Traffic Processing Research Articles

Microservices-Based Resource Provisioning for Multi-User Cloud VR in Edge Networks

Cloud virtual reality (VR) is attracting attention in terms of its lightweight head-mounted display (HMD), providing telepresence and mobility. However, it is still in the research stages due to motion-to-photon (MTP) latency, the need for high-speed network infrastructure, and large-scale traffic processing problems. These problems are expected to be partially solved through edge computing, but the limited computing resource capacity of the infrastructure presents new challenges. In particular, in order to efficiently provide multi-user content such as remote meetings on edge devices, resource provisioning is needed that considers the application’s traffic patterns and computing resource requirements at the same time. In this study, we present a microservice architecture (MSA)-based application to provide multi-user cloud VR in edge computing and propose a scheme for planning an efficient service deployment considering the characteristics of each service. The proposed scheme not only guarantees the MTP latency threshold for all users but also aims to reduce networking and computing resource waste. The proposed scheme was evaluated by simulating various scenarios, and the results were compared to several studies. It was confirmed that the proposed scheme represents better performance metrics than the comparison schemes in most cases from the perspectives of networking, computing, and MTP latency.

Towards Sustainable Cloud Computing: Load Balancing with Nature-Inspired Meta-Heuristic Algorithms

Cloud computing is considered suitable for organizations thanks to its flexibility and the provision of digital services via the Internet. The cloud provides nearly limitless computing resources on demand without any upfront costs or long-term contracts, enabling organizations to meet their computing needs more economically. Furthermore, cloud computing provides higher security, scalability, and reliability levels than traditional computing solutions. The efficiency of the platform affects factors such as Quality of Service (QoS), congestion, lifetime, energy consumption, dependability, and scalability. Load balancing refers to managing traffic flow to spread it across several channels. Asymmetric network traffic results in increased traffic processing, more congestion on specific routes, and fewer packets delivered. The paper focuses on analyzing the use of the meta-optimization algorithm based on the principles of natural selection to solve the imbalance of loads in cloud systems. To sum up, it offers a detailed literature review on the essential meta-heuristic algorithms for load balancing in cloud computing. The study also assesses and analyses meta-heuristic algorithm performance in load balancing, as revealed by past studies, experiments, and case studies. Key performance indicators encompass response time, throughput, resource utilization, and scalability, and they are used to assess how these algorithms impact load balance efficiency.

Unidirectional switch model for multiservice traffic with polymodal distribution

The modern stage of development of telecommunication networks is characterized by active improvement of routing algorithms in packet-switched networks taking into account the provision of the required quality of service. The need to transfer large amounts of information is due to the need to ensure the normal functioning of modern multimedia applications, in particular such as IP telephony, video and radio broadcasting, interactive distance learning, which determines the multiservice nature of traffic, which is heterogeneous, and its statistical properties in most cases are of a complex polymodal nature. Taking into account the fact that traditional Poisson models providing FIFO servicing of network traffic for solving modern telecommunication problems lead to overly optimistic results in terms of delays, there is a need to develop a new mathematical model of a unidirectional switch providing FIFO servicing of multiservice traffic with polymodal distribution taking into account the provision of the required quality of subscriber service and an algorithm for estimating its main parameters. Development of a mathematical model of a unidirectional switch FIFO-service of multiservice traffic with polymodal distribution taking into account the provision of the required quality of subscriber service and an algorithm for estimating its main parameters. A new mathematical model of a unidirectional switch implementing FIFO-service of multiservice traffic with polymodal distribution has been developed, allowing one to estimate the probabilities that packets arriving at the switch input will not be processed due to overflow of its buffer memory and exceeding the maximum packet processing time. The model takes into account the delays introduced by the channel and channel equipment during the distribution and processing of packets from the source to the switch in question. Recommendations for modeling traffic processing to ensure the specified accuracy of the results are presented.

