Traffic prediction of wireless networks attracted many researchersand practitioners during the past decades. However, wireless traffic frequentlyexhibits strong nonlinearities and complicated patterns, which makes it ...Traffic prediction of wireless networks attracted many researchersand practitioners during the past decades. However, wireless traffic frequentlyexhibits strong nonlinearities and complicated patterns, which makes it challengingto be predicted accurately. Many of the existing approaches forpredicting wireless network traffic are unable to produce accurate predictionsbecause they lack the ability to describe the dynamic spatial-temporalcorrelations of wireless network traffic data. In this paper, we proposed anovel meta-heuristic optimization approach based on fitness grey wolf anddipper throated optimization algorithms for boosting the prediction accuracyof traffic volume. The proposed algorithm is employed to optimize the hyperparametersof long short-term memory (LSTM) network as an efficient timeseries modeling approach which is widely used in sequence prediction tasks.To prove the superiority of the proposed algorithm, four other optimizationalgorithms were employed to optimize LSTM, and the results were compared.The evaluation results confirmed the effectiveness of the proposed approachin predicting the traffic of wireless networks accurately. On the other hand,a statistical analysis is performed to emphasize the stability of the proposedapproach.展开更多
The flourishing complex network theory has aroused increasing interest in studying the properties of real-world networks. Based on the traffic network of Chang-Zhu Tan urban agglomeration in central China, some basic ...The flourishing complex network theory has aroused increasing interest in studying the properties of real-world networks. Based on the traffic network of Chang-Zhu Tan urban agglomeration in central China, some basic network topological characteristics were computed with data collected from local traffic maps, which showed that the traffic networks were small-world networks with strong resilience against failure; more importantly, the investigations of as- sortativity coefficient and average nearestlneighbour degree implied the disassortativity of the traffic networks. Since traffic network hierarchy as an important basic property has been neither studied intensively nor proved quantitatively, the authors are inspired to analyse traffic network hierarchy with disassortativity and to finely characterize hierarchy in the traffic networks by using the n-degree-n-clustering coefficient relationship. Through numerical results and analyses an exciting conclusion is drawn that the traffic networks exhibit a significant hierarchy, that is, the traffic networks are proved to be hierarchically organized. The result provides important information and theoretical groundwork for optimal transport planning.展开更多
In the paper,we propose a framework to investigate how to effectively perform traffic flow splitting in heterogeneous wireless networks from a queue point.The average packet delay in heterogeneous wireless networks is...In the paper,we propose a framework to investigate how to effectively perform traffic flow splitting in heterogeneous wireless networks from a queue point.The average packet delay in heterogeneous wireless networks is derived in a probabilistic manner.The basic idea can be understood via treating the integrated heterogeneous wireless networks as different coupled and parallel queuing systems.The integrated network performance can approach that of one queue with maximal the multiplexing gain.For the purpose of illustrating the effectively of our proposed model,the Cellular/WLAN interworking is exploited.To minimize the average delay,a heuristic search algorithm is used to get the optimal probability of splitting traffic flow.Further,a Markov process is applied to evaluate the performance of the proposed scheme and compare with that of selecting the best network to access in terms of packet mean delay and blocking probability.Numerical results illustrate our proposed framework is effective and the flow splitting transmission can obtain more performance gain in heterogeneous wireless networks.展开更多
The Peer-to-Peer(P2P)network traffic identification technology includes Transport Layer Identification(TLI)and Deep Packet Inspection(DPI)methods.By analyzing packets of the transport layer and the traffic characteris...The Peer-to-Peer(P2P)network traffic identification technology includes Transport Layer Identification(TLI)and Deep Packet Inspection(DPI)methods.By analyzing packets of the transport layer and the traffic characteristic in the P2P system,TLI can identify whether or not the network data flow belongs to the P2P system.The DPI method adopts protocol analysis technology and reverting technology.It picks up data from the P2P application layer and analyzes the characteristics of the payload to judge if the network traffic belongs to P2P applications.Due to its accuracy,robustness and classifying ability,DPI is the main method used to identify P2P traffic.Adopting the advantages of TLI and DPI,a precise and efficient technology for P2P network traffic identification can be designed.展开更多
Network traffic classification is a crucial research area aimed at improving quality of service,simplifying network management,and enhancing network security.To address the growing complexity of cryptography,researche...Network traffic classification is a crucial research area aimed at improving quality of service,simplifying network management,and enhancing network security.To address the growing complexity of cryptography,researchers have proposed various machine learning and deep learning approaches to tackle this challenge.However,existing mainstream methods face several general issues.On one hand,the widely used Transformer architecture exhibits high computational complexity,which negatively impacts its efficiency.On the other hand,traditional methods are often unreliable in traffic representation,frequently losing important byte information while retaining unnecessary biases.To address these problems,this paper introduces the Swin Transformer architecture into the domain of network traffic classification and proposes the NetST(Network Swin Transformer)model.This model improves the Swin Transformer to better accommodate the characteristics of network traffic,effectively addressing efficiency issues.Furthermore,this paper presents a traffic representation scheme designed to extract meaningful information from large volumes of traffic while minimizing bias.We integrate four datasets relevant to network traffic classification for our experiments,and the results demonstrate that NetST achieves a high accuracy rate while maintaining low memory usage.展开更多
