and cumulative distribution function, has been provided for the near 100% reliable industrial scenario and error‐prone channel condition, which in comparison with similar pieces of work provides much more accurate results. Copyright © 2014 John Wiley & Sons, Ltd.

Independent comparison of popular DPI tools for traffic classification

Deep Packet Inspection (DPI) is the state-of-the-art technology for traffic classification. According to the conventional wisdom, DPI is the most accurate classification technique. Consequently, most popular products, either commercial or open-source, rely on some sort of DPI for traffic classification. However, the actual performance of DPI is still unclear to the research community, since the lack of public datasets prevent the comparison and reproducibility of their results. This paper presents a comprehensive comparison of 6 well-known DPI tools, which are commonly used in the traffic classification literature. Our study includes 2 commercial products (PACE and NBAR) and 4 open-source tools (OpenDPI, L7-filter, nDPI, and Libprotoident). We studied their performance in various scenarios (including packet and flow truncation) and at different classification levels (application protocol, application and web service). We carefully built a labeled dataset with more than 750K flows, which contains traffic from popular applications. We used the Volunteer-Based System (VBS), developed at Aalborg University, to guarantee the correct labeling of the dataset. We released this dataset, including full packet payloads, to the research community. We believe this dataset could become a common benchmark for the comparison and validation of network traffic classifiers. Our results present PACE, a commercial tool, as the most accurate solution. Surprisingly, we find that some open-source tools, such as nDPI and Libprotoident, also achieve very high accuracy.

Guest Editorial Deep Packet Inspection: Algorithms, Hardware, and Applications

The thirteen articles in this special section explore the technology of deep packet inspection (DPI). DPI examines the content in packet payloads to search for signatures of network applications, signs of malicious activities, and leaks of sensitive information, rather than just examine packet headers for information such as IP addresses and port numbers. The inspection provides network devices with rich information of application protocol messages in packet payloads, and enables them to make intelligent decisions in packet processing based on the information. The papers are organized into the following four sections: (1) Scalable Algorithms and Architectures for DPI, (2) Network Traffic Analysis with DPI, (3) Network Protocol Identification with DPI, and (4) Network Security Analysis with DPI.

Application Traffic Classification using PSS Signature

Recently, network traffic has become more complex and diverse due to the emergence of new applications and services. Therefore, the importance of application-level traffic classification is increasing rapidly, and it has become a very popular research area. Although a lot of methods for traffic classification have been introduced in literature, they have some limitations to achieve an acceptable level of performance in real-time application-level traffic classification. In this paper, we propose a novel application-level traffic classification method using payload size sequence (PSS) signature. The proposed method generates unique PSS signatures for each application using packet order, direction and payload size of the first N packets in a flow, and uses them to classify application traffic. The evaluation shows that this method can classify application traffic easily and quickly with high accuracy rates, over 99.97%. Furthermore, the method can also classify application traffic that uses the same application protocol or is encrypted.

Saturated distributed coordination function Markov model for noisy soft‐real‐time industrial wireless networks

The use of wireless technology in industrial networks is becoming more popular due to its numerous advantages. Providing an accurate model to study its performance parameters, is an essential step in designing a reliable and real-time industrial wireless network protocol. Most of the existing models are accurate only for data networks which have large packet payloads and high signal to noise ratio (SNR) characteristics, and cannot be applied to study the performance of industrial networks which have short packet lengths and are used in harsh and noisy environments. In this paper a novel three-dimensional discrete-time Markov chain (DTMC) model has been proposed for the IEEE 802.11-based industrial wireless networks using the distributed coordination function (DCF) as the medium access control (MAC) mechanism. It considers both causes of the backoff freezing: busy channel and the successive inter-frame space (IFS) waiting phase. In this way, it provides a much more accurate estimation of the channel access and collision probabilities, resulting in more accurate network metric calculations. Also, based on the proposed model, a simple and accurate packet delay analysis is provided in the worst-case saturated traffic and error-prone channel condition which in comparison with similar works provides more accurate results.

TCP/IP Reassembly in Network Intrusion Detection and Prevention Systems

Deep Packet Inspection DPI in Network Intrusion Detection and Prevention Systems NIDPS typically involves the matching of packet payloads against attack signatures in the form of fixed strings and ...

