Guofeng Zhao

Predicted Packet Padding for Anonymous Web Browsing Against Traffic Analysis Attacks

Anonymous communication has become a hot research topic in order to meet the increasing demand for web privacy protection. However, there are few such systems which can provide high level anonymity for web browsing. The reason is the current dominant dummy packet padding method for anonymization against traffic analysis attacks. This method inherits huge delay and bandwidth waste, which inhibits its use for web browsing. In this paper, we propose a predicted packet padding strategy to replace the dummy packet padding method for anonymous web browsing systems. The proposed strategy mitigates delay and bandwidth waste significantly on average. We formulated the traffic analysis attack and defense problem, and defined a metric, cost coefficient of anonymization (CCA), to measure the performance of anonymization. We thoroughly analyzed the problem with the characteristics of web browsing and concluded that the proposed strategy is better than the current dummy packet padding strategy in theory. We have conducted extensive experiments on two real world data sets, and the results confirmed the advantage of the proposed method.

A novel model for user clicks identification based on hidden semi-Markov

User click pattern is a critical part of cyber behavior, which is important for web operators and designers. Usually, massive mixed HTTP requests, we observed, are caused by the clicks from numerous web browsers. Moreover, the ever growing complexity of the web makes it more difficult to identify user click pattern accurately. In this paper, we propose a novel user click pattern identification method based on the hidden semi-Markov model. Moreover, we develop the parameter estimation and state estimation algorithms for our model. In order to initialize the model state value and improve the applicability of our method for real websites, we propose a state selection algorithm based on K-means clustering to reveal the in-line objects of web pages on different websites. We evaluate our method with a real data set, which is collected at the backbone of a state Telecom. The experiment results demonstrated that our method works quite well.

Browsing behavior mimicking attacks on popular web sites for large botnets

With the significant growth of botnets, application layer DDoS attacks are much easier to launch using large botnet, and false negative is always a problem for intrusion detection systems in real practice. In this paper, we propose a novel application layer DDoS attack tool, which mimics human browsing behavior following three statistical distributions, the Zipf-like distribution for web page popularity, the Pareto distribution for page request time interval for an individual browser, and the inverse Gaussian distribution for length of browsing path. A Markov model is established for individual bot to generate attack request traffic. Our experiments indicated that the attack traffic that generated by the proposed tool is pretty similar to the real traffic. As a result, the current statistics based detection algorithms will result high false negative rate in general. In order to counter this kind of attacks, we discussed a few preliminary solutions at the end of this paper.

Traflow: Design and Complementation of a Real Time Traffic Measurement System in High-Speed Networks

High-speed network traffic measurement system has a broad background and significance, design and development environment to a high-speed network measurement system become one of the hot network technology. In this paper the design and implementation of a 1G to a high-speed link to a wire-speed wire-speed or near real-time monitoring of network traffic Traflow measurement system, the system has a flexible, reliable and real-time architecture characterization of the state of network capacity to effectively Recognition P2P, online games, streaming media and audio/video, and other new services, operators can adapt to the different measurement environment.

A Novel Multipath-Transmission Supported Software Defined Wireless Network Architecture

The inflexible management and operation of today’s wireless access networks cannot meet the increasingly growing specific requirements, such as high mobility and throughput, service differentiation, and high-level programmability. In this paper, we put forward a novel multipath-transmission supported software-defined wireless network architecture (MP-SDWN), with the aim of achieving seamless handover, throughput enhancement, and flow-level wireless transmission control as well as programmable interfaces. In particular, this research addresses the following issues: 1) for high mobility and throughput, multi-connection virtual access point is proposed to enable multiple transmission paths simultaneously over a set of access points for users and 2) wireless flow transmission rules and programmable interfaces are implemented into mac80211 subsystem to enable service differentiation and flow-level wireless transmission control. Moreover, the efficiency and flexibility of MP-SDWN are demonstrated in the performance evaluations conducted on a 802.11 based-testbed, and the experimental results show that compared to regular WiFi, our proposed MP-SDWN architecture achieves seamless handover and multifold throughput improvement, and supports flow-level wireless transmission control for different applications.

