Deni Torres-Roman

Traffic analysis for IP telephony

There is a great interest today in voice communication over the Internet (VoIP) with a high level quality of service (QoS). Our objective in this paper is to assess to what extent todays Internet is meeting this expectation. This work presents H.323 traffic analysis in the scenario where two LANs are connected through the Internet. For tests, series of H.323 calls between two endpoints were established, employing IP commercial cards and an Ethereal protocol analyzer for the packet reception. During the tests were taken into account a set of parameters such as: coded type, packet size (ms), and the voice activity detection. Relationships between the metrics: delay, jitter and packet loss were proved; considering real VoIP scenarios, and different types of codecs.

Jitter in IP networks: a cauchy approach

Jitter is recognized as an important phenomenon that degrades the communication performance. Particularly, in real time services such as voice and video over the Internet, there is evidence that jitter departs from already proposed Laplacian models and that it has a heavy tail behavior. In this paper, we show that an Alpha-Stable jitter model is adequate, and that in some cases the Cauchy distribution provides a satisfactory approximation. Furthermore, this work shows how the jitter dispersion increases with the number of hops in the path, following a power law with scaling exponent dependent on the index of stability ¿. This allows us to predict the expected QoS in terms of the number of nodes and traffic parameters.

Detecting anomalies in network traffic using the method of remaining elements

Attacks, such as port scans, DDoS and worms, threaten the functionality and reliability of IP networks. Early and accurate detection is crucial to mitigate their impact. We use the Method of Remaining Elements (MRE) to detect anomalies based on the characterization of traffic features through a proportional uncertainty measure. MRE has the functionality and performance to detect abnormal behavior and serve as the foundation for next generation network intrusion detection systems.

RTT Prediction in Heavy Tailed Networks

TCP is the most used transport protocol in the Internet and it relies on RTT (Round Trip Time) predictions for the retransmission control algorithm. Most of the algorithms reported in the literature consider memoryless traffic characteristics and do not study the performance under heavy tailed scenarios present in the Internet. In this paper, an algorithm for RTT prediction in a heavy-tailed environment is introduced, and it is shown to follow closely and accurately the actual RTT. The proposed algorithm is simple and permits online implementations. Results are compared with those obtained with other methodologies for real trace sets. It is shown that the proposed algorithm leads to a lower prediction error.

Using Generalized Entropies and OC-SVM with Mahalanobis Kernel for Detection and Classification of Anomalies in Network Traffic

Network anomaly detection and classification is an important open issue in network security. Several approaches and systems based on different mathematical tools have been studied and developed, among them, the Anomaly-Network Intrusion Detection System (A-NIDS), which monitors network traffic and compares it against an established baseline of a “normal” traffic profile. Then, it is necessary to characterize the “normal” Internet traffic. This paper presents an approach for anomaly detection and classification based on Shannon, Renyi and Tsallis entropies of selected features, and the construction of regions from entropy data employing the Mahalanobis distance (MD), and One Class Support Vector Machine (OC-SVM) with different kernels (Radial Basis Function (RBF) and Mahalanobis Kernel (MK)) for “normal” and abnormal traffic. Regular and non-regular regions built from “normal” traffic profiles allow anomaly detection, while the classification is performed under the assumption that regions corresponding to the attack classes have been previously characterized. Although this approach allows the use of as many features as required, only four well-known significant features were selected in our case. In order to evaluate our approach, two different data sets were used: one set of real traffic obtained from an Academic Local Area Network (LAN), and the other a subset of the 1998 MIT-DARPA set. For these data sets, a True positive rate up to 99.35%, a True negative rate up to 99.83% and a False negative rate at about 0.16% were yielded. Experimental results show that certain q-values of the generalized entropies and the use of OC-SVM with RBF kernel improve the detection rate in the detection stage, while the novel inclusion of MK kernel in OC-SVM and k-temporal nearest neighbors improve accuracy in classification. In addition, the results show that using the Box-Cox transformation, the Mahalanobis distance yielded high detection rates with an efficient computation time, while OC-SVM achieved detection rates slightly higher, but is more computationally expensive.