Abnormal network traffic, as a frequent security risk, requires a series of techniques to categorize and detect it. Existing network traffic anomaly detection still faces challenges: the inability to fully extract loc...Abnormal network traffic, as a frequent security risk, requires a series of techniques to categorize and detect it. Existing network traffic anomaly detection still faces challenges: the inability to fully extract local and global features, as well as the lack of effective mechanisms to capture complex interactions between features;Additionally, when increasing the receptive field to obtain deeper feature representations, the reliance on increasing network depth leads to a significant increase in computational resource consumption, affecting the efficiency and performance of detection. Based on these issues, firstly, this paper proposes a network traffic anomaly detection model based on parallel dilated convolution and residual learning (Res-PDC). To better explore the interactive relationships between features, the traffic samples are converted into two-dimensional matrix. A module combining parallel dilated convolutions and residual learning (res-pdc) was designed to extract local and global features of traffic at different scales. By utilizing res-pdc modules with different dilation rates, we can effectively capture spatial features at different scales and explore feature dependencies spanning wider regions without increasing computational resources. Secondly, to focus and integrate the information in different feature subspaces, further enhance and extract the interactions among the features, multi-head attention is added to Res-PDC, resulting in the final model: multi-head attention enhanced parallel dilated convolution and residual learning (MHA-Res-PDC) for network traffic anomaly detection. Finally, comparisons with other machine learning and deep learning algorithms are conducted on the NSL-KDD and CIC-IDS-2018 datasets. The experimental results demonstrate that the proposed method in this paper can effectively improve the detection performance.展开更多
In the big data era,the surge in network traffic volume poses challenges for network management and cybersecurity.Network Traffic Classification(NTC)employs deep learning to categorize traffic data,aiding security and...In the big data era,the surge in network traffic volume poses challenges for network management and cybersecurity.Network Traffic Classification(NTC)employs deep learning to categorize traffic data,aiding security and analysis systems as Intrusion Detection Systems(IDS)and Intrusion Prevention Systems(IPS).However,current NTC methods,based on isolated network simulations,usually fail to adapt to new protocols and applications and ignore the effects of network conditions and user behavior on traffic patterns.To improve network traffic management insights,federated learning frameworks have been proposed to aggregate diverse traffic data for collaborative model training.This approach faces challenges like data integrity,label noise,packet loss,and skewed data distributions.While label noise can be mitigated through the use of sophisticated traffic labeling tools,other issues such as packet loss and skewed data distributions encountered in Network Packet Brokers(NPB)can severely impede the efficacy of federated learning algorithms.In this paper,we introduced the Robust Traffic Classifier with Federated Contrastive Learning(FC-RTC),combining federated and contrastive learning methods.Using the Supcon-Loss function from contrastive learning,FC-RTC distinguishes between similar and dissimilar samples.Training by sample pairs,FC-RTC effectively updates when receiving corrupted traffic data with packet loss or disorder.In cases of sample imbalance,contrastive loss functions for similar samples reduce model bias towards higher proportion data.By addressing uneven data distribution and packet loss,our system enhances its capability to adapt and perform accurately in real-world network traffic analysis,meeting the specific demands of this complex field.展开更多
With the rise of encrypted traffic,traditional network analysis methods have become less effective,leading to a shift towards deep learning-based approaches.Among these,multimodal learning-based classification methods...With the rise of encrypted traffic,traditional network analysis methods have become less effective,leading to a shift towards deep learning-based approaches.Among these,multimodal learning-based classification methods have gained attention due to their ability to leverage diverse feature sets from encrypted traffic,improving classification accuracy.However,existing research predominantly relies on late fusion techniques,which hinder the full utilization of deep features within the data.To address this limitation,we propose a novel multimodal encrypted traffic classification model that synchronizes modality fusion with multiscale feature extraction.Specifically,our approach performs real-time fusion of modalities at each stage of feature extraction,enhancing feature representation at each level and preserving inter-level correlations for more effective learning.This continuous fusion strategy improves the model’s ability to detect subtle variations in encrypted traffic,while boosting its robustness and adaptability to evolving network conditions.Experimental results on two real-world encrypted traffic datasets demonstrate that our method achieves a classification accuracy of 98.23% and 97.63%,outperforming existing multimodal learning-based methods.展开更多
The integration of cloud computing into traditional industrial control systems is accelerating the evolution of Industrial Cyber-Physical System(ICPS),enhancing intelligence and autonomy.However,this transition also e...The integration of cloud computing into traditional industrial control systems is accelerating the evolution of Industrial Cyber-Physical System(ICPS),enhancing intelligence and autonomy.However,this transition also expands the attack surface,introducing critical security vulnerabilities.To address these challenges,this article proposes a hybrid intrusion detection scheme for securing ICPSs that combines system state anomaly and network traffic anomaly detection.Specifically,an improved variation-Bayesian-based noise covariance-adaptive nonlinear Kalman filtering(IVB-NCA-NLKF)method is developed to model nonlinear system dynamics,enabling optimal state estimation in multi-sensor ICPS environments.Intrusions within the physical sensing system are identified by analyzing residual discrepancies between predicted and observed system states.Simultaneously,an adaptive network traffic anomaly detection mechanism is introduced,leveraging learned traffic patterns to detect node-and network-level anomalies through pattern matching.Extensive experiments on a simulated network control system demonstrate that the proposed framework achieves higher detection accuracy(92.14%)with a reduced false alarm rate(0.81%).Moreover,it not only detects known attacks and vulnerabilities but also uncovers stealthy attacks that induce system state deviations,providing a robust and comprehensive security solution for the safety protection of ICPS.展开更多
