Classification of Delay-based TCP Algorithms From Passive Traffic Measurements

Hagos, Desta Haileselassie; Engelstad, Paal E.; Yazidi, Anis

doi:10.1109/nca.2019.8935063

Cited by 5 publications

(3 citation statements)

References 23 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The back-off parameter along with other TCP characteristics can be used to predict the underlying TCP congestion control algorithms. In our previous work [16], we have developed an efficient tool for the prediction of the underlying delay-based TCP flavors from passive measurements by utilizing the β and queueing delay values. By using different data-driven classification techniques based on probabilistic models and Bayesian inference approaches, we addressed how the β varies as a function of queueing delay changes and investigated into how the TCP variants of delay-based congestion control algorithms can be predicted both from passively measured traffic and real measurements over the Internet [16].…”

Section: B Comparison Of Results With a Predicted Tcp Variantmentioning

confidence: 99%

“…In this section we will extend the passive OS fingerprinting method presented above by coupling to our previous work [16] to also cover delay-based TCP variants, e.g., TCP Vegas [4], TCP Veno [12], BBR [5], etc. The performance results with emulated data and a passive prediction of the delay-based TCP flavors as shown in Table XII gives an accuracy of 95.24% and 95.38% on average using both classical machine learning and deep learning techniques respectively.…”

Section: B Comparison Of Results With a Predicted Tcp Variantmentioning

confidence: 99%

See 1 more Smart Citation

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

Hagos

Yazidi

Kure

et al. 2021

IEEE Internet Things J.

Self Cite

View full text Add to dashboard Cite

With the emergence of Internet of Things (IoT), securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real-time. An accurate passive Operating System (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting doesn't send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This paper proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This paper takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.3% and 95.22% on average using a tool for loss-based and a combination of loss and delay-based TCP variant prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

show abstract

Section: B Comparison Of Results With a Predicted Tcp Variantmentioning

confidence: 99%

Section: B Comparison Of Results With a Predicted Tcp Variantmentioning

confidence: 99%

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

Hagos

Yazidi

Kure

et al. 2021

IEEE Internet Things J.

Self Cite

View full text Add to dashboard Cite

show abstract

“…A passive approach by Hagos et al [8] analyzed the multiplicative back off factor (β) to decrease cwnd. This approach observes how β varies as a function of queuing delay.…”

Section: Related Workmentioning

confidence: 99%

A CNN-LSTM Approach for Classification of Major TCP Congestion Control Algorithms

Nithya

Venkataraman

Balaaji

et al. 2021

Lecture Notes in Networks and Systems

View full text Add to dashboard Cite

Transmission Control Protocol is widely popular with varied applications in internet like World Wide Web, email, remote administration and file transfer protocols. Over the years, numerous congestion control algorithms for TCP have been proposed each with its own characteristics. The automatic identification of individual algorithm is important for traffic engineering in the Internet. This paper aims to classify three major congestion control algorithms: TCP New Reno, TCP High Speed and TCP Veno. The proposed approach passively collects packet trace files with data and ACK segments from an NS3 simulator and then calculates a time sequence split of the congestion window. The collected data are normalized and fed separately to machine learning approaches: CNN, LSTM, hybrid CNN-LSTM and a ConvLSTM. The performance of each of these approaches is analyzed in terms of accuracy, precision, recall and F1 score. From the results, it is inferred that the hybrid CNN-LSTM model gives highest accuracy in classifying TCP congestion control algorithms.

show abstract

Advanced Passive Operating System Fingerprinting Using Machine Learning and Deep Learning

Hagos

Løland

Yazidi

et al. 2020

2020 29th International Conference on Computer Communications and Networks (ICCCN)

Self Cite

View full text Add to dashboard Cite

without whom my Ph.D. life in Oslo would not have been so much fun. I am deeply grateful for all the fun, jokes and sometimes serious academic conversations over our lunch and dinner times. You all have been the source of my laughter and positive energy ever since we became colleagues. I have had so much fun along the way and my sincere thanks to you all buddies. There are still other very good friends, families, and colleagues, too many to list here, who I have had the opportunity to discuss ideas about my Ph.D. research work over the years to which I owe a great debt of heartfelt gratitude.Last but not least, I would like to thank the two most important people in my life to whom this dissertation is dedicated: my brilliant and hard-working mother Amlisha Mehari Tesfeu; and my best friend Amha Tesfay Desta. Dear mom, your boundless support, unconditional love, courage, strength, resilience, constant source of encouragement in everything I do and your pro-education mentality is what has brought me this far, and I will forever be unbelievably grateful to you. For as long as I can remember, you have always believed in me and wholeheartedly encouraged and supported me to run after whatever it is that I passionately dream of pursuing in life. None of what I have achieved and all the miles I have traveled so far in my life would have been possible without you, mom. I owe everything I have ever achieved in my entire life to you, mom, and thank you for being my lifetime hero and my best friend.Amish, you are one of the most thoughtful, loyal, dignified, compassionate and generous souls with a golden heart I have ever come in my life and it makes me extremely happy to proudly call you a dear brother and absolutely my best friend for life. Your positive attitude, profound knowledge, and understanding about a simple and ethical life, your true brotherhood and friendship have deeply influenced my life to which I am extraordinarily grateful. Most importantly, Amishey, you are one of the very few people who never gave up on me, no matter what and the best lifelong friend who has always been by my side through good and bad times. Of all your encouraging SMS messages I have received during this journey of my Ph.D. career, "The more I see you being strong and organized, I thank God! Always be on the right page of life and be grateful to God for everything you have.", stood out for me. In every step of my journey, I will try my level best to remain as strong and organized as possible and make you and my mom proud. Amishey, both you and my mother are constant reminders in my life of what it means to live with integrity and professionalism every day and this is something I will never ever forget as long as I live. Thank you!

show abstract

Classification of Delay-based TCP Algorithms From Passive Traffic Measurements

Cited by 5 publications

References 23 publications

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

A CNN-LSTM Approach for Classification of Major TCP Congestion Control Algorithms

Advanced Passive Operating System Fingerprinting Using Machine Learning and Deep Learning

Contact Info

Product

Resources

About