Classification of Encrypted Traffic With Second-Order Markov Chains and Application Attribute Bigrams

Shen, Meng; Wei, Mingwei; Zhu, Liehuang; Wang, Mingzhong

doi:10.1109/tifs.2017.2692682

Cited by 148 publications

(45 citation statements)

References 25 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Since the arrival time of the traffic packets in each flow is different and the values of the fields such as TTL are also different. Different from the methods of dealing with temporal feature like Feghhi and Leith [30] and Shen et al [31], this paper uses the LSTM network to perform automatic temporal feature extraction on the original flow data. In this paper, the LSTM network uses two layers of cells for temporal feature extraction.…”

Section: Lstm Modelmentioning

confidence: 99%

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

et al. 2019

View full text Add to dashboard Cite

Network intrusion detection plays a very important role in protecting computer network security. The abnormal traffic detection and analysis by extracting the statistical features of flow is the main analysis method in the field of network intrusion detection. However, these features need to be designed and extracted manually, which often loses the original information of the flow and leads to poor detection efficiency. In this paper, we do not manually design the features of the flow but directly extract the raw data information of the flow for analysis. In addition, we first proposed a new network intrusion detection model named the deep hierarchical network, which integrates the improved LeNet-5 and LSTM neural network structures, while learning the spatial and temporal features of flow. By designing a reasonable network cascading method, we can train our proposed hierarchical network at the same time instead of training two networks separately. In this paper, we use the CICIDS2017 dataset and the CTU dataset. The number and types of flow in these two datasets are large, and the attack types are relatively new. The experimental results show that the performance of the proposed hierarchical network model is significantly better than other network intrusion detection models, which can achieve the best detection accuracy. Finally, we also present an analysis method for traffic features which has an important contribution to abnormal traffic detection and gives the actual meanings of these important features. INDEX TERMS Network intrusion detection, deep hierarchical network, raw feature, feature importance.

show abstract

Section: Lstm Modelmentioning

confidence: 99%

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

et al. 2019

View full text Add to dashboard Cite

show abstract

“…Compared to the traditional machine learning research [17], current researches on encrypted traffic classification using machine learning approach produced various type of output that could be further analysed and refined. Study by [39], [40], [42], [43] managed to perform encrypted traffic classification that identify traffic with fine granularity output of information.…”

Section: Discussion and Comparisonmentioning

confidence: 99%

“…Another supervised research for encrypted traffic from [40] has proposed an attribute-aware classification that utilized second-order Markov Chain algorithm. Second-order Markov Chains is required in order to determine state transition probabilities.…”

Section: B Traffic Classification On Non-tor Networkmentioning

confidence: 99%

A Survey on Tor Encrypted Traffic Monitoring

Aminuddin¹,

Zaaba²,

Singh³

et al. 2018

ijacsa

View full text Add to dashboard Cite

Tor (The Onion Router) is an anonymity tool that is widely used worldwide. Tor protect its user privacy against surveillance and censorship using strong encryption and obfuscation techniques which makes it extremely difficult to monitor and identify users' activity on the Tor network. It also implements strong defense to protect the users against traffic features extraction and website fingerprinting. However, the strong anonymity also became the heaven for criminal to avoid network tracing. Therefore, numerous of research has been performed on encrypted traffic analyzing and classification using machine learning techniques. This paper presents survey on existing approaches for classification of Tor and other encrypted traffic. There is preliminary discussion on machine learning approaches and Tor network. Next, there are comparison of the surveyed traffic classification and discussion on their classification properties.

show abstract

“…Terminals, such as Raspberry Pi, mobile phones, and Google Glass, are small end devices that have limited computation, storage, and energy resources . Recently, applications running on terminals, such as object detection, indoor localization, and encrypting, are increasingly data‐intensive and latency‐critical. For example, Google Glass needs to classify the objects in pictures it takes, and augmented reality games need indoor localization information to render real‐life environments on mobile phones.…”

Section: Introductionmentioning

confidence: 99%

Cooperative storage by exploiting graph‐based data placement algorithm for edge computing environment

Jin

Luo

2018

Concurrency and Computation

View full text Add to dashboard Cite

Edge computing is a new computing paradigm that performs data processing at the edge of the network (ie, edge servers) to lower data processing latency. Prior research significantly focused on offloading tasks from terminals to edge servers, yet most ignored how to store task's necessary data (such as databases and pretrained machine-learning models) on edge servers. Today, as data-intensive tasks such as deep learning and augmented reality become common, large data storage and powerful computation resources are needed. This is a cumbersome challenge, because many lightweight edge servers have limited resources. If an edge server does not have a task's necessary data, then it needs to offload the task to cloud datacenters or download the necessary data from the cloud. Either case could increase data processing latency. To address this problem, this paper proposes an edge-side collaborative storage framework called Edge-side Cooperative Storage (ECS). In ECS, edge servers collaboratively store and process data-intensive tasks's necessary data. Here, we particularly focus on how to effectively place data on ECS, using an approach that differs from existing works (that model data placement problems as linear/integer programming problems). Our work models cooperative storage as a graph and solves the data placement problem by using a graph-based iterative algorithm. This algorithm easily extends to a distributed version, so distributed ECSworks efficiently without a centralized scheduler. We also evaluate ECS's effectiveness and convergence through simulations. Simulation results show that ECSis 2× better than a traditional nonshared storage framework in terms of the cache hit rate. KEYWORDScooperative storage, data placement, edge computing INTRODUCTIONEdge computing 1,2 is a new computing paradigm that performs data processing at the network's edge (ie, edge servers). In an edge computing system, terminals with limited computation and storage resources can offload tasks to edge servers to improve terminals' performance. As Figure 1 shows, a typical edge computing system consists of three layers, ie, the terminal layer, edge server layer, and cloud datacenter layer. Terminals, such as Raspberry Pi, mobile phones, and Google Glass, are small end devices that have limited computation, storage, and energy resources. 3 Recently, applications running on terminals, such as object detection, 4 indoor localization, 5,6 and encrypting, 7,8 are increasingly data-intensive and latency-critical.For example, Google Glass needs to classify the objects in pictures it takes, and augmented reality games need indoor localization information to render real-life environments on mobile phones. Because the terminals' computation and storage resources cannot satisfy these applications' requirements, often, computation tasks are offloaded to nearby edge servers. Edge servers are small computing facilities, such as smart network routers, base stations, and small datacenters, which are located near terminal devices. Edge servers connect via ...

show abstract

Classification of Encrypted Traffic With Second-Order Markov Chains and Application Attribute Bigrams

Cited by 148 publications

References 25 publications

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

Network Intrusion Detection: Based on Deep Hierarchical Network and Original Flow Data

A Survey on Tor Encrypted Traffic Monitoring

Cooperative storage by exploiting graph‐based data placement algorithm for edge computing environment

Contact Info

Product

Resources

About