An Interactive Traffic Replay Method in a Scaled-Down Environment

Abstract

Network traffic replay plays an essential role in network security tests. However, performing traffic replay in a network is still a challenge due to the different scales of the live network and the replay network. In this study, we investigate three problems of the interactive traffic replay under a scaled-down replay environment and then propose a multi-node traffic replay method. In this method, a self-elected IP mapping algorithm is designed to construct the IP mapping between the target network and the live network, which reproduce the interaction between the nodes of the live network. We prove that the traffic aggregation problem is an NP-complete problem and design a divide and conquer algorithm to approximate an optimal solution. On this basis, a traffic replay algorithm based on minimum-delay forwarding mechanism is proposed to perform low-delay interactive traffic replay. The experimental results show that the method mentioned above enables us to better aggregate elephant flows and achieve high similarity in replay timing series and bandwidth, which can be employed to reproduce a real network scenario in network device tests and network security experiments.

ClusterRR: a record and replay framework for virtual machine cluster

“…Record and Replay (RnR) systems have been researched and applied in many fields. They can be classified into following categories: application level [11,12,24], OS kernel level [3,35], network traffic level [20,21,23] and VM level [25ś29].…”

Introducing the CYSAS-S3 Dataset for Operationalizing a Mission-Oriented Cyber Situational Awareness

“…Another example is TCPivo [ 40 ], a high-speed packet replay engine implemented on commodity hardware. Replays are particularly useful in generating backbone traffic due to the complexity of their artificial generation [ 41 ]. They entail the category of most realistic general-purpose generators but with difficulties for adaptation to particular contexts on delivering the entropy required for particular applications of the simulation/emulation.…”

Method for providing background traffic using IP random assigning in cyber range

“…A cyber range is an environment where individuals can practice cyber defence skills and validate various security tools [1]. Background traffic is an essential element in the cyber range and provides a realistic network scenario [2]. In addition, the use of background traffic has the effect of confusing cyber defence trainees to misidentify benign background traffic as malicious traffic [3].…”