Young J. Won

Towards automated application signature generation for traffic identification

Traditionally, Internet applications have been identified by using predefined well-known ports with questionable accuracy. An alternative approach, application-layer signature mapping, involves the exhaustive search of reliable signatures but with more promising accuracy. With a prior protocol knowledge, the signature generation can guarantee a high accuracy. As more applications use proprietary protocols, it becomes increasingly difficult to obtain an accurate signature while avoiding time-consuming and manual signature generation process. This paper proposes an automated approach for generating application-level signature, the LASER algorithm, that does not need to be preceded by an analysis of application protocols. We show that our approach is as accurate and efficient as the approach that uses preceding application protocol analysis.

Characteristic analysis of internet traffic from the perspective of flows

The necessity of network traffic monitoring and analysis is growing dramatically with increasing network usage demands from individual users as well as business communities. Most network traffic monitoring and analysis systems are based on flows. One key asset with these systems is to compress a significant amount of packet data into flows. However, the compression ratio is highly variable in the recent network environments due to the increased use of peer-to-peer file sharing applications and the frequent appearances of abnormal traffic caused by Internet worms, which negatively influences the performance of traffic analysis systems. The performance of traffic monitoring and analysis systems highly depends on the number of flows as well as link utilization and the pattern of packet arrival. This paper examines the characteristics of recent Internet traffic from the perspective of flows. We found that the frequent occurrence of flash flows highly affects the performance of the existing flow-based traffic monitoring systems. Using various flow-related metrics, we analyzed the IP traffic traces collected from the Internet junction at POSTECH, a university with over 6000 end hosts and servers.

End-User IPTV Traffic Measurement of Residential Broadband Access Networks

Offering IPTV to broadband access subscribers is a key challenge as well as a prospective revenue source for ISPs. Despite of its growing interest, no comprehensive study has presented the traffic details of real-world commercial IPTV services yet. We have measured commercial IPTV traffic via four different residential broadband access networks, namely xDSL, Cable, FTTB, and FTTH. In this paper, we present traffic statistics and insight of the IPTV traffic impact onto these end- subscriber broadband accesses. We also present the mathematical formulas to describe traffic behavior and bandwidth demand in IPTV VoD services.

A Hybrid Approach for Accurate Application Traffic Identification

The traffic dynamics of the Internets dominant applications, such as peer-to-peer and multimedia, worsen the accuracy of the existing application traffic identification. There is a strong need for both practical and reliable identification methods with proof of accuracy. This paper proposes a hybrid approach of signature matching and session behavior mapping methods for accurate application traffic identification. In particular, the paper explores a priority-based signature matching scheme on early packet samples to replace conventional signature matching. It then uses session relationships to identify application traffic from the remaining, unidentified traffic. In validation, we present the accuracy analysis of applications using the Port Dependency Ratio (PDR) method for simulated traffic as well as real traffic.

Empirical Analysis of Application-Level Traffic Classification Using Supervised Machine Learning

Accurate application traffic classification and identification are important for network monitoring and analysis. The accuracy of traditional Internet application traffic classification approaches is rapidly decreasing due to the diversity of todays Internet application traffic, such as ephemeral port allocation, proprietary protocol, and traffic encryption. This paper presents an empirical evaluation of application-level traffic classification using supervised machine learning techniques. Our results indicate that we cannot achieve high accuracy with a simple feature set. Even if a simple feature set shows good performance in application category-level classification, more sophisticated feature selection methods and other techniques are necessary for performance enhancement.

Measurement of download and play and streaming IPTV traffic

Telecommunication service providers are eager for the benefits of IPTV services to penetrate into the lives of their broadband subscribers. A few multimedia delivery methods, such as multicast and P2P-style data bartering, are investigated in an attempt to reduce the network traffic at the backbone while preventing quality of experience degradation. While delivering fiber to households is still in its infancy in most parts of the world, the download and play delivery scheme has been deployed as an interim solution for video-on-demand service until fullscale multicast IPTV deployment in order to handle heterogeneous residential access networks. QoS-controlled streaming IPTV (e.g., multicast) is only available to customers with high-bandwidth broadband access. The research community has been heavily focused on how to reduce network load at the backbone and has overlooked the importance of traffic impact at the customer premises, which is very closely related to the quality of experience. This article provides a traffic impact analysis and a discussion of network-centric quality from the perspective of customers using real-world commercial traces in various user scenarios. We also present an overview of IPTV delivery schemes and user behavior models from previous measurement work. Finally, we illustrate a bandwidth demand estimation method for D&P scenarios.

Traffic Classification Based on Flow Similarity

Due to the various masquerading strategies adopted by newer P2P applications to avoid detection and filtering, well-known port mapping techniques cannot guarantee their accuracy any more. Alternative approaches, application-signature mapping, behavior-based analysis, and machine learning based classification methods, show more promising accuracy. However, these methods still have complexity issues. This paper provides a new classification method which utilizes cosine similarity between network flows.

Measurement analysis of mobile data networks

This paper analyzes the mobile data traffic traces of a CDMA network and presents its unique characteristics compared to the wired Internet traffic. The data set was passively collected from the backbone of a commercial mobile service provider. Our study shows the highly uneven up/downlink traffic utilization nature in mobile data networks along with small packet sizes, so called the mice in the network. In addition, the relatively short session length reflects the user behavior in mobile data network. We have also observed a large amount of retransmissions on the backbone and analyzed the consequences of such phenomenon as well as the possible causes.

An effective similarity metric for application traffic classification

Application level traffic classification is one of the major issues in network monitoring and traffic engineering. In our previous study, we proposed a new traffic classification method that utilizes a flow similarity function based on Cosine Similarity. This paper compares the classification accuracy of three similarity metrics, Jaccard Similarity, Cosine Similarity, and Gaussian Radius Based Function, to select appropriate similarity metrics for application traffic classification. This paper also defines a new two-stage traffic classification algorithm that can guarantee high classification accuracy even under an asymmetric routing environment, with reasonable complexity.

Fault detection in IP-based process control networks using data mining

Industrial process control IP networks support communications between process control applications and devices. Communication faults in any stage of these control networks can cause delays or even shutdown of the entire manufacturing process. The current process of detecting and diagnosing communication faults is mostly manual, cumbersome, and inefficient. Detecting early symptoms of potential problems is very important but automated solutions do not yet exist. Our research goal is to automate the process of detecting and diagnosing the communication faults as well as to prevent problems by detecting early symptoms of potential problems. To achieve our goal, we have first investigated real-world fault cases and summarized control network failures. We have also defined network metrics and their alarm conditions to detect early symptoms for communication failures between process control servers and devices. In particular, we leverage data mining techniques to train the system to learn the rules of network faults in control networks and our testing results show that these rules are very effective. In our earlier work, we presented a design of a process control network monitoring and fault diagnosis system. In this paper, we focus on how the fault detection part of this system can be improved using data mining techniques.