This paper comprehensively analyzes the evolution of traffic light systems in Shanghai,highlighting the technological advancements and their impact on traffic management and safety.Starting from the historical context...This paper comprehensively analyzes the evolution of traffic light systems in Shanghai,highlighting the technological advancements and their impact on traffic management and safety.Starting from the historical context of the first traffic light in London in 1868 to the modern automated systems,the study explores the complexity and adaptability of traffic lights in Shanghai.Through field surveys and interviews with traffic engineers,the paper debunks common misconceptions about traffic light operation,revealing a sophisticated network that responds to real-time traffic dynamics using software like the Sydney Coordinated Adaptive Traffic System(SCATS)6.The study also discusses the importance of pedestrian safety,suggesting future enhancements such as Global Positioning System(GPS)based emergency systems and accommodations for color-blind individuals.The paper further delves into the potential of Artificial Intelligence(AI)and Vehicle-to-Infrastructure(V21)technology in revolutionizing traffic light systems,emphasizing their role in improving traffic flow and safety.The findings underscore Shanghai’s progressive approach to traffic management,showcasing the city’s commitment to optimizing traffic control solutions for the benefit of both vehicles and pedestrians.展开更多
In this paper we apply the nonlinear time series analysis method to small-time scale traffic measurement data. The prediction-based method is used to determine the embedding dimension of the traffic data. Based on the...In this paper we apply the nonlinear time series analysis method to small-time scale traffic measurement data. The prediction-based method is used to determine the embedding dimension of the traffic data. Based on the reconstructed phase space, the local support vector machine prediction method is used to predict the traffic measurement data, and the BIC-based neighbouring point selection method is used to choose the number of the nearest neighbouring points for the local support vector machine regression model. The experimental results show that the local support vector machine prediction method whose neighbouring points are optimized can effectively predict the small-time scale traffic measurement data and can reproduce the statistical features of real traffic measurements.展开更多
This paper proposes a method for improving the precision of Network Traffic Prediction based on the Maximum Correntropy Criterion(NTPMCC),where the nonlinear characteristics of network traffic are considered.This meth...This paper proposes a method for improving the precision of Network Traffic Prediction based on the Maximum Correntropy Criterion(NTPMCC),where the nonlinear characteristics of network traffic are considered.This method utilizes the MCC as a new error evaluation criterion or named the cost function(CF)to train neural networks(NN).MCC is based on a new similarity function(Generalized correlation entropy function,Correntropy),which has as its foundation the Parzen window evaluation and Renyi entropy of error probability density function.At the same time,by combining the MCC with the Mean Square Error(MSE),a mixed evaluation criterion with MCC and MSE is proposed as a cost function of NN training.According to the traffic network characteristics including the nonlinear,non-Gaussian,and mutation,the Elman neural network is trained by MCC and MCC-MSE,and then the trained neural network is used as the model for predicting network traffic.The simulation results based on the evaluation by Mean Absolute Error(MAE),MSE,and Sum Squared Error(SSE)show that the accuracy of the prediction based on MCC is superior to the results of the Elman neural network with MSE.The overall performance is improved by about 0.0131.展开更多
In a given district, the accessibility of any point should be the synthetically evaluation of the internal and external accessibilities. Using MapX component and Delphi, the author presents an information system to ca...In a given district, the accessibility of any point should be the synthetically evaluation of the internal and external accessibilities. Using MapX component and Delphi, the author presents an information system to calculate and analyze regional accessibility according to the shortest travel time, generating thus a mark diffusing figure. Based on land traffic network, this paper assesses the present and the future regional accessibilities of sixteen major cities in the Yangtze River Delta. The result shows that the regional accessibility of the Yangtze River Delta presents a fan with Shanghai as its core. The top two most accessible cities are Shanghai and Jiaxing, and the bottom two ones are Taizhou （Zhejiang province） and Nantong With the construction of Sutong Bridge, Hangzhouwan Bridge and Zhoushan Bridge, the regional internal accessibility of all cities will be improved. Especially for Shaoxing, Ningbo and Taizhou （Jiangsu province）, the regional internal accessibility will be decreased by one hour, and other cities will be shortened by about 25 minutes averagely. As the construction of Yangkou Harbor in Nantong, the regional external accessibility of the harbor cities in Jiangsu province will be speeded up by about one hour.展开更多
Based on the massive data collected with a passive network monitoring equipment placed in China＇s backbone, we present a deep insight into the network backbone traffic and evaluate various ways for inproving traffic ...Based on the massive data collected with a passive network monitoring equipment placed in China＇s backbone, we present a deep insight into the network backbone traffic and evaluate various ways for inproving traffic classifying efficiency in this pa- per. In particular, the study has scrutinized the net- work traffic in terms of protocol types and signatures, flow length, and port distffoution, from which mean- ingful and interesting insights on the current Intemet of China from the perspective of both the packet and flow levels are derived. We show that the classifica- tion efficiency can be greatly irrproved by using the information of preferred ports of the network applica- tions. Quantitatively, we find two traffic duration thresholds, with which 40% of TCP flows and 70% of UDP flows can be excluded from classification pro- cessing while the in^act on classification accuracy is trivial, i.e., the classification accuracy can still reach a high level by saving 85% of the resources.展开更多
Intrusion detection system ean make effective alarm for illegality of networkusers, which is absolutely necessarily and important to build security environment of communicationbase service According to the principle t...Intrusion detection system ean make effective alarm for illegality of networkusers, which is absolutely necessarily and important to build security environment of communicationbase service According to the principle that the number of network traffic can affect the degree ofself-similar traffic, the paper investigates the variety of self-similarity resulted fromunconventional network traffic. A network traffic model based on normal behaviors of user isproposed and the Hursl parameter of this model can be calculated. By comparing the Hurst parameterof normal traffic and the self-similar parameter, we ean judge whether the network is normal or notand alarm in time.展开更多