TCP/IP Reassembly in Network Intrusion Detection and Prevention Systems

Deep Packet Inspection (DPI) in Network Intrusion Detection and Prevention Systems (NIDPS) typically involves the matching of packet payloads against attack signatures in the form of fixed strings and regular expressions. As an attack pattern may span multiple IP fragments or TCP segments, accurate DPI requires that the traffic is reassembled prior to analysis of the payload data stream. Although hardware acceleration of the TCP layer, including reassembly, is well known in the form of TCP Offload Engines for Network Interface Cards, only limited research has been conducted into reassembly architectures suited to the particular requirements of DPI systems. The challenging requirements include the tracking and fragment/segment reordering of a potentially very large number of streams in addition to dealing with subtle ambiguities in IP fragmentation and TCP segmentation using target based reassembly or traffic normalization. In this article, the authors present a combined hardware and software architecture which harnesses the resources of the latest FPGA technology to improve on existing research proposals.

Dependence of Transfer Time of Bluetooth Payload Packets on the Surroundings and Distance

This paper deals with the Bluetooth technology in telecommunication networks. The basis for the data transmission is a packet which has its own specifics in the wireless communication. The more important is signal level, but other parameters like transfer time and a number of transferred packets are interesting too. The output of this paper is a proposed mathematical model which describes dependencies of this output parameters on the distance of communicating devices and on the environment where these devices are placed. Some input criteria and conditions are defined for the functionality of the proposed model. The file transfer between both devices depends on the distance between communicating devices and on the surroundings, where the slave device is placed. For our purposes were selected some possible surroundings that might be encountered, it is free-space, paper with variant thickness, PVC or leather and wood with their density. Equation of mathematical model thanks to application of logarithmic regression analysis on graphical output was found out the equation of output function of mathematical model. Because partial equations were multiplying, it is multiplicative (additive) type of regression model.

Content-adaptive bitstream-layer model for coding distortion assessment of H.264/AVC networked video

Bitstream-layer models are designed to use the information extracted from both packet headers and payload for real-time and non-intrusive quality monitoring of networked video. This paper proposes a content-adaptive bitstream-layer (CABL) model for coding distortion assessment of H.264/AVC networked video. Firstly, the fundamental relationship between perceived coding distortion and quantization parameter (QP) is established. Then, considering the fact that the perceived coding distortion of a networked video significantly relies on both the spatial and temporal characteristics of video content, spatial and temporal complexities are incorporated in the proposed model. Assuming that the residuals before Discrete Cosine Transform (DCT) keep to the Laplace distribution, the scale parameters of the Laplace distribution are estimated utilizing QP and quantized coefficients on the basis of the Parseval theorem firstly. Then the spatial complexity is evaluated using QP and the scale parameters. Meanwhile, the temporal complexity is obtained using the weighted motion vectors (MV) considering the variations in temporal masking extent for high motion regions and low motion regions, respectively. Both the two characteristics of video content are extracted from the compressed bitstream without resorting to a complete decoding. Using content related information, the proposed model is able to adapt to different video contents. Experimental results show that the overall performance of CABL model significantly outperforms that of the P.1202.1 model and other coding distortion assessment models in terms of widely used performance criteria, including the Pearson Correlation Coefficient (PCC), the Spearman Rank Order Correlation Coefficient (SROCC), the Root-Mean-Squared Error (RMSE) and the Outlier Ratio (OR).

Towards self adaptive network traffic classification

A critical aspect of network management from an operator’s perspective is the ability to understand or classify all traffic that traverses the network. The failure of port based traffic classification technique triggered an interest in discovering signatures based on packet content. However, this approach involves manually reverse engineering all the applications/protocols that need to be identified. This suffers from the problem of scalability; keeping up with the new applications that come up everyday is very challenging and time-consuming. Moreover, the traditional approach of developing signatures once and using them in different networks suffers from low coverage. In this work, we present a novel fully automated packet payload content (PPC) based network traffic classification system that addresses the above shortcomings. Our system learns new application signatures in the network where classification is desired. Furthermore, our system adapts the signatures as the traffic for an application changes. Based on real traces from several service providers, we show that our system is capable of detecting (1) tunneled or wrapped applications, (2) applications that use random ports, and (3) new applications. Moreover, it is robust to routing asymmetry, an important requirement in large ISPs, and has high precision (>97%). Finally, our system is easy to deploy and setup and performs classification in real-time.

