While Internet traffic is currently dominated by elastic data transfers, it is anticipated that streaming applications will rapidly develop and contribute a significant amount of traffic in the near future. Therefore,...While Internet traffic is currently dominated by elastic data transfers, it is anticipated that streaming applications will rapidly develop and contribute a significant amount of traffic in the near future. Therefore, it is essential to understand and capture the relation between streaming and elastic traffic behavior. In this paper, we focus on developing simple yet effective approximations to capture this relationship. We study, then, an analytical model to evaluate the end-to-end performance of elastic traffic under multi-queuing system. This model is based on the fluid flow approximation. We assume that network architecture gives the head of priority to real time traffic and shares the remaining capacity between the elastic ongoing flows according to a specific weight.展开更多
In order to develop optimal multi-regime traffic stream models, a new method that integrates cluster analysis and B-spline regression is presented. First, for identifying the proper number of regimes, the K-means and ...In order to develop optimal multi-regime traffic stream models, a new method that integrates cluster analysis and B-spline regression is presented. First, for identifying the proper number of regimes, the K-means and the fuzzy c-means methods are applied in cluster analysis to actual traffic data, which suggests that dividing the traffic flow into two or three clusters can best reflect intrinsic patterns of traffic flows. Such information is then taken as guidance in spline regression, thus significantly reducing the computational burden of estimating spline models. Spline regression is used to estimate the locations of knots and the coefficients of the model so that the global error can be minimized. Model analysis results demonstrate that the proposed spline models have better fitting and generalization capability than the conventional models. In addition, the new method is more flexible in terms of data fitting and can provide smoother traffic stream models.展开更多
With the rapid increase of link speed and network throughput in recent years,much more attention has been paid to the work of obtaining statistics over speed traffic streams.It is a challenging problem to identify hea...With the rapid increase of link speed and network throughput in recent years,much more attention has been paid to the work of obtaining statistics over speed traffic streams.It is a challenging problem to identify heavy hitters in high-speed and dynamically changing data streams with less memory and computational overhead with high measurement accuracy.In this paper,we combine Bloom Filter with exponential histogram to query streams in the sliding window so as to identify heavy hitters.This method is called EBF sketches.Our sketch structure allows for effective summarization of streams over time-based sliding windows with guaranteed probabilistic accuracy.It can be employed to address problems such as maintaining frequency statistics and finding heavy hitters.Our experimental results validate our theoretical claims and verifies the effectiveness of our techniques.展开更多
A kind of packet labeling algorithm for autonomous system is introduced. The fairness of the algorithm for each traffic stream in the integrated-services is analyzed. It is shown that the rate of each stream in the in...A kind of packet labeling algorithm for autonomous system is introduced. The fairness of the algorithm for each traffic stream in the integrated-services is analyzed. It is shown that the rate of each stream in the integrated-services would converge to a stable value if the transmittfing or forwarding rates converge to that of the receiving exponentially.展开更多
Active anomaly detection queries labels of sampled instances and uses them to incrementally update the detection model,and has been widely adopted in detecting network attacks.However,existing methods cannot achieve d...Active anomaly detection queries labels of sampled instances and uses them to incrementally update the detection model,and has been widely adopted in detecting network attacks.However,existing methods cannot achieve desirable performance on dynamic network traffic streams because(1)their query strategies cannot sample informative instances to make the detection model adapt to the evolving stream and(2)their model updating relies on limited query instances only and fails to leverage the enormous unlabeled instances on streams.To address these issues,we propose an active tree based model,adaptive and augmented active prior-knowledge forest(A3PF),for anomaly detection on network trafic streams.A prior-knowledge forest is constructed using prior knowledge of network attacks to find feature subspaces that better distinguish network anomalies from normal traffic.On one hand,to make the model adapt to the evolving stream,a novel adaptive query strategy is designed to sample informative instances from two aspects:the changes in dynamic data distribution and the uncertainty of anomalies.On the other hand,based on the similarity of instances in the neighborhood,we devise an augmented update method to generate pseudo labels for the unlabeled neighbors of query instances,which enables usage of the enormous unlabeled instances during model updating.Extensive experiments on two benchmarks,CIC-IDS2017 and UNSW-NB15,demonstrate that A3PF achieves significant improvements over previous active methods in terms of the area under the receiver operating characteristic curve(AUC-ROC)(20.9%and 21.5%)and the area under the precision-recall curve(AUC-PR)(44.6%and 64.1%).展开更多
文摘While Internet traffic is currently dominated by elastic data transfers, it is anticipated that streaming applications will rapidly develop and contribute a significant amount of traffic in the near future. Therefore, it is essential to understand and capture the relation between streaming and elastic traffic behavior. In this paper, we focus on developing simple yet effective approximations to capture this relationship. We study, then, an analytical model to evaluate the end-to-end performance of elastic traffic under multi-queuing system. This model is based on the fluid flow approximation. We assume that network architecture gives the head of priority to real time traffic and shares the remaining capacity between the elastic ongoing flows according to a specific weight.