Network traffic identification is critical for maintaining network security and further meeting various demands of network applications.However,network traffic data typically possesses high dimensionality and complexi...Network traffic identification is critical for maintaining network security and further meeting various demands of network applications.However,network traffic data typically possesses high dimensionality and complexity,leading to practical problems in traffic identification data analytics.Since the original Dung Beetle Optimizer(DBO)algorithm,Grey Wolf Optimization(GWO)algorithm,Whale Optimization Algorithm(WOA),and Particle Swarm Optimization(PSO)algorithm have the shortcomings of slow convergence and easily fall into the local optimal solution,an Improved Dung Beetle Optimizer(IDBO)algorithm is proposed for network traffic identification.Firstly,the Sobol sequence is utilized to initialize the dung beetle population,laying the foundation for finding the global optimal solution.Next,an integration of levy flight and golden sine strategy is suggested to give dung beetles a greater probability of exploring unvisited areas,escaping from the local optimal solution,and converging more effectively towards a global optimal solution.Finally,an adaptive weight factor is utilized to enhance the search capabilities of the original DBO algorithm and accelerate convergence.With the improvements above,the proposed IDBO algorithm is then applied to traffic identification data analytics and feature selection,as so to find the optimal subset for K-Nearest Neighbor(KNN)classification.The simulation experiments use the CICIDS2017 dataset to verify the effectiveness of the proposed IDBO algorithm and compare it with the original DBO,GWO,WOA,and PSO algorithms.The experimental results show that,compared with other algorithms,the accuracy and recall are improved by 1.53%and 0.88%in binary classification,and the Distributed Denial of Service(DDoS)class identification is the most effective in multi-classification,with an improvement of 5.80%and 0.33%for accuracy and recall,respectively.Therefore,the proposed IDBO algorithm is effective in increasing the efficiency of traffic identification and solving the problem of the original DBO algorithm that converges slowly and falls into the local optimal solution when dealing with high-dimensional data analytics and feature selection for network traffic identification.展开更多
Attacks on websites and network servers are among the most critical threats in network security.Network behavior identification is one of the most effective ways to identify malicious network intrusions.Analyzing abno...Attacks on websites and network servers are among the most critical threats in network security.Network behavior identification is one of the most effective ways to identify malicious network intrusions.Analyzing abnormal network traffic patterns and traffic classification based on labeled network traffic data are among the most effective approaches for network behavior identification.Traditional methods for network traffic classification utilize algorithms such as Naive Bayes,Decision Tree and XGBoost.However,network traffic classification,which is required for network behavior identification,generally suffers from the problem of low accuracy even with the recently proposed deep learning models.To improve network traffic classification accuracy thus improving network intrusion detection rate,this paper proposes a new network traffic classification model,called ArcMargin,which incorporates metric learning into a convolutional neural network(CNN)to make the CNN model more discriminative.ArcMargin maps network traffic samples from the same category more closely while samples from different categories are mapped as far apart as possible.The metric learning regularization feature is called additive angular margin loss,and it is embedded in the object function of traditional CNN models.The proposed ArcMargin model is validated with three datasets and is compared with several other related algorithms.According to a set of classification indicators,the ArcMargin model is proofed to have better performances in both network traffic classification tasks and open-set tasks.Moreover,in open-set tasks,the ArcMargin model can cluster unknown data classes that do not exist in the previous training dataset.展开更多
This paper investigates the dynamical behaviour of network traffic flow. Assume that trip rates may be influenced by the level of service on the network and travellers are willing to take a faster route. A discrete dy...This paper investigates the dynamical behaviour of network traffic flow. Assume that trip rates may be influenced by the level of service on the network and travellers are willing to take a faster route. A discrete dynamical model for the day-to-day adjustment process of route choice is presented. The model is then applied to a simple network for analysing the day-to-day behaviours of network flow. It finds that equilibrium is arrived if network flow consists of travellers not very sensitive to the differences of travel cost. Oscillations and chaos of network traffic flow are also found when travellers are sensitive to the travel cost and travel demand in a simple network.展开更多
The modeling of network traffic is important for the design and application of networks, but little is known as to the characteristics of distribution of packets in network traffic. In this letter the distribution of ...The modeling of network traffic is important for the design and application of networks, but little is known as to the characteristics of distribution of packets in network traffic. In this letter the distribution of packets in network traffic is explored.展开更多
Network traffic classification is essential in supporting network measurement and management.Many existing traffic classification approaches provide application-level results regardless of the network quality of servi...Network traffic classification is essential in supporting network measurement and management.Many existing traffic classification approaches provide application-level results regardless of the network quality of service(QoS)requirements.In practice,traffic flows from the same application may have irregular network behaviors that should be identified to various QoS classes for best network resource management.To address the issues,we propose to conduct traffic classification with two newly defined QoSaware features,i.e.,inter-APP similarity and intraAPP diversity.The inter-APP similarity represents the close QoS association between the traffic flows that originate from the different Internet applications.The intra-APP diversity describes the QoS variety of the traffic even among those originated from the same Internet application.The core of performing the QoS-aware feature extraction is a Long-Short Term Memory neural network based Autoencoder(LSTMAE).The QoS-aware features extracted by the encoder part of the LSTM-AE are then clustered into the corresponding QoS classes.Real-life data from multiple applications are collected to evaluate the proposed QoS-aware network traffic classification approach.The evaluation results demonstrate the efficacy of the extracted QoS-aware features in supporting the traffic classification,which can further contribute to future network measurement and management.展开更多
基金Princess Nourah bint Abdulrahman University Researchers Supporting Project Number (PNURSP2022R323)Princess Nourah bint Abdulrahman University,Riyadh,Saudi Arabia.