The Effect of MAC Parameters on Energy Efficiency and Delay in Wireless Sensor Networks

As the most important indices to evaluate the performance of wireless sensor networks, energy efficiency and delay have been achieved more and more attention by researchers. In order to build the mathematical relationship between network parameters and performances, this paper starts from the three basic elements of communication and takes account backoff mechanism in sending period, bit error rate in transmission period and collision rate in receiving period. Using theoretical analysis and simulation confirmation, we can make a conclusion that packet payload length, bit error rate, node number, contention window size and the maximum retransmission times allowed have influences on packet drop rate, and then affect network performances

Packet Payload Monitoring for Internet Worm Content Detection Using Deterministic Finite Automaton with Delayed Dictionary Compression

Packet content scanning is one of the crucial threats to network security and network monitoring applications. In monitoring applications, payload of packets in a network is matched against the set of patterns in order to detect attacks like worms, viruses, and protocol definitions. During network transfer, incoming and outgoing packets are monitored in depth to inspect the packet payload. In this paper, the regular expressions that are basically string patterns are analyzed for packet payloads in detecting worms. Then the grouping scheme for regular expression matching is rewritten using Deterministic Finite Automaton (DFA). DFA achieves better processing speed during regular expression matching. DFA requires more memory space for each state. In order to reduce memory utilization, decompression technique is used. Delayed Dictionary Compression (DDC) is applied for achieving better speeds in the communication links. DDC achieves decoding latency during compression of payload packets in the network. Experimental results show that the proposed approach provides better time consumption and memory utilization during detection of Internet worm attacks.

Achieving energy efficient advertisements traffic for smartphones

Mobile advertising has now become a business model for free applications of smartphones, which leads to tremendous growth of advertisement traffic. Experiment shows that data traffic of advertisements (ad) is higher than non-advertisement data traffic in application (app). We present a detailed look at advertising traffic for smartphones and find that the main factor of increasing the volume of advertisement traffic is the redundant user context information contained in HTTP parameters for targeted advertising. We propose to reduce redundant user information in payload of HTTP packets by setting up context information related to the users that can save approximately 94% in payload size in ads traffic. This proposal can decrease signalling overhead and battery consumption in smartphones.

Efficient Methods for Early Protocol Identification

To manage and monitor their networks in a proper way, network operators are often interested in automatic methods that enable them to identify applications generating the traffic traveling through their networks as fast (i.e., from the first few packets) as possible. State-of-the-art packet-based traffic classification methods are either based on costly inspection of the payload of several packets in each flow or on basic flow statistics without taking into account the packet content. In this paper, we consider an intermediate approach of analyzing only the first few bytes of the first (or first few) packet(s) of each flow and propose automatic, machine-learning-based methods with very low computational complexity and memory footprint. The performance of these techniques are thoroughly analyzed, showing that outstanding early classification accuracy can be achieved on traffic traces generated by a diverse set of applications (including P2P TV and file sharing) in a laboratory environment as well as on a real-world data set collected in the network of a large European ISP.

Auto-Pattern Programmable Kernel Filter (Auto-PPKF) for Suppression of Bot Generated Traffic

Bots usually vary from their other malicious counter parts by periodically reporting to the botmaster through regular exchange of messages. Our experiments on bot attack generation showed a continuous exchange of packets with similar content between the botmaster and the zombie machine at various time intervals. Though there were also genuine packets with similar content being sent out of the victim machine challenge was to differentiate between the two and pass only the genuine ones. In this paper, an algorithm namely Auto-Pattern Programmable Kernel Filter (Auto-PPKF), for automatic detection of patterns from packet payload for filtering out malicious packets generated by bots is proposed. The significant feature of our proposed Auto-PPKF algorithm is that, the malicious pattern is deduced at kernel level on the fly from packet payload. Traditional algorithms such as Boyer Moore, Knuth Morris Patt, and Naive Pattern search algorithms require the pattern to be identified available a priori. Currently, Longest Common Subsequence (LCS) algorithm stands as the most preferred algorithm for pattern matching. But the disadvantage is that common sequences can also exist in many genuine packets. Hence, the challenge lies in automatic detection of malicious patterns and filtering of the packets having such malicious patterns. This would not only put off the communication between the Botmaster and Zombie machine, but will also thus prevent user information from being sent to the botmaster.

