Sequence Of Packets Research Articles

CESNET-TLS-Year22: A year-spanning TLS network traffic dataset from backbone lines

The modern approach for network traffic classification (TC), which is an important part of operating and securing networks, is to use machine learning (ML) models that are able to learn intricate relationships between traffic characteristics and communicating applications. A crucial prerequisite is having representative datasets. However, datasets collected from real production networks are not being published in sufficient numbers. Thus, this paper presents a novel dataset, CESNET-TLS-Year22, that captures the evolution of TLS traffic in an ISP network over a year. The dataset contains 180 web service labels and standard TC features, such as packet sequences. The unique year-long time span enables comprehensive evaluation of TC models and assessment of their robustness in the face of the ever-changing environment of production networks.

Physical Side-Channel Attacks against Intermittent Devices

Intermittent (batteryless) devices operate solely using energy harvested from their environment. These devices turn on when they have energy and turn off during energy scarcity. Intermittent devices have recently become increasingly popular in smart buildings, manufacturing plants, and medical implantables as they eliminate the need for battery replacement and enable green computing. Despite their growing adoption in critical applications, the privacy implications of intermittent devices remain largely unexplored. In this paper, we introduce a novel remote side-channel attack. Our observation is that the network packet frequency of an intermittent device can be exploited to learn its turn-on/off patterns. From these patterns, we can infer the energy availability of a device, which reveals privacy-sensitive information about its operating environment, e.g., the presence or absence of individuals. To realize our attack, we develop a three-stage hierarchical inference framework that leverages the timestamped network packet sequence of intermittent devices. Our framework automatically extracts a set of temporal features from inter-packet-arrival timings. It then employs a series of models to uncover (1) whether a target intermittent device is present in the environment, (2) its energy harvester type (e.g., vibration or water flow), and (3) its energy availability conditions (e.g., high-vibration or no-vibration). To validate our attack effectiveness, we conduct experiments in two environments: a smart home and a miniature manufacturing plant equipped with three intermittent devices powered by solar energy, vibration, and temperature. By analyzing their energy availability patterns, we are able to infer user activities and presence in the smart home and the robot’s movement patterns in the manufacturing plant with an average accuracy of 85%. This sensitive information enables an adversary to launch domain-specific attacks, such as burglarizing a smart home when the user is asleep or timely tampering with plant sensors to cause maximum damage.

Gravitational waves from nonradial oscillations of stochastically accreting neutron stars

Abstract Oscillating neutron stars are sources of continuous gravitational waves. We study analytically the excitation of stellar oscillations by the mechanical impact on the stellar surface of ‘clumps’ of stochastically accreted matter. We calculate the waveform and spectrum of the gravitational wave signal emitted by the accretion-driven pulsations. Results are generated for an idealised model of a nonrotating, unmagnetised, one-component star with uniform polytropic index npoly assuming Newtonian gravity and the Cowling approximation. We find that the excited mode amplitudes grow with increasing npoly and mode order n. The gravitational wave signal forms a sequence of amplitude-modulated packets for npoly = 1, lasting ∼10−3s after each impact. The gravitational wave strain increases with increasing npoly, but decreases with increasing n and increasing multipole order l for npoly = 1. In the observing band of current long-baseline interferometers, g-modes emit higher, narrower peaks in the amplitude spectral density than f- and p-modes, with the highest peaks reaching ∼10−26Hz−1/2 for modes with damping time τnl ∼ 108yr. The root-mean-square strain hrms, calculated by summing over modes with 2 ≤ l ≤ 4 and τnl ≤ 108yr, spans the range 10−33 ≤ hrms ≤ 10−32 for 1 ≤ npoly ≤ 2.