文摘Traffic prediction of wireless networks attracted many researchersand practitioners during the past decades. However, wireless traffic frequentlyexhibits strong nonlinearities and complicated patterns, which makes it challengingto be predicted accurately. Many of the existing approaches forpredicting wireless network traffic are unable to produce accurate predictionsbecause they lack the ability to describe the dynamic spatial-temporalcorrelations of wireless network traffic data. In this paper, we proposed anovel meta-heuristic optimization approach based on fitness grey wolf anddipper throated optimization algorithms for boosting the prediction accuracyof traffic volume. The proposed algorithm is employed to optimize the hyperparametersof long short-term memory (LSTM) network as an efficient timeseries modeling approach which is widely used in sequence prediction tasks.To prove the superiority of the proposed algorithm, four other optimizationalgorithms were employed to optimize LSTM, and the results were compared.The evaluation results confirmed the effectiveness of the proposed approachin predicting the traffic of wireless networks accurately. On the other hand,a statistical analysis is performed to emphasize the stability of the proposedapproach.
基金supported by the National Natural Science Foundation of China (Grant No. 60964006)the Scientific Research Innovation Fund Project for Graduate Student of Hunan,China (Grant No.3340-74236000003)the Open Program of State Key Laboratory of Rail Traffic Control and Safety (Beijing Jiaotong University),China (Grant No.2007K-0027)
文摘The flourishing complex network theory has aroused increasing interest in studying the properties of real-world networks. Based on the traffic network of Chang-Zhu Tan urban agglomeration in central China, some basic network topological characteristics were computed with data collected from local traffic maps, which showed that the traffic networks were small-world networks with strong resilience against failure; more importantly, the investigations of as- sortativity coefficient and average nearestlneighbour degree implied the disassortativity of the traffic networks. Since traffic network hierarchy as an important basic property has been neither studied intensively nor proved quantitatively, the authors are inspired to analyse traffic network hierarchy with disassortativity and to finely characterize hierarchy in the traffic networks by using the n-degree-n-clustering coefficient relationship. Through numerical results and analyses an exciting conclusion is drawn that the traffic networks exhibit a significant hierarchy, that is, the traffic networks are proved to be hierarchically organized. The result provides important information and theoretical groundwork for optimal transport planning.
基金ACKNOWLEDGEMENT This work was supported by National Natural Science Foundation of China （Grant No. 61231008）, National Basic Research Program of China （973 Program） （Grant No. 2009CB320404）, Program for Changjiang Scholars and Innovative Research Team in University （Grant No. IRT0852）, and the 111 Project （Grant No. B08038）.
文摘In the paper,we propose a framework to investigate how to effectively perform traffic flow splitting in heterogeneous wireless networks from a queue point.The average packet delay in heterogeneous wireless networks is derived in a probabilistic manner.The basic idea can be understood via treating the integrated heterogeneous wireless networks as different coupled and parallel queuing systems.The integrated network performance can approach that of one queue with maximal the multiplexing gain.For the purpose of illustrating the effectively of our proposed model,the Cellular/WLAN interworking is exploited.To minimize the average delay,a heuristic search algorithm is used to get the optimal probability of splitting traffic flow.Further,a Markov process is applied to evaluate the performance of the proposed scheme and compare with that of selecting the best network to access in terms of packet mean delay and blocking probability.Numerical results illustrate our proposed framework is effective and the flow splitting transmission can obtain more performance gain in heterogeneous wireless networks.
基金This work was funded by the National Natural Science Foundation of China under Grant60473090.
文摘The Peer-to-Peer(P2P)network traffic identification technology includes Transport Layer Identification(TLI)and Deep Packet Inspection(DPI)methods.By analyzing packets of the transport layer and the traffic characteristic in the P2P system,TLI can identify whether or not the network data flow belongs to the P2P system.The DPI method adopts protocol analysis technology and reverting technology.It picks up data from the P2P application layer and analyzes the characteristics of the payload to judge if the network traffic belongs to P2P applications.Due to its accuracy,robustness and classifying ability,DPI is the main method used to identify P2P traffic.Adopting the advantages of TLI and DPI,a precise and efficient technology for P2P network traffic identification can be designed.
基金supported by National Natural Science Foundation of China(62473341)Key Technologies R&D Program of Henan Province(242102211071,252102211086,252102210166).
文摘Network traffic classification is a crucial research area aimed at improving quality of service,simplifying network management,and enhancing network security.To address the growing complexity of cryptography,researchers have proposed various machine learning and deep learning approaches to tackle this challenge.However,existing mainstream methods face several general issues.On one hand,the widely used Transformer architecture exhibits high computational complexity,which negatively impacts its efficiency.On the other hand,traditional methods are often unreliable in traffic representation,frequently losing important byte information while retaining unnecessary biases.To address these problems,this paper introduces the Swin Transformer architecture into the domain of network traffic classification and proposes the NetST(Network Swin Transformer)model.This model improves the Swin Transformer to better accommodate the characteristics of network traffic,effectively addressing efficiency issues.Furthermore,this paper presents a traffic representation scheme designed to extract meaningful information from large volumes of traffic while minimizing bias.We integrate four datasets relevant to network traffic classification for our experiments,and the results demonstrate that NetST achieves a high accuracy rate while maintaining low memory usage.