Class imbalance and concept drift invariant online botnet threat detection framework for heterogeneous IoT edge

Heterogeneous networks (HetIoT) of high-capacity and resource-constrained IoT devices and their edge associations for on-device distributed critical workloads—called the edge-of-things (EoT)—attract short-burst, botnet-based zero-day attacks that exploit latent vulnerabilities due to heterogeneous device properties, dynamic operational contexts, and insufficient security scrutiny of the constituent proprietary devices. Such a scenario necessitates a device-specific network intrusion detection (NID) technique for localizing the threat space and updated rule learning through online (real-time) model retraining. Furthermore, scarce labeled knowledge base and high levels of class imbalance of NID datasets complicate the ID system design process for EoT environments, as online detection cannot afford computationally expensive data balancing techniques; this necessitates a class imbalance invariant traffic inference technique for data preprocessing. Therefore, we propound the ONIDS online NID technique, which consists of a two-fold solution for the above problems. First, we propose a Beta distribution-based inference technique for efficient traffic behavior approximation—invariant of class imbalance and capable of non-cumulative traffic processing of smaller sample sizes. Then, we put forth an online ID technique called ELMO for class imbalance invariant time-bound training of smaller sample sizes on resource-constrained device-specific network traffic. Together, they are invariant of traffic class imbalances and adaptable to resultant concept drift categories exhibited by HetIoT attack behaviors. ONIDS has low memory and compute footprints and can efficiently process large and small amounts of traffic, making it suitable for online and offline NID. It also exhibits qualitative and quantitative superiority—particularly on smaller data samples.

RT-CBCH: Real-Time VPN Traffic Service Identification Based on Sampled Data in High-Speed Networks

Virtual Private Network (VPN) technology can bypass censorship and access geographically locked services. Some harmful information may be hidden in VPN traffic and circumvent the surveillance systems, bringing a significant challenge to network security. Considering the increasing richness of service types in VPN traffic, identifying traffic service facilitates further targeting harmful VPN traffic. Therefore, VPN traffic service identification is critical in network management. The existing identification methods use complete traffic for analysis. However, massive data analysis in high-speed networks consumes enormous resources, limiting the real-time processing of traffic identification. This paper proposes a real-time VPN traffic service identification method named RT-CBCH. We construct features that are still available after sampling and design a fast traffic processing structure based on Counting Bloom Filter and Chained Hash Table (CBCH). Experimental results validate the real-time capability, stability and accuracy of our method. At the sampling ratio of 1/256, it takes only 23.63 seconds to process the mixed traffic of 900-second traffic generated on a 10 Gbps link and our collected V2Ray traffic, which is increasingly common in VPN traffic. Under different sampling ratios, the identification results remain respectable, with an overall accuracy of about 90% for application service and over 99% for V2Ray proxy service. Furthermore, comparisons with similar work illustrate the high accuracy and low resource consumption of RT-CBCH. Experimental results show that our method can stably implement real-time VPN traffic service identification from sampled data in high-speed networks.

Advancing Snort IPS to Achieve Line Rate Traffic Processing for Effective Network Security Monitoring

Advancing Snort IPS to Achieve Line Rate Traffic Processing for Effective Network Security Monitoring

The method of assessing the efficiency of tunneling management in trunk networks

The article deals with the method of evaluating the effectiveness of tunneling management in trunk networks with a focus on improving efficiency and optimizing data transmission. The relevance of creating a tunneling management technique in the context of growing traffic volumes and expanding the functionality of IP/MPLS networks is substantiated. It is noted that traditional control methods may be ineffective in the given environment, and the use of specialized models of network construction is a key factor for optimal use of tunnel resources. The main requirements for the trunk network technology are high bandwidth, speed of information transfer and scalability. The current state of the market and the needs of users require access to integrated network services, and the organization of virtual private networks, the provision of intelligent services. The growing demand for additional services implemented on top of simple IP access requires the development of backbone network architectures with virtually unlimited scaling capabilities, increased traffic processing speed, and unprecedented flexibility in terms of the organization of additional services. The MPLS technology allows for network integration, due to which service providers will not only be able to save the means invested in asynchronous transmission equipment, but also get additional benefits from the compatible use of protocols. It is proposed to use a specialized model to determine and optimize tunnel resources aimed at maintaining a high level of service quality. It is shown that with an increase in the load with an unchanged number of nodes, the time the packet stays in the tunnel increases, since the load served by each node increases, and therefore the total time the packet stays in the tunnel.

