Session Level Flow Classification by Packet Size Distribution and Session Grouping

Lu, Chun-Nan; Lin, Ying-Dar; Huang, Chun-Ying; Lai, Yuan‐Cheng

doi:10.1109/waina.2012.145

Cited by 6 publications

(6 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The main method for classification is Hidden Markov Modeling to profile network behavior . To detect in the application level, session classification method is performed too . The combination of these two methods leads to strong results that cover both in application level behavior and protocols.…”

Section: Evaluation and Experimental Resultsmentioning

confidence: 99%

“…Most of the network analysis techniques are based on the three vital origins: direction, time, and packet size. Some techniques like the Hidden Markov Model and session classification use time and size features to analyze the Internet traffic, but some other techniques work according to the direction of the data flow or mixed information of the direction and size or time .…”

Section: Preliminaries and Backgroundmentioning

confidence: 99%

“…The same result could reveal true types of transmission protocols . By using the session classification method, they have reached higher than 99% accuracy in flow classifications . The creative solution for these types of attacks is changing rules of the game.…”

Section: Preliminaries and Backgroundmentioning

confidence: 99%

See 2 more Smart Citations

Privacy enhancement in anonymous network channels using multimodality injection

Nia

Atani

Ruiz‐Martínez³

2015

Security Comm Networks

View full text Add to dashboard Cite

The increase of the capacity of processing units and the growth of distributed computing make easy to collect and process information of Internet traffic flows. This information, however, can be used to perform attacks in anonymous communications that could compromise privacy. With the aim of preventing these attacks, we propose a scheme that implements a multimodal behavior using the random walk theory and crypto-types. The random walk mechanism is responsible for generating network patterns, and the cryptotype performs the micro-encryption tasks using series of quantum-resistant cryptography methods through the anonymous channel. The result shows that using this technique, we can prevent network analysis attacks by means of the generation of a different pattern in each execution for the same set of data. Namely, the experiments we have developed indicate that the average rate of true detections of application behaviors made by intruders does not exceed 24%. Thus, this multimodal pattern gives a high level of immunity against data analysis attacks because the intruders could consider the generated patterns as the typical patterns.

show abstract

Section: Evaluation and Experimental Resultsmentioning

confidence: 99%

Section: Preliminaries and Backgroundmentioning

confidence: 99%

See 1 more Smart Citation

Privacy enhancement in anonymous network channels using multimodality injection

Nia

Atani

Ruiz‐Martínez³

2015

Security Comm Networks

View full text Add to dashboard Cite

show abstract

“…Intelligent flow processing is an advanced method in Refs. [29][30][31] for intrusion detection. Intelligent flow processing in vCNSMS is based on the smart packet verdict scheme.…”

Section: Intelligent Flow Processing In Vcnsmsmentioning

confidence: 99%

Collaborative network security in multi-tenant data center for cloud computing

Chen

Dong

et al. 2014

Tinshhua Sci. Technol.

View full text Add to dashboard Cite

A data center is an infrastructure that supports Internet service. Cloud computing is rapidly changing the face of the Internet service infrastructure, enabling even small organizations to quickly build Web and mobile applications for millions of users by taking advantage of the scale and flexibility of shared physical infrastructures provided by cloud computing. In this scenario, multiple tenants save their data and applications in shared data centers, blurring the network boundaries between each tenant in the cloud. In addition, different tenants have different security requirements, while different security policies are necessary for different tenants. Network virtualization is used to meet a diverse set of tenant-specific requirements with the underlying physical network, enabling multi-tenant datacenters to automatically address a large and diverse set of tenants requirements. In this paper, we propose the system implementation of vCNSMS, a collaborative network security prototype system used in a multi-tenant data center. We demonstrate vCNSMS with a centralized collaborative scheme and deep packet inspection with an open source UTM system. A security level based protection policy is proposed for simplifying the security rule management for vCNSMS. Different security levels have different packet inspection schemes and are enforced with different security plugins. A smart packet verdict scheme is also integrated into vCNSMS for intelligence flow processing to protect from possible network attacks inside a data center network.

show abstract

“…Identification and classification of network applications using data mining and pattern recognition methods [5]- [7] confirm that computer networks, including the Internet, use a wide range of packet-based applications. Traditionally, applications are identified by inspection of the destination port number in packet header.…”

Section: Introductionmentioning

confidence: 98%

Packet size distribution tendencies in computer network flows

Garsva

Paulauskas

Grazulevicius

2015

2015 Open Conference of Electrical, Electronic and Information Sciences (eStream)

View full text Add to dashboard Cite

Network flows are easy to get and simple to store network activity data. The challenge is to interpret them efficiently from security and network engineering standpoint as payload and application layer protocol specific information is missing. The article presents the statistical analysis of network flows with the emphasis on packet size distribution. Existing packet size distribution researches were reviewed. Packet size distribution Cumulative Distribution Functions (CDFs) were produced from existing academic computer network data. The CDFs for protocols TCP, UDP, ICMP and popular application layer protocols (HTTP, DNS) were analysed. Network traffic statistics were further visualized using radar graph. Article provides reusable statistical analysis steps and statistical trends for academic computer network.

show abstract

Session Level Flow Classification by Packet Size Distribution and Session Grouping

Cited by 6 publications

References 19 publications

Privacy enhancement in anonymous network channels using multimodality injection

Privacy enhancement in anonymous network channels using multimodality injection

Collaborative network security in multi-tenant data center for cloud computing

Packet size distribution tendencies in computer network flows

Contact Info

Product

Resources

About