Two-Phase Industrial Control System Anomaly Detection Using Communication Patterns and Deep Learning

Several cases of Industrial Internet of Things (IIoT) attacks with zero-day vulnerabilities have been reported. To prevent these attacks, it is necessary to apply an abnormal behavior detection method; however, there are three main problems that make it hard. First, there are various industrial communication protocols. Instead of IT environments, many unstandardized protocols, which are usually defined by vendors, are used. Second, legacy devices are commonly used, not only EOS (End-of-service), but also EoL (End-of-Life). And last, the analysis of collected data is necessary for defining normal behavior. This behavior should be separately defined in each IIoT. Therefore, it is difficult to apply abnormal behavior detection in environments where economic and human investment is difficult. To solve these problems, we propose a deep learning based abnormal behavior detection technique that utilizes IIoT communication patterns. The proposed method uses a deep learning technique to train periodic data acquisition sequences, which is one of the common characteristics of IIoT. The trained model determined the sequence of packet is normal. The proposed technique can be applied without an additional analysis. The proposed method is expected to prevent security threats by proactively detecting cyberattacks. To verify the proposed method, a dataset was collected from the Korea Electric Power Control System. The model that defines normal behavior based on the application layer exhibits an accuracy of 79.6%. The other model, defining normal behavior based on the transport layer, has an accuracy of 80.9%. In these two models, most false positives and false negatives only occur when the abnormal packet is in a sequence.

HSTW: A robust network flow watermarking method based on hybrid packet sequence-timing

Network flow watermarking (NFW) has been widely used in flow trace back. However, most of the existing NFW methods cannot work efficiently due to the weakness of resisting channel interferences, establishing reliable synchronization, and resisting statistical analysis-based NFW attacks. To this end, a hybrid packet sequence-timing-based flow watermarking (HSTW) method is proposed, for which packet sequence and packet timing constitute a hybrid carrier to carry watermark information. HSTW modulates the packet sequence of the flow and represents the watermark information by the relative time relationship between the packet reordering, which improves the robustness of the watermark against delay jitter and packet loss. By designing a synchronization header based on the specific packet sequence, the information synchronization is achieved at any position of the flow. To resist statistical analysis-based NFW attacks, the packet sequence modulation is carried out in the form of slight packet reordering. The random distribution of the watermark is achieved based on the synchronization header, eliminating the time correlation between multiple watermarked flows. By a large number of experiments based on real-time traffic and public datasets, the results show that in comparison with the existing methods, HSTW has stronger robustness and more reliable synchronization. Compared with timing-based and rate-based methods, the accuracy of HSTW under delay jitter is increased by 32.17% to 34.50%. The accuracy of HSTW under packet loss interference is improved by 20.11% to 26.89% in comparison with sequence-based methods. HSTW can achieve information synchronization even if only partial watermarked flow can be obtained. Furthermore, HSTW can avoid the detection of Kolmogorov-Smirnov test and multi-flow attacks.

MFFLR-DDoS: An encrypted LR-DDoS attack detection method based on multi-granularity feature fusions in SDN.

Low rate distributed denial of service attack (LR-DDoS) is a special type of distributed denial of service (DDoS) attack, which uses the vulnerability of HTTP protocol to send HTTP requests to applications or servers at a slow speed, resulting in long-term occupation of server threads and affecting the normal access of legitimate users. Since LR-DDoS attacks do not need to send flooding or a large number of HTTP requests, it is difficult for traditional intrusion detection methods to detect such attacks, especially when HTTP traffic is encrypted. To overcome the above problems, we proposed an encrypted LR-DDoS attack detection and mitigation method based on the multi-granularity feature fusion (MFFLR-DDoS) for software defined networking (SDN). This method analyzes the encrypted session flow from the time sequence of packets and the spatiality of session flow and uses different deep learning methods to extract features, to obtain more effective features for abnormal traffic detection. In addition, we used the advantages of SDN architecture to perform real-time defense against LR-DDoS attacks by the way of SDN controller issuing flow rules. The experimental results showed that the MFFLR-DDoS model had a higher detection rate than advanced methods, and could mitigate LR-DDoS attack traffic online and in real-time.