The application of neural networks to improve the quality of experience of video transmission over IP networks

The transmission of real-time multimedia streams requires service guarantees, such as limited packet loss, minimum bandwidth and low delay and jitter, to ensure a good quality of experience (QoE) for viewers. The spatial and temporal redundancy of videos is addressed by coding algorithms that reduce the amount of information necessary to represent the images. As a consequence, multimedia traffic commonly presents variable bit rate behavior and self-similar characteristics. Although the reduction in bandwidth requirements is highly desirable, the burstiness of traffic leads to problems in network design and performance prediction. Even a low level of packet loss could severely affect the viewer QoE. In this paper, we propose a real-time packet payload classifier, implemented with artificial neural network (ANN) to be used at network routers. A priority packet discard strategy can be implemented to avoid discarding packets that carry the most relevant information for image reconstruction, thus improving the perceived quality. This approach does not require changes at the video source to classify outgoing packets. The ANN was employed because of its good capacity in temporal series recognition and the possibility of its implementation in real-time systems due to its low computational complexity. The video traces used for training and validation were encoded with H.264/MPEG-4 Advanced Video Coding and are publicly available. The priority packet discard strategy was tested through computational simulations. The QoE was estimated comparing the peak signal-to-noise ratio (PSNR) of original and the received frames of video, and the results indicate that the proposed method improves the QoE. The implementation does not require packet payload processing and can be performed with network layer information only.

MULTI-GIGABIT PATTERN FOR DATA IN NETWORK SECURITY

In the current scenario network security is emerging the world. Matching large sets of patterns against an incoming stream of data is a fundamental task in several fields such as network security or computational biology. High-speed network intrusion detection systems (IDS) rely on efficient pattern matching techniques to analyze the packet payload and make decisions on the significance of the packet body. However, matching the streaming payload bytes against thousands of patterns at multi-gigabit rates is computationally intensive. Various techniques have been proposed in past but the performance of the system is reducing because of multi-gigabit rates.Pattern matching is a significant issue in intrusion detection systems, but by no means the only one. Handling multi-content rules, reordering, and reassembling incoming packets are also significant for system performance. We present two pattern matching techniques to compare incoming packets against intrusion detection search patterns. The first approach, decoded partial CAM (DpCAM), pre-decodes incoming characters, aligns the decoded data, and performs logical AND on them to produce the match signal for each pattern. The second approach, perfect hashing memory (PHmem), uses perfect hashing to determine a unique memory location that contains the search pattern and a comparison between incoming data and memory output to determine the match. The suggested methods have implemented in vhdl coding and we use Xilinx for synthesis.

Communication Energy Modeling and Optimization through Joint Packet Size Analysis of BSN and WiFi Networks

In this paper, we present an optimal packet size solution that optimizes the communication energy consumption in the heterogeneous wireless networks. More specifically, we consider a heterogeneous network system composed of a body sensor network (BSN) and a WiFi network. Then, based on the analysis of data communication in the BSN and WiFi (BSN-WiFi) network, we formulate a communication energy consumption optimization model with the constraints of throughput and time delay. Mathematically, we convert this model into a geometric programming problem, which is then numerically solved. The optimal solution can be applied in both BSN and WiFi network to dynamically select packet payload sizes according to real-time packet delivery ratios (PDRs). Since PDRs are time-varying, we tabulate a packet payload size lookup table for online packet size selection using PDRs as indices. Finally, we collect PDRs from a deployed BSN-WiFi network and evaluate the energy optimization model. The performance evaluation results show that, in comparison with fixed packet size solutions, our optimal solutions achieve up to 70 percent energy savings in a BSN(TDMA)-WiFi network and 68 percent in a BSN(CSMA)-WiFi network.

High performance payload conversion method

Virtualization technology is becoming more and more popular, and when applicable, telecom equipment is being migrated to virtualized platforms. While virtualization technology provides many benefits, it also presents significant challenges. For example, the special hardware used for audio payload conversion can no longer be used. In legacy telecom equipment, the user plane, which processes voice over Internet Protocol (IP), was designed to use special hardware such as field programmable gate array/complex programmable logic devices (FPGA/CPLD) for optimum performance. However, in virtualized platforms the only choice is a general-purpose processor and therefore software-based payload conversion algorithms have to be used accordingly. This introduces a major performance issue in that a software-only solution is needed to reach the performance levels already possible with legacy equipment, and the prospect of reaching this goal using a software-based algorithm is a very challenging task. This letter describes our work to use a virtualized machine to replace the CPLD board used to convert the VoIP payload packets from the Real Time Transport Protocol (RTP) to the Transcoder and Rate Adaptation Unit over IP (TRAUP) protocol and vice versa. We also describe a conversion method that we developed to improve performance.