Soroush Haeri

Feature selection for classification of BGP anomalies using Bayesian models

Traffic anomalies in communication networks greatly degrade network performance. Early detection of such anomalies alleviates their effect on network performance. A number of approaches that involve traffic modeling, signal processing, and machine learning techniques have been employed to detect network traffic anomalies. In this paper, we develop various Naive Bayes (NB) classifiers for detecting the Internet anomalies using the Routing Information Base (RIB) of the Border Gateway Protocol (BGP). The classifiers are trained on the feature sets selected by various feature selection algorithms. We compare the Fisher, minimum redundancy maximum relevance (mRMR), extended/weighted/multi-class odds ratio (EORIWORIMOR), and class discriminating measure (CDM) feature selection algorithms. The odds ratio algorithms are extended to include continuous features. The classifiers that are trained based on the features selected by the WOR algorithm achieve the highest F-score.

Intelligent Deflection Routing in Buffer-Less Networks

Deflection routing is employed to ameliorate packet loss caused by contention in buffer-less architectures such as optical burst-switched networks. The main goal of deflection routing is to successfully deflect a packet based only on a limited knowledge that network nodes possess about their environment. In this paper, we present a framework that introduces intelligence to deflection routing (iDef). iDef decouples the design of the signaling infrastructure from the underlying learning algorithm. It consists of a signaling and a decision-making module. Signaling module implements a feedback management protocol while the decision-making module implements a reinforcement learning algorithm. We also propose several learning-based deflection routing protocols, implement them in iDef using the ns-3 network simulator, and compare their performance.

Classification of BGP anomalies using decision trees and fuzzy rough sets.

Border Gateway Protocol (BGP) is the core component of the Internets routing infrastructure. Abnormal routing behavior impairs global Internet connectivity and stability. Hence, designing and implementing anomaly detection algorithms is important for improving performance of routing protocols. While various machine learning techniques may be employed to detect BGP anomalies, their performance strongly depends on the employed learning algorithms. These techniques have multiple variants that often work well for detecting a particular anomaly. In this paper, we use the decision tree and fuzzy rough set methods for feature selection. Decision tree and extreme learning machine classification techniques are then used to maximize the accuracy of detecting BGP anomalies. The proposed techniques are tested using Internet traffic traces.

A reinforcement learning-based algorithm for deflection routing in optical burst-switched networks

In this paper, we propose a Q-learning based deflection routing algorithm that may be employed to resolve contention in optical burst-switched networks. The main goal of deflection routing is to successfully deflect a burst based only on a limited knowledge that network nodes possess about their environment. Q-learning, one of the reinforcement learning algorithms, has been proposed in the past to help generate deflection decisions. The complexity of existing reinforcement learning-based deflection routing algorithms depends on the number of nodes in the network. The proposed algorithm scales well for larger networks because its complexity depends on the node degree rather than the network size. The algorithm is implemented using the ns-3 network simulator. Simulation results show that it has comparable performance to an existing reinforcement learning deflection routing scheme while having lower memory requirements.

Global resource capacity algorithm with path splitting for virtual network embedding

Network visualization enables support and deployment of new services and applications that the current Internet architecture is unable to support. Virtual Network Embedding (VNE) problem that addresses efficient mapping of virtual network elements onto a physical infrastructure (substrate network) is one of the main challenges in network virtualization. The Global Resource Capacity (GRC) is a VNE algorithm that utilizes for virtual link mapping a modified version of Dijkstras shortest path algorithm. In this paper, we propose the GRC-M algorithm that utilizes the Multicommodity Flow (MCF) algorithm. MCF enables path splitting and yields to higher substrate resource utilizations. Simulation results show that MCF significantly enhances performance of the GRC algorithm.

Deflection Routing in Complex Networks

Contention is the main source of information loss in buffer-less network architectures where deflection routing is a viable contention resolution scheme. In recent years, various reinforcement learning-based deflection routing algorithms have been proposed. However, performance of these algorithms has not been evaluated in larger networks that resemble the autonomous system-level topology of the Internet. In this paper, we compare performance of three reinforcement learning-based deflection routing algorithms by using topologies generated with Waxman and Barabási-Albert algorithms. We examine the scalability of deflection routing algorithms by increasing the network size while keeping the network load constant.

Probabilistic verification of BGP convergence

The Border Gateway Protocol (BGP) is the de facto Internet routing protocol. Various aspects of the BGP protocol have been analyzed using mathematical and experimental approaches. Formal verification of BGP specification validates whether or not a specific set of requirements is satisfied. In resent years, the probabilistic behavior of BGP has been explored. The size of routing tables has been modeled as a stochastic process that changes over time according to some probability distribution function. Hence, the verification of BGP may also be probabilistic in nature due to its randomized behavior. In this paper, we present a probabilistic model checking approach to analyze BGP convergence properties that may be employed to automate the BGP convergence analysis.

Virtual network embeddings in data center networks

Network visualization enables coexistence of multiple virtual networks on a shared infrastructure without requiring unified protocols, applications, and control and management planes. Recent approaches such as Software Defined Networking have enabled cloud service providers to offer virtualized network services that require embedding virtual network requests in data centers. In this paper, we employ R-Vine, D-Vine, and Global Resource Capacity (GRC) algorithms to perform a series of virtual net work embeddings on BCube and Fat-Tree substrate networks. We compare these two data center network topologies to determine the topology that is better suited for virtual network embeddings. Simulation results show that the Fat-Tree network is capable of hosting additional virtual network requests, resulting in higher substrate node and link utilization.

Application of Machine Learning Techniques to Detecting Anomalies in Communication Networks: Classification Algorithms

In this chapter, we apply various machine learning techniques for classification of known network anomalies. The models are trained and tested on various collected datasets. With the advent of fast computing platforms, many neural network-based algorithms have proved useful in detecting BGP anomalies. Performance of classification algorithms depends on the selected features and their combinations. Various classification techniques and approaches are compared based on accuracy and F-Score.

Application of Machine Learning Techniques to Detecting Anomalies in Communication Networks: Datasets and Feature Selection Algorithms

Detecting, analyzing, and defending against cyber threats is an important topic in cyber security. Applying machine learning techniques to detect such threats has received considerable attention in research literature. Anomalies of Border Gateway Protocol (BGP) affect network operations and their detection is of interest to researchers and practitioners. In this Chapter, we describe main properties of the protocol and datasets that contain BGP records collected from various public and private domain repositories such as Route Views, Reseaux IP Europeens (RIPE), and BCNET. We employ various feature selection algorithms to extract the most relevant features that are later used to classify BGP anomalies.