Weighted packet selection for rechargeable links in cryptocurrency networks: Complexity and approximation

We consider a natural problem dealing with weighted packet selection across a rechargeable link, which e.g., finds applications in cryptocurrency networks. The capacity of a link (u,v) is determined by how many nodes u and v allocate for this link. Specifically, the input is a finite ordered sequence of packets that arrive in both directions along a link. Given (u,v) and a packet of weight x going from u to v, node u can either accept or reject the packet. If u accepts the packet, the capacity on link (u,v) decreases by x. Correspondingly, v's capacity on (u,v) increases by x. If a node rejects the packet, this will entail a cost affinely linear in the weight of the packet. A link is “rechargeable” in the sense that the total capacity of the link has to remain constant, but the allocation of capacity at the ends of the link can depend arbitrarily on the nodes' decisions. The goal is to minimise the sum of the capacity injected into the link and the cost of rejecting packets. We show that the problem is NP-hard, but can be approximated efficiently with a ratio of (1+ε)⋅(1+3) for some arbitrary ε>0.

A methodology to calibrate the PICSI cyclic p-y model using experimental results and optimisation

Fatigue life estimation of the components of a drilling conductor system is often a critical design consideration. The analysis is usually performed using a coupled system, with the soil-conductor interaction modelled using p-y springs that remain constant throughout the analysis. This means that shifts in bending moment profile that occur due to degradation and recovery of the soil during or after cycling are not accurately modelled. While the PICSI framework (White et al., 2022) can model changes in stiffness and strength of p-y curves due to cycling and pore-pressure dissipation, guidance has not yet been provided on how to calibrate its parameters. This paper presents an experimental methodology for this calibration process based on centrifuge and p-y model testing in reconstituted carbonate silt and kaolin clay. The procedure uses numerical optimisation, and the calibrated parameters are validated against results from an independent set of centrifuge tests on carbonate silt using a flexible pile of similar dimensions to a conductor. It is found that the calibrated model is able to match the changes in cyclic bending moment through a sequence of different packets of cyclic loading. This calibration procedure provides an objective approach for more accurate modelling of conductor fatigue.

Feature Selection to Enhance DDoS Detection Using Hybrid N-Gram Heuristic Techniques

Various forms of distributed denial of service (DDoS) assault systems and servers, including traffic overload, request overload, and website breakdowns. Heuristic-based DDoS attack detection is a combination of anomaly-based and pattern-based methods, and it is one of three DDoS attack detection techniques available. The pattern-based method compares a sequence of data packets sent across a computer network using a set of criteria. However, it cannot identify modern assault types, and anomaly-based methods take advantage of the habits that occur in a system. However, this method is difficult to apply because the accuracy is still low, and the false positives are relatively high. Therefore, this study proposes feature selection based on Hybrid N-Gram Heuristic Techniques. The research starts with the conversion process, package extract, and hex payload analysis, focusing on the HTTP protocol. The results show the Hybrid N-Gram Heuristic-based feature selection for the CIC-2017 dataset with the SVM algorithm on the CSDPayload+N-Gram feature with a 4-Gram accuracy rate of 99.86%, MIB- Dataset 2016 with the 2016 algorithm. SVM and CSPayload feature +N-Gram with 100% accuracy for 4-Gram, H2N-Payload Dataset with SVM Algorithm, and CSDPayload+N-Gram feature with 100% accuracy for 4-Gram. As a comparison, the KNN algorithm for 4-Gram has an accuracy rate of 99.44%, and the Neural Network Algorithm has an accuracy rate of 100% for 4-Gram. Thus, the best algorithm for DDoS detection is SVM with Hybrid N-Gram (4-Gram).

Accurate compressed traffic detection via traffic analysis using Graph Convolutional Network based on graph structure feature

As the application of data compression technology expands in areas such as IoT, webpage, and video data transmission, there are problems such as leakage of compressed but unencrypted user data, difficulty in supervising compressed data, and confusion between compressed and private encrypted traffic. Existing compressed traffic detection methods are significantly affected by data length and rely on binary classification in one step using random tests. It remains a challenging task to conduct accurate and efficient compressed traffic detection. In this paper, we present GCN-RTG, a compressed traffic detection method using Graph Convolutional Network. We investigate the randomness feature transformation pattern of packet sequences, propose a graph structure based on this pattern, and design a powerful GCN-based classifier to detect compressed traffic. The experimental results show that GCN-RTG achieves 94% accuracy in compressed traffic detection, remarkably improving by nearly 10% accuracy compared with traditional machine learning methods and approximately 5% compared with CNN and LSTM. Considering the effect of private encrypted traffic, GCN-RTG attains an accuracy of 89% for detecting compressed traffic. Furthermore, GCN-RTG can maintain an 83% accuracy even in the most extreme packet loss scenario and reach an outstanding accuracy of up to 95% of compressed traffic detection in real-world network data sized 4GB from the Jiangsu education backbone network in China.