Network dynamics of mobile social networks

With the rapid development of smartphones and mobile Internet technology, we witness an overwhelming growth of mobile social networks (MSN), which is a type of social network, forming virtual communities among people with similar interests or commonalities. In MSNs, users play a crucial role for their development, deployment and success. Understanding the MSN user behavior therefore attracts interests of different entities - ISPs, service providers, and researchers. However, it is hard to gather a comprehensive real data set, little is known and even less has been published about MSN user activities. In this paper, we focus on analyzing MSN user behavior from the perspective of ISP network, which is seldom reported in literature. Based on the real data set collected from the mobile network gateway of a major mobile carrier who has more than five million subscribers, we present an in-depth user behavior analysis of four popular social networks. We study the MSN user behavior from six aspects: user requests, active online time, sessions, inter-session, the number of requests in a session, and inter-request. We found that power law and lognormal are two popular features of the studied objects, and exposed some interesting findings as well. We hope our work could be helpful for ISPs, MSN content providers, and researchers.

Analysis of User Behavior in Mobile Internet Using Bipartite Network

With the popularization of mobile network and smart phone, the number of mobile Internet users has been growing rapidity and various kinds of services have emerged. It is significant for both academia and industries to understand its user behavior. This paper firstly constructs a user-service weighted bipartite network model, according to the methodology in complex network, and then groups the present services in mobile Internet into 12 categories, in order to research user access characteristics for different kinds of services. Using this model, we analyze the user behavior mainly from user interest range, user interest intensity, user access characteristics and user access relevance four aspects. Our click stream data sets, which contain two 1-week periods, one is in 2010 and the other in 2011, were collected from a WAP gateway of one main Mobile Telecom Carrier in Chongqing Province, China, then, based on the two data sets, we show the characteristics of service access behavior and expose the changes of user behavior during two years.

Tuna: An Efficient and Practical Scheme for Wireless Access Point in 5G Networks Virtualization

Recently, network function virtualization (NFV) has been widely used in 5G innovation. However, with the implementation of NFV, virtualized wireless access point has suffered a significant performance degradation. In this letter, we propose an efficient packet processing scheme (Tuna) to improve the performance of wireless network virtualization. Specifically, we locate management frame into user space for virtualization, and place control and data frame in kernel space to reduce packet processing delay. Moreover, hostapd and network address translation are modified to accelerate packet processing. We implemented the prototype of the proposed scheme, and the experimental results demonstrate that Tuna can improve both delay and throughput dramatically.

A Sleeping and Offloading Optimization Scheme for Energy-Efficient WLANs

In this letter, we propose an access point (AP) sleeping and user offloading optimization scheme to improve energy efficiency in densely deployed WLANs. Through real trace analysis, we investigate AP energy efficiency to obtain the sleep-awake threshold, which is used to select sleep or awake APs according to real-time status information monitored on controller. Moreover, we formulate the user offloading problem as a reverse auction process to optimize energy efficiency of APs involved in offloading. Simulation results demonstrate that, comparing to traditional methods, our scheme can achieve up to 20% energy saving while maintaining effective system coverage and throughput.

MP-SDWN: A Novel Multipath-Supported Software Defined Wireless Network Architecture

The wireless access networks have witnessed an explosive growth in home and enterprise applications. However, to meet the tough performance requirements, such as seamless handover, higher throughput, and agile programing, there still exists many challenges in WiFi networks. In this paper, we propose a novel MP-SDWN (multipath-supported Software Defined Wireless Network), to provide mobility handover, throughput enhancement, and flow-level transmission control as well as programmable system control interfaces. Furthermore, the effectiveness and efficiency of MP-SDWN is evaluated on an experimental prototype.