基金The US National Science Foundation (No.BCS-0527508)
文摘In order to develop optimal multi-regime traffic stream models, a new method that integrates cluster analysis and B-spline regression is presented. First, for identifying the proper number of regimes, the K-means and the fuzzy c-means methods are applied in cluster analysis to actual traffic data, which suggests that dividing the traffic flow into two or three clusters can best reflect intrinsic patterns of traffic flows. Such information is then taken as guidance in spline regression, thus significantly reducing the computational burden of estimating spline models. Spline regression is used to estimate the locations of knots and the coefficients of the model so that the global error can be minimized. Model analysis results demonstrate that the proposed spline models have better fitting and generalization capability than the conventional models. In addition, the new method is more flexible in terms of data fitting and can provide smoother traffic stream models.
基金This study is supported by National key research and development program(2016YFB0801200).
文摘With the rapid increase of link speed and network throughput in recent years,much more attention has been paid to the work of obtaining statistics over speed traffic streams.It is a challenging problem to identify heavy hitters in high-speed and dynamically changing data streams with less memory and computational overhead with high measurement accuracy.In this paper,we combine Bloom Filter with exponential histogram to query streams in the sliding window so as to identify heavy hitters.This method is called EBF sketches.Our sketch structure allows for effective summarization of streams over time-based sliding windows with guaranteed probabilistic accuracy.It can be employed to address problems such as maintaining frequency statistics and finding heavy hitters.Our experimental results validate our theoretical claims and verifies the effectiveness of our techniques.
文摘A kind of packet labeling algorithm for autonomous system is introduced. The fairness of the algorithm for each traffic stream in the integrated-services is analyzed. It is shown that the rate of each stream in the integrated-services would converge to a stable value if the transmittfing or forwarding rates converge to that of the receiving exponentially.
基金Project supported by the National Science and Technology Major Project(No.2022ZD0115302)the National Natural Science Foundation of China(No.61379052)+1 种基金the Science Foundation of Ministry of Education of China(No.2018A02002)the Natural Science Foundation for Distinguished Young Scholars of Hunan Province,China(No.14JJ1026)。
文摘Active anomaly detection queries labels of sampled instances and uses them to incrementally update the detection model,and has been widely adopted in detecting network attacks.However,existing methods cannot achieve desirable performance on dynamic network traffic streams because(1)their query strategies cannot sample informative instances to make the detection model adapt to the evolving stream and(2)their model updating relies on limited query instances only and fails to leverage the enormous unlabeled instances on streams.To address these issues,we propose an active tree based model,adaptive and augmented active prior-knowledge forest(A3PF),for anomaly detection on network trafic streams.A prior-knowledge forest is constructed using prior knowledge of network attacks to find feature subspaces that better distinguish network anomalies from normal traffic.On one hand,to make the model adapt to the evolving stream,a novel adaptive query strategy is designed to sample informative instances from two aspects:the changes in dynamic data distribution and the uncertainty of anomalies.On the other hand,based on the similarity of instances in the neighborhood,we devise an augmented update method to generate pseudo labels for the unlabeled neighbors of query instances,which enables usage of the enormous unlabeled instances during model updating.Extensive experiments on two benchmarks,CIC-IDS2017 and UNSW-NB15,demonstrate that A3PF achieves significant improvements over previous active methods in terms of the area under the receiver operating characteristic curve(AUC-ROC)(20.9%and 21.5%)and the area under the precision-recall curve(AUC-PR)(44.6%and 64.1%).