FusionTC: Encrypted App Traffic Classification Using Decision-Level Multimodal Fusion Learning of Flow Sequence

In recent years, an increasing number of mobile platforms and applications have adopted traffic encryption protocol technology to ensure privacy and security. Existing researches on encrypted traffic identification approaches often rely on a single-modal feature pattern (such as packet sequence and statistical features), which cannot fully represent the detail information of complex traffic features, and so their predictions are susceptible to anomalies. In order to improve the effect of classification on encrypted app traffic, we propose FusionTC, a novel app traffic classification framework based on feature fusion of flow sequence. FusionTC consists of two-level subclassifiers, which are used to perform decision-level fusion of multimodal features by an upgraded stacking method. The comprehensive capture and fusion of multimodal traffic details, coupled with the refined processing and segmentation of traffic, enables FusionTC to significantly promote classification accuracy and enhance robustness in challenging situations. Based on our self-built app traffic dataset, FusionTC improves the accuracy by at least 3.2% over the state-of-the-art approaches.

From Replay to Regeneration: Recovery of UDP Flood Network Attack Scenario Based on SDN

In recent years, various network attacks have emerged. These attacks are often recorded in the form of Pcap data, which contains many attack details and characteristics that cannot be analyzed through traditional methods alone. Therefore, restoring the network attack scenario through scene reconstruction to achieve data regeneration has become an important entry point for detecting and defending against network attacks. However, current network attack scenarios mainly reproduce the attacker’s attack steps by building a sequence collection of attack scenarios, constructing an attack behavior diagram, or simply replaying the captured network traffic. These methods still have shortcomings in terms of traffic regeneration. To address this limitation, this paper proposes an SDN-based network attack scenario recovery method. By parsing Pcap data and utilizing network topology reconstruction, probability, and packet sequence models, network traffic data can be regenerated. The experimental results show that the proposed method is closer to the real network, with a higher similarity between the reconstructed and actual attack scenarios. Additionally, this method allows for adjusting the intensity of the network attack and the generated topology nodes, which helps network defenders better understand the attackers’ posture and analyze and formulate corresponding security strategies.

Improving the TCP Newreno Congestion Avoidance Algorithm on 5G Networks

Enhancing Transmission Control Protocol (TCP) performance is one of the key solutions for improving the performance of modern wireless communication networks. It is a highly dependable protocol for communication between network hosts based on an internet protocol (IP). It uses packet sequence numbering and acknowledgment (ACK) packets to ensure that data is recoverable in the event of problems like data loss, and corruption. Loss-based Congestion Control (CC) algorithms overreact and underperform in the presence of rapid channel oscillations, resulting in buffer bloat and significant delays. The goal of this paper is to develop an efficient congestion control mechanism for the new TCP agent Newreno over the fifth generation (5G) network, as well as to improve the increment and decrement strategy for adjusting the congestion window (cwnd) during the congestion avoidance phase, It also fast adapts to the current network requirements and adjusts the transmission rate accordingly. TCP enhancements can improve performance under dynamic traffic loads and over long product channels with high bandwidth. As a result, when such a TCP congestion control mechanism is improved, the network’s throughput increases, and low packet losses, and delay are reduced.