基金supported by the Xiamen Science and Technology Subsidy Project(No.2023CXY0318).
文摘Abnormal network traffic, as a frequent security risk, requires a series of techniques to categorize and detect it. Existing network traffic anomaly detection still faces challenges: the inability to fully extract local and global features, as well as the lack of effective mechanisms to capture complex interactions between features;Additionally, when increasing the receptive field to obtain deeper feature representations, the reliance on increasing network depth leads to a significant increase in computational resource consumption, affecting the efficiency and performance of detection. Based on these issues, firstly, this paper proposes a network traffic anomaly detection model based on parallel dilated convolution and residual learning (Res-PDC). To better explore the interactive relationships between features, the traffic samples are converted into two-dimensional matrix. A module combining parallel dilated convolutions and residual learning (res-pdc) was designed to extract local and global features of traffic at different scales. By utilizing res-pdc modules with different dilation rates, we can effectively capture spatial features at different scales and explore feature dependencies spanning wider regions without increasing computational resources. Secondly, to focus and integrate the information in different feature subspaces, further enhance and extract the interactions among the features, multi-head attention is added to Res-PDC, resulting in the final model: multi-head attention enhanced parallel dilated convolution and residual learning (MHA-Res-PDC) for network traffic anomaly detection. Finally, comparisons with other machine learning and deep learning algorithms are conducted on the NSL-KDD and CIC-IDS-2018 datasets. The experimental results demonstrate that the proposed method in this paper can effectively improve the detection performance.
基金supported by the Joint Funds of the National Natural Science Foundation of China under grant No.U22B2025.
文摘In the big data era,the surge in network traffic volume poses challenges for network management and cybersecurity.Network Traffic Classification(NTC)employs deep learning to categorize traffic data,aiding security and analysis systems as Intrusion Detection Systems(IDS)and Intrusion Prevention Systems(IPS).However,current NTC methods,based on isolated network simulations,usually fail to adapt to new protocols and applications and ignore the effects of network conditions and user behavior on traffic patterns.To improve network traffic management insights,federated learning frameworks have been proposed to aggregate diverse traffic data for collaborative model training.This approach faces challenges like data integrity,label noise,packet loss,and skewed data distributions.While label noise can be mitigated through the use of sophisticated traffic labeling tools,other issues such as packet loss and skewed data distributions encountered in Network Packet Brokers(NPB)can severely impede the efficacy of federated learning algorithms.In this paper,we introduced the Robust Traffic Classifier with Federated Contrastive Learning(FC-RTC),combining federated and contrastive learning methods.Using the Supcon-Loss function from contrastive learning,FC-RTC distinguishes between similar and dissimilar samples.Training by sample pairs,FC-RTC effectively updates when receiving corrupted traffic data with packet loss or disorder.In cases of sample imbalance,contrastive loss functions for similar samples reduce model bias towards higher proportion data.By addressing uneven data distribution and packet loss,our system enhances its capability to adapt and perform accurately in real-world network traffic analysis,meeting the specific demands of this complex field.
基金supported by the National Key Research and Development Program of China No.2023YFB2705000.
文摘With the rise of encrypted traffic,traditional network analysis methods have become less effective,leading to a shift towards deep learning-based approaches.Among these,multimodal learning-based classification methods have gained attention due to their ability to leverage diverse feature sets from encrypted traffic,improving classification accuracy.However,existing research predominantly relies on late fusion techniques,which hinder the full utilization of deep features within the data.To address this limitation,we propose a novel multimodal encrypted traffic classification model that synchronizes modality fusion with multiscale feature extraction.Specifically,our approach performs real-time fusion of modalities at each stage of feature extraction,enhancing feature representation at each level and preserving inter-level correlations for more effective learning.This continuous fusion strategy improves the model’s ability to detect subtle variations in encrypted traffic,while boosting its robustness and adaptability to evolving network conditions.Experimental results on two real-world encrypted traffic datasets demonstrate that our method achieves a classification accuracy of 98.23% and 97.63%,outperforming existing multimodal learning-based methods.
基金supported by the National Natural Science Foundation of China(NSFC)under grant No.62371187the Hunan Provincial Natural Science Foundation of China under Grant Nos.2024JJ8309 and 2023JJ50495.
文摘The integration of cloud computing into traditional industrial control systems is accelerating the evolution of Industrial Cyber-Physical System(ICPS),enhancing intelligence and autonomy.However,this transition also expands the attack surface,introducing critical security vulnerabilities.To address these challenges,this article proposes a hybrid intrusion detection scheme for securing ICPSs that combines system state anomaly and network traffic anomaly detection.Specifically,an improved variation-Bayesian-based noise covariance-adaptive nonlinear Kalman filtering(IVB-NCA-NLKF)method is developed to model nonlinear system dynamics,enabling optimal state estimation in multi-sensor ICPS environments.Intrusions within the physical sensing system are identified by analyzing residual discrepancies between predicted and observed system states.Simultaneously,an adaptive network traffic anomaly detection mechanism is introduced,leveraging learned traffic patterns to detect node-and network-level anomalies through pattern matching.Extensive experiments on a simulated network control system demonstrate that the proposed framework achieves higher detection accuracy(92.14%)with a reduced false alarm rate(0.81%).Moreover,it not only detects known attacks and vulnerabilities but also uncovers stealthy attacks that induce system state deviations,providing a robust and comprehensive security solution for the safety protection of ICPS.
