UDP traffic classification using most distinguished port

Zhang, Qianli; Ma, Yunlong; Wang, Jilong; Li, Xing

doi:10.1109/apnoms.2014.6996569

Cited by 8 publications

(4 citation statements)

References 14 publications

(11 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Likewise, to generate TCP traffic, we use file transfer protocol applications transported through TCP Reno. In all scenarios, UDP constitutes almost 12% of the overall traffic to reflect the practical ratio prevalent on the Internet [13,22,[31][32][33][34]. For the considered network topology, the default ns-2 maximum window size of 20 segments may limit the TCP transmission rate by imposing a cap on TCP throughput over the shared link.…”

Section: Performance Evaluationmentioning

confidence: 99%

ARCH: A dual‐mode fairness‐driven AQM for promoting cooperative behaviour in best effort Internet

et al. 2019

View full text Add to dashboard Cite

The cooperative behaviour of end-systems in efficiently and fairly utilizing the scarce bandwidth is of paramount significance in the best effort Internet. Not only does the uncooperative behaviour result in unfairness, but it may also induce congestion collapse. How to urge end-systems to share the bandwidth cooperatively is a problem that depends, in essence, on incentives. This study presents a novel fairness-driven active queue management (AQM)-based incentive scheme to detect and take punitive action against any uncooperative behaviour. Different from all other fairness-driven AQM schemes, the proposed scheme offers a dual-mode control function that can adaptively switch between stateless and partial-state modes in order to be scalable. The control function remains stateless at low to moderate congestion levels and maintains a partial-state when congestion becomes severe. In the stateless mode, the identification and restriction of unresponsive flows are based on a matched-drop mechanism having a dynamic drawing factor to differentially drop packets from unresponsive flows. In the partialstate mode, a fair-share is estimated and flows whose arrival rates exceed the fair-share bandwidth get their rates limited to the fair rate. Simulation results demonstrate the reasonable performance improvement of the proposed scheme over well-known fairness-driven AQM schemes.

show abstract

Section: Performance Evaluationmentioning

confidence: 99%

ARCH: A dual‐mode fairness‐driven AQM for promoting cooperative behaviour in best effort Internet

et al. 2019

View full text Add to dashboard Cite

show abstract

“…[3]Lotfollahi, M.added dropout to prevent over fitting and softmax to classify the last layer on the basis of CNN and 5-layer SAE. From Kampeas, J [4]proposed a new set of traffic classification functions for SDN [5] and NFV [6]environments. Very high classification accuracy is achieved by capturing the required data through a single filtering rule and taking only the least feature-dependent part.…”

Section: Introductionmentioning

confidence: 99%

RP-Bert: An approach to detect and classify network intrusions based on a combination of Transfer learning and rules

Sun

Zhang

2023

J. Phys.: Conf. Ser.

View full text Add to dashboard Cite

We investigate the model generalization problem that exists for network traffic intrusion detection. Existing works have begun to apply some advanced algorithms and models from NLP domain to network security domain, but have some challenges. One of the biggest problem is that the amount of data for some existing network intrusions is not sufficient to train the current oversized models. For this purpose, we improve on ET-Bert and propose a method to detect and classify network intrusion based on the combination of migration learning and rules (RP-Bert). And we test and validate it on a large open source dataset BoT-loT, which Recall is achieved, Precision is achieved, F1 Score is achieved, Accuracy is achieved.

show abstract

“…Traditional traffic classification methods are mainly port-based, payload-based, or statistic-based [1,2]. The port-based and payload-based methods are unable to detect encrypted malicious traffic [3].…”

Section: Introductionmentioning

confidence: 99%

Deep-Forest-Based Encrypted Malicious Traffic Detection

et al. 2022

View full text Add to dashboard Cite

The SSL/TLS protocol is widely used in data encryption transmission. Aiming at the problem of detecting SSL/TLS-encrypted malicious traffic with small-scale and unbalanced training data, a deep-forest-based detection method called DF-IDS is proposed in this paper. According to the characteristics of SSL/TSL protocol, the network traffic was split into sessions according to the 5-tuple information. Each session was then transformed into a two-dimensional traffic image as the input of a deep-learning classifier. In order to avoid information loss and improve the detection efficiency, the multi-grained cascade forest (gcForest) framework was simplified with only cascade structure, which was named cascade forest (CaForest). By integrating random forest and extra trees in the CaForest framework, an end-to-end high-precision detector for small-scale and unbalanced SSL/TSL encrypted malicious traffic was realized. Compared with other deep-learning-based methods, the experimental results showed that the detection rate of DF-IDS was 6.87% to 29.5% higher than that of other methods on a small-scale and unbalanced dataset. The advantage of DF-IDS was more obvious in the multi-classification case.

show abstract

UDP traffic classification using most distinguished port

Cited by 8 publications

References 14 publications

ARCH: A dual‐mode fairness‐driven AQM for promoting cooperative behaviour in best effort Internet

ARCH: A dual‐mode fairness‐driven AQM for promoting cooperative behaviour in best effort Internet

RP-Bert: An approach to detect and classify network intrusions based on a combination of Transfer learning and rules

Deep-Forest-Based Encrypted Malicious Traffic Detection

Contact Info

Product

Resources

About