LDES: detector design for version number attack detection using linear temporal logic based on discrete event system

The Internet Engineering Task Force (IETF) has defined routing protocols for low power and lossy networks (RPL) for constrained devices. RPL constructs DODAGs (destination oriented directed acyclic graphs), to optimize routing. RPL ensures acyclic topology with the DODAG version number. However, the control message’s DODAG version number is not authenticated. So, RPL is vulnerable to network resource attack known as DODAG Version Number (DVN) attack. DVN attack creates a packet delay, packet loss, cyclic topology, etc., in the network. This paper proposes a method for detecting DODAG version number attacks. Several existing schemes to defend against the DVN, such as cryptographic techniques, trust-based, threshold-based and mitigation are computationally intensive or require protocol modification. DVN does not change the packet format or sequence of packets, but can still perform attacks and hence fall under the category of stealthy attacks, which are difficult to detect using traditional intrusion detection system’s (IDS). Discrete-event system (DES) based IDS have been applied in the literature for stealthy attacks that achieve low overhead, low false alarm rate, etc. However, the construction of DES-based IDS for network protocol may lead to errors, as modelling is manual. The resulting IDS, therefore, is unable to guarantee its correctness. This paper proposes linear temporal logic (LTL) based DES paradigm to detect DVN. LTL-based paradigm facilitates formal verification of the DES-based IDS, and hence the correctness of the scheme is ascertained. The proposed technique is simulated using the Contiki cooja simulator. When the percentage of spiteful nodes in the network increases, the true positive rate, and packet delivery rate drops, while the false positive rate and control message overhead increase. The memory requirement for sending the packets and verifying the nodes is minimal. The LTL-based IDS has been formally verified using NuSMV to ensure the correctness of the framework.

Detection-estimation strategies for delayed systems with unavailable packet sequence

In this paper, we study the problem of remote state estimation on networks with random delays and unavailable packet sequence due to malicious attacks. Two maximum a posteriori (MAP) schemes are proposed to detect the unavailable packet sequence. The first MAP strategy detects the packet sequence using data within a finite time horizon; the second MAP strategy detects the packet sequence by a recursive structure, which effectively reduces the computation time. With the detected packet sequence, we further design a linear minimum mean-squared error (LMMSE) estimation algorithm based on smoothing techniques, rather than using the classic prediction and update structure. A wealth of information contained in the combined measurements is utilized to improve the estimation performance. Finally, the effectiveness of the proposed algorithms is demonstrated by simulation experiments.

Encrypted TLS Traffic Classification on Cloud Platforms

Nowadays, encryption technology has been widely used to protect user privacy. With the explosive growth of mobile Internet, encrypted TLS traffic rises sharply and occupies a great share of current Internet traffic. In reality, the classification of encrypted TLS traffic on cloud platforms brings a new challenge to traditional encrypted traffic classification methods, because some information such as certificates in the TLS flows is no longer effective. In this paper, we apply deep learning technology to the problem of encrypted TLS traffic classification on cloud platforms, and propose NeuTic, which takes the packet sequence of each TLS flow as the input, and effectively classifies raw TLS flows generated by many “cloud” applications. Our approach is able to automatically capture the long-range dependencies between elements in the packet sequences for robust and accurate encrypted TLS traffic classification. In NeuTic, we first convert each TLS flow into three attribute sequences. Then, we train a multi-application traffic classification model using our newly designed deep learning model. Finally, we use the well-trained classification model to classify new incoming TLS flows. We conduct comprehensive experiments on real-world application traces covering multiple “cloud” applications from three different companies. In addition, we compare our experimental results of NeuTic with two deep learning-based methods for encrypted traffic classification. NeuTic outperforms the state-of-the-art approaches in classification accuracy.

Contrastive Learning Enhanced Intrusion Detection

With the continuous development of network technology, the diversity of network traffic constantly increased (intra-class diversity). Nevertheless, the boundary between malicious and benign actions became even ambiguous (inter-class similarity), causing lots of false detection and hindering the further optimization of the detection model. Focusing on challenges brought by intra-class diversity and inter-class similarity, we proposed a novel approach to enhance intrusion detection based on contrastive learning, which can make the right decision while disentangling samples from different classes. First, to bridge the gap when applying contrastive learning to intrusion detection data, we proposed a heuristic method to build contrastive tasks based on random masking of network packet sequences, which can reflect semantic relationships among samples. Then contrastive loss can be calculated to measure the inter-class and intra-class distances. Second, contrastive cross-entropy loss was proposed, which was a combination of contrastive loss and classification loss. Together with a dual branch deep structure, we can optimize the detection and sample distance requirements at the same time. Thirdly, experiments were conducted on diverse real-world and benchmark datasets using different model architectures under various parameter settings. Results on real-world dataset showed that our methods could stable experience a 5% increase in accuracy, and an 8% improvement in detection rate on those easily misdetected scenarios. To verify the method’s effectiveness on different traffic representations, we further conducted experiments on NSL-KDD and UNSW-NB15, which achieved a 7% accuracy improvement on NSL-KDD and a 6% accuracy improvement on UNSW-NB15. Extensive comparison with state of art intrusion detection models in recent five years showed that the proposed methods could effectively improve the accuracy of detection models.