МЕТОДИ ТА ЗАСОБИ ЗАХИСТУ РЕСУРСІВ В КОМП’ЮТЕРНІЙ SDN-МЕРЕЖІ

The work is dedicated to the analysis and improvement of methods and tools for building the architecture of software-defined networks (SDNs). A crucial aspect involves comparing the differences between network management using traditional methods and utilizing an SDN controller. Primary attention is given to the development of security models based on software-defined networks.The research is grounded in the analysis of specific cases involving the use of such networks, including gathering opinions and expert assessments from professionals in the field. It leverages publicly available information on methods and tools for securing the architecture of software-defined networks. SDN technology provides greater flexibility and speed in implementing security measures, allowing real-time responses to threats. In contemporary conditions, where cyber threats are becoming more complex and pronounced, SDN networks enable the detection of attacks, blocking malicious actions, and applying security policies in real-time. However, the increasing complexity of cyber threats and constant technological changes necessitate further development and enhancement of the information security of SDN network resources for companies. There is a need for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks. The necessity for further analysis and improvement of methods and tools for protecting information and other resources in computer-based SDN networks serves as the foundation for this research. As a result, an enhancement in the level of information security for SDN network resources has been achieved by: 1) reducing the intervention time in the network; 2) applying an improved method of traffic processing based on network security of packet flows, allowing desired network applications to efficiently manage forwarding.

ADJUSTING THE PARAMETERS OF MACHINE LEARNING ALGORITHMS TO IMPROVE THE SPEED AND ACCURACY OF TRAFFIC CLASSIFICATION

Background. Telecommunications developments lead to new mobile network technologies and especially 5G, which has only recently been launched, sixth generation of which is already under active development. The development of new technologies influence on both types of mobile traffic (V2V, IoT) and leads to the significant increase in the volume of existing traffic types. Currently, existing methods of traffic processing are not adapted to such changes, which may lead to a deterioration in the quality of service.
 Objective. The purpose of the paper is to analyze the effectiveness of machine learning algorithms to solve the task of traffic classification in mobile networks in real time.
 Methods. The method of solving the problem of increasing the efficiency of information processing is the introduction of new algorithms for traffic classification and prioritization. In this regard, the paper presents the urgent task of analyzing the effectiveness of machine learning algorithms to solve the task of traffic classification in mobile networks in real time.
 Results. Comparison indicated the best accuracy of the ANN algorithm that was achieved with the number of hidden layers of the network equal to 200. Also, the research results showed that different applications have different recognition accuracy, which does not depend on the total number of packets in the dataset.
 Conclusions. This proceeding solves the urgent problem of increasing the efficiency of the mobile communication system through the use of machine learning algorithms for traffic classification. In this regard, it can be concluded that the most promising is the application of algorithms based on ANN. In future the aspect of anomaly detection based on traffic classification and traffic pattern preparation should be investigated, as this process allows detecting attacks to network infrastructure and increase mobile network security.

Service Deployment With Priority Queueing for Traffic Processing and Transmission in Network Function Virtualization

Network function virtualization enables service providers to flexibly deploy network services. The existing works mainly focus on function placement and capacity allocation without exploring traffic scheduling for service deployment, by adopting a first-in-first-out policy. It introduces inefficiency considering that different services vary in the delay requirements. This paper proposes a service deployment model with priority queuing for both traffic processing and transmission to minimize the deployment cost with satisfying the service delay constraints. We analyze the problem including proving its NP-hardness and the convexity of a subproblem. Based on the analysis, we develop a reinforcement learning-based approach to address the problem in a decomposition manner with a polynomial-time complexity in each episode. Several specific designs are introduced to fit the learning-based approach to the considered deployment problem with priority queueing. The numerical results show that the introduced approach achieves an objective value comparable to the optimal one obtained by brute force search with a computation time 103 times shorter. Compared to a conventional model with the first-in-first-out policy, the proposed model reduces the deployment cost by adopting a more flexible queueing policy.