Detecting anomalies in network traffic using Entropy and Mahalanobis distance

This paper proposes an Entropy-Mahalanobis-based methodology to detect certain anomalies in IP traffic. The balanced estimator II is used to model the normal behavior of two intrinsic traffic features: source and destination IP addresses. Mahalanobis distance allows to describe an ellipse that characterizes the network entropy, which allows to determine whether a given actual traffic-slot is normal or anomalous. Experimental tests were conducted to evaluate the performance detection of portscan and worm attacks deployed in a campus network, showing that the methodology is effective in timely and accurate detection of these attacks.

Vehicle Detection with Occlusion Handling, Tracking, and OC-SVM Classification: A High Performance Vision-Based System

This paper presents a high performance vision-based system with a single static camera for traffic surveillance, for moving vehicle detection with occlusion handling, tracking, counting, and One Class Support Vector Machine (OC-SVM) classification. In this approach, moving objects are first segmented from the background using the adaptive Gaussian Mixture Model (GMM). After that, several geometric features are extracted, such as vehicle area, height, width, centroid, and bounding box. As occlusion is present, an algorithm was implemented to reduce it. The tracking is performed with adaptive Kalman filter. Finally, the selected geometric features: estimated area, height, and width are used by different classifiers in order to sort vehicles into three classes: small, midsize, and large. Extensive experimental results in eight real traffic videos with more than 4000 ground truth vehicles have shown that the improved system can run in real time under an occlusion index of 0.312 and classify vehicles with a global detection rate or recall, precision, and F-measure of up to 98.190%, and an F-measure of up to 99.051% for midsize vehicles.

Characterization of worm attacks using entropy, Mahalanobis distance and K-nearest neighbors

This paper presents an algorithm based on entropy and Mahalanobis distance to characterize the behavior of worms attack. For this, is built a matrix with estimates of entropy of different intrinsic features of the network traffic, of this matrix four parameters {μ, γ, λ, d2} are obtained. These values determine an ellipsoidal region that characterizes the behavior of the worm within the space defined by the traffic features. Tests were conducted with two types of traces, one obtained from a LAN network traffic containing real attacks Blaster, Sasser and Welchia, and the other one is a Smurf attack obtained from the MIT-DARPA dataset. Using K nearest neighbors in time was performed a classification of the slots that were outside the ellipsoidal regions defined previously.

A parallel implementation of One-Sided Jacobi SVD for non-symmetric squared matrices on a high-performance GPU

Success of modern technology enterprises in a highly-competitive and fast-changing market relies on the efficient prototyping of high-performance and low-consumption digital devices. GPUs have become the key for reducing the time-to-market of these digital devices by providing a highly-reconfigurable parallel processing platform for implementing computationally expensive DSP algorithms. This paper exposes the benefits of using a GPU for accelerating DSP algorithms used in big data analysis and scientific computing. Particularly, a parallel-structured implementation of the One-Sided Jacobi algorithm for the SV decomposition is analyzed. Two contributions are highlighted, first, the highest reported speedup for the One-Sided SVD algorithm is achieved and, second, a mixed formal/intuitive analysis technique is applied to cyclic algorithms with the aim of adequate them to GPU platforms.

Wavelet q-Fisher Information for Scaling Signal Analysis

This article first introduces the concept of wavelet q-Fisher information and then derives a closed-form expression of this quantifier for scaling signals of parameter . It is shown that this information measure appropriately describes the complexities of scaling signals and provides further analysis flexibility with the parameter q. In the limit of q! 1, wavelet q-Fisher information reduces to the standard wavelet Fisher information and for q > 2 it reverses its behavior. Experimental results on synthesized fGn signals validates the level-shift detection capabilities of wavelet q-Fisher information. A comparative study also shows that wavelet q-Fisher information locates structural changes in correlated and anti-correlated fGn signals in a way comparable with standard breakpoint location techniques but at a fraction of the time. Finally, the application of this quantifier to H.263 encoded video signals is presented.