Graph-Based Multi-Label Classification for WiFi Network Traffic Analysis

Network traffic analysis, and specifically anomaly and attack detection, call for sophisticated tools relying on a large number of features. Mathematical modeling is extremely difficult, given the ample variety of traffic patterns and the subtle and varied ways that malicious activity can be carried out in a network. We address this problem by exploiting data-driven modeling and computational intelligence techniques. Sequences of packets captured on the communication medium are considered, along with multi-label metadata. Graph-based modeling of the data are introduced, thus resorting to the powerful GRALG approach based on feature information granulation, identification of a representative alphabet, embedding and genetic optimization. The obtained classifier is evaluated both under accuracy and complexity for two different supervised problems and compared with state-of-the-art algorithms. We show that the proposed preprocessing strategy is able to describe higher level relations between data instances in the input domain, thus allowing the algorithms to suitably reconstruct the structure of the input domain itself. Furthermore, the considered Granular Computing approach is able to extract knowledge on multiple semantic levels, thus effectively describing anomalies as subgraphs-based symbols of the whole network graph, in a specific time interval. Interesting performances can thus be achieved in identifying network traffic patterns, in spite of the complexity of the considered traffic classes.

Recursive Histogram Tracking-Based Rapid Online Anomaly Detection in Cyber-Physical Systems

Prompt online detection of anomalies induced by malicious attacks enhances the efficacy of real-time operation and mitigation of attack, an indispensable part of any cyber-physical system (CPS) management. This article proposes a novel online rapid detection scheme that continuously monitors the data packet stream and infers the sequence of probability distributions, estimated as histograms, and alerts when a change in the histogram is detected, reporting both the attack as well as an estimate of its instant of commencement. A statistical data-driven attack model is proposed and employed that is general enough to represent two ubiquitous types of attacks on CPS: 1) replay and 2) bias-injection. The proposed detection framework relies on the fact that CPSs possess well-defined dynamics that are affected by quasistationary noise, which allows the histogram sequences of the system data packets to converge (to different distributions under the presence of the attack versus the absence of attack). The proposed online scheme detects an attack, and estimates the attack commencement time by relying on the computed distance between real-time estimated histogram versus apriori learned nominal histogram. Our formulation further sheds light on two different attack initiation-time-based subcases, “early” (attack starts before sufficient data of nominal behavior was collected to allow its histogram sequence to be closer to its nominal value) versus “late.” The designed algorithm of our scheme has linear time complexities in the dimension of data packets and algorithm parameters, which makes it suited for rapid detection. The proposed algorithm is implemented and validated on two real supervisory control and data acquisition system datasets, where a low detection delay demonstrates the effectiveness of the scheme.

IoT Device Identification Using Directional Packet Length Sequences and 1D-CNN

With the large-scale application of the Internet of Things (IoT), security issues have become increasingly prominent. Device identification is an effective way to secure IoT environment by quickly identifying the category or model of devices in the network. Currently, the passive fingerprinting method used for IoT device identification based on network traffic flow mostly focuses on protocol features in packet headers but does not consider the direction and length of packet sequences. This paper proposes a device identification method for the IoT based on directional packet length sequences in network flows and a deep convolutional neural network. Each value in a packet length sequence represents the size and transmission direction of the corresponding packet. This method constructs device fingerprints from packet length sequences and uses convolutional layers to extract deep features from the device fingerprints. Experimental results show that this method can effectively recognize device identity with accuracy, recall, precision, and f1-score over 99%. Compared with methods using traditional machine learning and feature extraction techniques, our feature representation is more intuitive, and the classification model is effective.