文摘This paper comprehensively analyzes the evolution of traffic light systems in Shanghai,highlighting the technological advancements and their impact on traffic management and safety.Starting from the historical context of the first traffic light in London in 1868 to the modern automated systems,the study explores the complexity and adaptability of traffic lights in Shanghai.Through field surveys and interviews with traffic engineers,the paper debunks common misconceptions about traffic light operation,revealing a sophisticated network that responds to real-time traffic dynamics using software like the Sydney Coordinated Adaptive Traffic System(SCATS)6.The study also discusses the importance of pedestrian safety,suggesting future enhancements such as Global Positioning System(GPS)based emergency systems and accommodations for color-blind individuals.The paper further delves into the potential of Artificial Intelligence(AI)and Vehicle-to-Infrastructure(V21)technology in revolutionizing traffic light systems,emphasizing their role in improving traffic flow and safety.The findings underscore Shanghai’s progressive approach to traffic management,showcasing the city’s commitment to optimizing traffic control solutions for the benefit of both vehicles and pedestrians.
基金Project supported by the National Natural Science Foundation of China (Grant No 60573065)the Natural Science Foundation of Shandong Province,China (Grant No Y2007G33)the Key Subject Research Foundation of Shandong Province,China(Grant No XTD0708)
文摘In this paper we apply the nonlinear time series analysis method to small-time scale traffic measurement data. The prediction-based method is used to determine the embedding dimension of the traffic data. Based on the reconstructed phase space, the local support vector machine prediction method is used to predict the traffic measurement data, and the BIC-based neighbouring point selection method is used to choose the number of the nearest neighbouring points for the local support vector machine regression model. The experimental results show that the local support vector machine prediction method whose neighbouring points are optimized can effectively predict the small-time scale traffic measurement data and can reproduce the statistical features of real traffic measurements.
基金supported in part by the National Natural Science Foundation of China under Grant No.61071126the National Radio Project under Grants No. 2010ZX03004001, No.2010ZX03004-002, No.2011ZX03002001
文摘This paper proposes a method for improving the precision of Network Traffic Prediction based on the Maximum Correntropy Criterion(NTPMCC),where the nonlinear characteristics of network traffic are considered.This method utilizes the MCC as a new error evaluation criterion or named the cost function(CF)to train neural networks(NN).MCC is based on a new similarity function(Generalized correlation entropy function,Correntropy),which has as its foundation the Parzen window evaluation and Renyi entropy of error probability density function.At the same time,by combining the MCC with the Mean Square Error(MSE),a mixed evaluation criterion with MCC and MSE is proposed as a cost function of NN training.According to the traffic network characteristics including the nonlinear,non-Gaussian,and mutation,the Elman neural network is trained by MCC and MCC-MSE,and then the trained neural network is used as the model for predicting network traffic.The simulation results based on the evaluation by Mean Absolute Error(MAE),MSE,and Sum Squared Error(SSE)show that the accuracy of the prediction based on MCC is superior to the results of the Elman neural network with MSE.The overall performance is improved by about 0.0131.
基金National Natural Science Foundation of China, No.40371044 No.70573053
文摘In a given district, the accessibility of any point should be the synthetically evaluation of the internal and external accessibilities. Using MapX component and Delphi, the author presents an information system to calculate and analyze regional accessibility according to the shortest travel time, generating thus a mark diffusing figure. Based on land traffic network, this paper assesses the present and the future regional accessibilities of sixteen major cities in the Yangtze River Delta. The result shows that the regional accessibility of the Yangtze River Delta presents a fan with Shanghai as its core. The top two most accessible cities are Shanghai and Jiaxing, and the bottom two ones are Taizhou （Zhejiang province） and Nantong With the construction of Sutong Bridge, Hangzhouwan Bridge and Zhoushan Bridge, the regional internal accessibility of all cities will be improved. Especially for Shaoxing, Ningbo and Taizhou （Jiangsu province）, the regional internal accessibility will be decreased by one hour, and other cities will be shortened by about 25 minutes averagely. As the construction of Yangkou Harbor in Nantong, the regional external accessibility of the harbor cities in Jiangsu province will be speeded up by about one hour.
基金This paper was partially supported by the National Natural Science Foundation of China under Crant No. 61072061111 Project of China under Crant No. B08004 the Fundamental Research Funds for the Central Universities under Grant No. 2009RC0122. References
文摘Based on the massive data collected with a passive network monitoring equipment placed in China＇s backbone, we present a deep insight into the network backbone traffic and evaluate various ways for inproving traffic classifying efficiency in this pa- per. In particular, the study has scrutinized the net- work traffic in terms of protocol types and signatures, flow length, and port distffoution, from which mean- ingful and interesting insights on the current Intemet of China from the perspective of both the packet and flow levels are derived. We show that the classifica- tion efficiency can be greatly irrproved by using the information of preferred ports of the network applica- tions. Quantitatively, we find two traffic duration thresholds, with which 40% of TCP flows and 70% of UDP flows can be excluded from classification pro- cessing while the in^act on classification accuracy is trivial, i.e., the classification accuracy can still reach a high level by saving 85% of the resources.