METAseen: Analyzing network traffic and privacy policies in Web 3.0 based Metaverse

Metaverse is a new emerging concept building up a virtual environment for the user using Virtual Reality (VR) and blockchain technology but introduces privacy risks. Now, a series of challenges arise in Metaverse security, including massive data traffic breaches, large-scale user tracking, analysis activities, unreliable Artificial Intelligence (AI) analysis results, and social engineering security for people. In this work, we concentrate on Decentraland and Sandbox, two well-known Metaverse applications in Web 3.0. Our experiments analyze, for the first time, the personal privacy data exposed by Metaverse applications and services from a combined perspective of network traffic and privacy policy. We develop a lightweight traffic processing approach suitable for the Web 3.0 environment, which doesn't rely on complex decryption or reverse engineering techniques.We propose a smart contract interaction traffic analysis method capable of retrieving user interactions with Metaverse applications and blockchain smart contracts. This method provides a new approach to de-anonymizing users' identities through Metaverse applications. Our system, METAseen, analyzes and compares network traffic with the privacy policies of Metaverse applications to identify controversial data collection practices. The consistency check experiment reveals that the data types exposed by Metaverse applications include Personal Identifiable Information (PII), device information, and Metaverse-related data. By comparing the data flows observed in the network traffic with assertions made in the privacy regulations of the Metaverse service provider, we discovered that far more than 49% of the Metaverse data flows needed to be disclosed appropriately.

Deep Q-network-based heuristic intrusion detection against edge-based SIoT zero-day attacks

How to process and classify zero-day attacks due to their huge damage to social Internet of Things (SIoT) systems has become a hot research issue. To solve this issue, we propose a heuristic learning intrusion detection system with Deep Q-Networks (DQN) for edge-based SIoT networks under the scenario of insufficient training samples, which is named DQN-HIDS. It is composed of an SIoT network traffic processing module and a DQN-based heuristic learning network. The SIoT network traffic processing module generates SIoT traffic samples, selects samples entering a classifier and a cybersecurity examiner center, and outputs similarity. We integrate DQN into a heuristic learning network to gradually improve its ability to identify malicious traffic. Specially, reward functions are designed according to the selected actions of the network, in order to punish the behavior of incorrectly labeling malicious samples and make variable reward functions adapt to different execution actions. The LSTM-based DQN then maximizes the cumulative expected reward to find the optimal strategy for the heuristic learning network. Consequently, DQN-HIDS gradually improves the behavior frequency of its labeling, reduces resource workloads, and increases the ability to label SIoT network traffic. Experiments show the performance of DQN-HIDS in terms of the workload of the examiner center and the queue workload of delayed samples, the rewards obtained by the DQN-based heuristic learning network, and the accuracy of the classifier. Comparisons with a state-of-the-art deep learning model and typical machine learning methods are also made, demonstrating the advantages of DQN-HIDS with fewer SIoT network traffic samples.

PRISM: A Hierarchical Intrusion Detection Architecture for Large-Scale Cyber Networks

The increase in scale of cyber networks and the rise in sophistication of cyber-attacks have introduced several challenges in intrusion detection. The primary challenge is the requirement to detect complex multi-stage attacks in realtime by processing the immense amount of traffic produced by present-day networks. In this paper we present PRISM, a hierarchical intrusion detection architecture that uses a novel attacker behavior model-based sampling technique to minimize the realtime traffic processing overhead. PRISM has a unique multi-layered architecture that monitors network traffic distributedly to provide efficiency in processing and modularity in design. PRISM employs a Hidden Markov Model-based prediction mechanism to identify multi-stage attacks and ascertain the attack progression for a proactive response. Furthermore, PRISM introduces a stream management procedure that rectifies the issue of alert reordering when collected from distributed alert reporting systems. To evaluate the performance of PRISM, multiple metrics have been proposed, and various experiments have been conducted on a multi-stage attack dataset. The results exhibit up to 7.5x improvement in processing overhead as compared to a standard centralized IDS without the loss of prediction accuracy while demonstrating the ability to predict different attack stages promptly.