文摘Intrusion detection system ean make effective alarm for illegality of networkusers, which is absolutely necessarily and important to build security environment of communicationbase service According to the principle that the number of network traffic can affect the degree ofself-similar traffic, the paper investigates the variety of self-similarity resulted fromunconventional network traffic. A network traffic model based on normal behaviors of user isproposed and the Hursl parameter of this model can be calculated. By comparing the Hurst parameterof normal traffic and the self-similar parameter, we ean judge whether the network is normal or notand alarm in time.
基金supported by the National Natural Science Foundation of China under Grant 61602162the Hubei Provincial Science and Technology Plan Project under Grant 2023BCB041.
文摘Network traffic identification is critical for maintaining network security and further meeting various demands of network applications.However,network traffic data typically possesses high dimensionality and complexity,leading to practical problems in traffic identification data analytics.Since the original Dung Beetle Optimizer(DBO)algorithm,Grey Wolf Optimization(GWO)algorithm,Whale Optimization Algorithm(WOA),and Particle Swarm Optimization(PSO)algorithm have the shortcomings of slow convergence and easily fall into the local optimal solution,an Improved Dung Beetle Optimizer(IDBO)algorithm is proposed for network traffic identification.Firstly,the Sobol sequence is utilized to initialize the dung beetle population,laying the foundation for finding the global optimal solution.Next,an integration of levy flight and golden sine strategy is suggested to give dung beetles a greater probability of exploring unvisited areas,escaping from the local optimal solution,and converging more effectively towards a global optimal solution.Finally,an adaptive weight factor is utilized to enhance the search capabilities of the original DBO algorithm and accelerate convergence.With the improvements above,the proposed IDBO algorithm is then applied to traffic identification data analytics and feature selection,as so to find the optimal subset for K-Nearest Neighbor(KNN)classification.The simulation experiments use the CICIDS2017 dataset to verify the effectiveness of the proposed IDBO algorithm and compare it with the original DBO,GWO,WOA,and PSO algorithms.The experimental results show that,compared with other algorithms,the accuracy and recall are improved by 1.53%and 0.88%in binary classification,and the Distributed Denial of Service(DDoS)class identification is the most effective in multi-classification,with an improvement of 5.80%and 0.33%for accuracy and recall,respectively.Therefore,the proposed IDBO algorithm is effective in increasing the efficiency of traffic identification and solving the problem of the original DBO algorithm that converges slowly and falls into the local optimal solution when dealing with high-dimensional data analytics and feature selection for network traffic identification.
基金This work was supported by the National Natural Science Foundation of China(61871046).
文摘Attacks on websites and network servers are among the most critical threats in network security.Network behavior identification is one of the most effective ways to identify malicious network intrusions.Analyzing abnormal network traffic patterns and traffic classification based on labeled network traffic data are among the most effective approaches for network behavior identification.Traditional methods for network traffic classification utilize algorithms such as Naive Bayes,Decision Tree and XGBoost.However,network traffic classification,which is required for network behavior identification,generally suffers from the problem of low accuracy even with the recently proposed deep learning models.To improve network traffic classification accuracy thus improving network intrusion detection rate,this paper proposes a new network traffic classification model,called ArcMargin,which incorporates metric learning into a convolutional neural network(CNN)to make the CNN model more discriminative.ArcMargin maps network traffic samples from the same category more closely while samples from different categories are mapped as far apart as possible.The metric learning regularization feature is called additive angular margin loss,and it is embedded in the object function of traditional CNN models.The proposed ArcMargin model is validated with three datasets and is compared with several other related algorithms.According to a set of classification indicators,the ArcMargin model is proofed to have better performances in both network traffic classification tasks and open-set tasks.Moreover,in open-set tasks,the ArcMargin model can cluster unknown data classes that do not exist in the previous training dataset.
文摘This paper investigates the dynamical behaviour of network traffic flow. Assume that trip rates may be influenced by the level of service on the network and travellers are willing to take a faster route. A discrete dynamical model for the day-to-day adjustment process of route choice is presented. The model is then applied to a simple network for analysing the day-to-day behaviours of network flow. It finds that equilibrium is arrived if network flow consists of travellers not very sensitive to the differences of travel cost. Oscillations and chaos of network traffic flow are also found when travellers are sensitive to the travel cost and travel demand in a simple network.
文摘The modeling of network traffic is important for the design and application of networks, but little is known as to the characteristics of distribution of packets in network traffic. In this letter the distribution of packets in network traffic is explored.
文摘Network traffic classification is essential in supporting network measurement and management.Many existing traffic classification approaches provide application-level results regardless of the network quality of service(QoS)requirements.In practice,traffic flows from the same application may have irregular network behaviors that should be identified to various QoS classes for best network resource management.To address the issues,we propose to conduct traffic classification with two newly defined QoSaware features,i.e.,inter-APP similarity and intraAPP diversity.The inter-APP similarity represents the close QoS association between the traffic flows that originate from the different Internet applications.The intra-APP diversity describes the QoS variety of the traffic even among those originated from the same Internet application.The core of performing the QoS-aware feature extraction is a Long-Short Term Memory neural network based Autoencoder(LSTMAE).The QoS-aware features extracted by the encoder part of the LSTM-AE are then clustered into the corresponding QoS classes.Real-life data from multiple applications are collected to evaluate the proposed QoS-aware network traffic classification approach.The evaluation results demonstrate the efficacy of the extracted QoS-aware features in supporting the traffic classification,which can further contribute to future network measurement and management.