Virtual Service Embedding With Time-Varying Load and Provable Guarantees

Deploying services efficiently while satisfying their quality requirements is a major challenge in network slicing. Effective solutions place instances of the services' virtual network functions (VNFs) at different locations of the cellular infrastructure and manage such instances by scaling them as needed. In this work, we address the above problem and the very relevant aspect of sub-slice reuse among different services. Further, unlike prior art, we account for the services' finite lifetime and time-varying traffic load. We identify two major sources of inefficiency in service management: (i) the overspending of computing resources due to traffic of multiple services with different latency requirements being processed by the same virtual machine (VM), and (ii) the poor packing of traffic processing requests in the same VM, leading to opening more VMs than necessary. To cope with the above issues, we devise an algorithm, called REShare, that can dynamically adapt to the system's operational conditions and find an optimal trade-off between the aforementioned opposite requirements. We prove that REShare has low algorithmic complexity and is asymptotic 2-competitive under a non-decreasing load. Numerical results, leveraging real-world scenarios, show that our solution outperforms alternatives, swiftly adapting to time-varying conditions and reducing service cost by over 25%.

4MIDable: Flexible Network Offloading For Security VNFs

The ever-growing volume of network traffic and widening adoption of Internet protocols to underpin common communication processes augments the importance of network security. In order to enforce network security policies, network managers adopt a widening set of middleboxes and network appliances to improve traffic monitoring and processing capabilities. The resource requirements to support network security appliances are constantly increasing, making efficiency of these systems an essential aspect. The move toward Software-Defined Networking and programmable data planes offers a mean to offload traffic processing functionalities to within the network itself. To this end, we present the 4MIDable framework: a platform that facilitates the integration of existing middleboxes and monitoring appliances with an SDN (P4) network infrastructure. We also present P4Protect, a 4MIDable agent that protects the network from control plane DoS attacks with negligible impact on control plane latency, and P4ID (P4-Enhanced Intrusion Detection), a 4MIDable agent that offers stateful processing and feedback to unmodified Intrusion Detection System middleboxes and reduces traffic processing by over 80% without affecting threat detection rates.

Вызовы в реализации систем глубокого анализа сетевого трафика методом полного протокольного декодирования

This paper presents a summary of experience in developing the deep packet inspection system using full protocol decoding. The paper reviews the challenges encountered during implementation and provides a high-level overview of the solutions to these issues. The challenges can be grouped into two groups. The first group is related to the fundamental tasks which must be addressed when implementing full protocol decoding systems. This includes ensuring correct protocol parsing, which involves identifying and interpreting protocol headers and fields correctly. Moreover, it is necessary to ensure the processing of fragmented packets and the assembly of fragments into the original message. Additionally, the processing and analysis of encrypted traffic is a crucial task that may require the use of specialized algorithms and tools. The second group of problems is related to optimizing the process of full protocol decoding to ensure high-speed traffic processing, as well as supporting new protocols and the ability to add user-defined extensions. While there are open-source systems that address some of the primary issues associated with full protocol decoding, there may be a need for additional effort and specialized solutions to efficiently operate and expand the functionality of such systems. Although implementing deep network traffic analysis tools using full protocol decoding requires the use of advanced hardware and software technologies, the benefits of such analysis are significant. This approach provides a more complete understanding of network traffic patterns and enables more effective detection and prevention of cyber-attacks. It also allows for more accurate monitoring of network performance and the identification of potential bottlenecks or other issues that may impact network efficiency. In this article, we also emphasize the importance of system architecture development and implementation to ensure the successful deployment of deep network traffic analysis tools using full protocol decoding. At last, we conducted an experiment where several advanced optimizations were implemented in the system that had already solved primary issues. These optimizations related to working with memory, based on the features of the traffic processing scheme. By results, we evaluated significant performance improvement in solving secondary tasks, described in this work.

Метод комплексного контроля передачи трафика в программно-конфигурируемых сетях

Modern requirements for traffic processing should possess the properties of mobility, speed, and simplification of network equipment administration. However, the existing classical Ethernet networks with Quality of Service failed to meet these requirements, which led to the emergence of software defined networks (SDN). In SDN, the main protocol is OpenFlow, which enables processing and managing heterogeneous traffic. This article aims to propose a methodology for eliminating the disadvantages inherent in the OpenFlow protocol. A method for complex control of traffic transmission in SDN was developed based on the algorithm of early diagnosis of real-time traffic losses during the transmission of heterogeneous traffic in the OpenFlow switch and the algorithm of real-time traffic transmission using a scheduler and a delivery control function in SDN. Moore digital automata of the proposed transmission algorithms were developed. A description of systems of canonical equations and output functions for digital automata was presented. Tables of transitions of digital automata were constructed, states of digital automata were encoded, and digital automata were synthesized based on D-triggers. The formalization of the developed method and algorithms of traffic transmission in SDN based on digital automata made it possible to design control automata and algorithms on FPGA of the Spartan 6 family and later familie.

ВЕРИФИКАЦИЯ ОПТИМИЗАЦИОННОЙ МОДЕЛИ ПЕРЕРАБОТКИ ВАГОНОПОТОКОВ НА СОРТИРОВОЧНОЙ СТАНЦИИ МЕТОДОМ ИМИТАЦИОННОГО МОДЕЛИРОВАНИЯ

As a rule, current planning of operation of marshalling station is carried out with the use of heuristic algorithms and simulation modeling. It is possible to improve the quality of planning on the basis of strict optimization models. With the use of the mixed integer linear programming method the authors have created a mathematical and a computer model of car traffic processing at a marshalling station. The paper considers questions of verification of the optimization model with the use of simulation modeling.

Traffic Processing Model of Big Data Base Station Based on Hybrid Improved CNN Algorithm and K-Centroids Clustering Algorithm

Traffic Processing Model of Big Data Base Station Based on Hybrid Improved CNN Algorithm and K-Centroids Clustering Algorithm

Simulation and analysis models of hybrid software­configured devices

The analysis of the algorithm, based on which the simulation and analytical model of the hybrid software-configurable device is automatically synthesized, was carried out. The solution for modeling OpenFlow equipment was also considered, and an original OpenFlow switch model was developed, which is distinguished by the ability to manage delays based on the results of its mathematical model. The operation scheme of a hybrid switch that supports both traditional switching and OpenFlow switching has been developed. This scheme allows solving complex tasks in the physical infrastructure of virtualized networks. A module has been developed to create a realistic delay and limit the capacity and performance of the hybrid switch model, which can work according to the data obtained as a result of the experimental study. Additional traffic processing schemes have been developed for a more detailed implementation of the hybrid software-configurable equipment model. The basic model of the switch presented in the INET OMNeT++ framework is considered. The switch is represented by a set of modules interacting through the OMNeT transmission system. The most detailed modules of Ethernet interfaces are implemented, in particular, there are implementations of the input queue of the Tail-Drop type, output queues of the FIFO, RED, WRED, PQ, CBFQ types, as well as the implementation of the transmission delay on the line. The virtualization technology of network functions, which is built on the basis of software-configured networks, has been studied, and the most popular Linux-based solutions are used as a software-controlled Open vSwitch switch. The considered methods of forming a model of such a switch. Open vSwitch is architecturally different from both classical and OpenFlow real switches, as there are no dedicated packet refactoring units (except for network cards with hardware header processing and FPGAs), dedicated memory and processors for switching, Open vSwitch uses a kernel module (or module DPDK for direct transmission without the participation of the kernel) to transmit packets based on information from the OVSDB database or OpenFlow tables.