Efficient Methods for Early Protocol Identification

Hullár, Béla; Laki, Sándor; György, András

doi:10.1109/jsac.2014.2358832

Cited by 10 publications

(6 citation statements)

References 17 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The traffic volume can be enormous in a high-speed network; thus, it is important to reduce a load of packet capturing and analysis on the detection function for high efficiency. According to the heavy-tailed nature of Internet traffic [26], it was reported that keeping only a small portion of each flow is sufficient for protocol identification or retrospective analysis while reducing the total traffic volume significantly [27], [28]. Therefore, we consider sampling the flows by extracting the first n packets of each, and each packet is trimmed into a fixed length of l bytes, starting with the header fields (with zero-padding if necessary; see the next subsection for the detail).…”

Section: A Sampling Network Flowsmentioning

confidence: 99%

See 1 more Smart Citation

An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

Various attacks have emerged as the major threats to the success of a connected world like the Internet of Things (IoT), in which billions of devices interact with each other to facilitate human life. By exploiting the vulnerabilities of cheap and insecure devices such as IP cameras, an attacker can create hundreds of thousands of zombie devices and then launch massive volume attacks to take down any target. For example, in 2016, a record large-scale DDoS attack launched by millions of Mirai-injected IP cameras and smart printers blocked the accessibility of several high-profile websites. To date, the state-of-the-art defense systems against such attacks rely mostly on pre-defined features extracted from the entire flows or signatures. The feature definitions are manual, and it would be too late to block a malicious flow after extracting the flow features. In this work, we present an effective anomaly traffic detection mechanism, namely D-PACK, which consists of a Convolutional Neural Network (CNN) and an unsupervised deep learning model (e.g., Autoencoder) for auto-profiling the traffic patterns and filtering abnormal traffic. Notably, D-PACK inspects only the first few bytes of the first few packets in each flow for early detection. Our experimental results show that, by examining just the first two packets in each flow, D-PACK still performs with nearly 100% accuracy, while features an extremely low false-positive rate, e.g., 0.83%. The design can inspire the emerging efforts towards online anomaly detection systems that feature reducing the volume of processed packets and blocking malicious flows in time.

show abstract

Section: A Sampling Network Flowsmentioning

confidence: 99%

“…1, a flow consists of ten packets, and we inspect only the first three packets and trim their lengths. Since only several packets per flow are examined, the system can inspect significantly fewer data in total, like the results from in [27], [28]. This saving is even much more if the flow is part of a long session.…”

Section: A Sampling Network Flowsmentioning

confidence: 99%

An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection

et al. 2020

View full text Add to dashboard Cite

show abstract

“…tanh(x) = e x − e −x e x + e −x (9) We assume that the input of LSTM at time moment t includes input layer x t , hidden layer h t−1 which is calculated by the previous unit and memory cell c t−1 . The output of LSTM at time moment t includes hidden layer h t which is calculated by the current unit and memory cell c t .…”

Section: B Lstmmentioning

confidence: 99%

“…The existing protocol classification method mainly includes method based on port number, method based on deep packet inspection, and method based on deep stream inspection [9]. The method based on port number can classify the protocol that has registered the port number in Internet assigned numbers authority (IANA) [10].…”

Section: Introductionmentioning

confidence: 99%

Communication Protocol Classification Based on LSTM and DBN

Dou

2020

IEEE Access

View full text Add to dashboard Cite

In the battlefield, we often don't know the parameters about enemy wireless communication system. Therefore, we need to use electronic reconnaissance equipment to search, intercept, identify and analyze enemy wireless communication signal. However, the exciting electronic reconnaissance methods can only detect signal layer parameters such as signal carrier frequency and bandwidth, and cannot obtain more information. In order to improve the reconnaissance ability, we propose a novel communication protocol classification algorithm based on long short-term memory (LSTM) and deep belief network (DBN). We first introduce the DBN, then simulates communication protocol classification method based on DBN. In order to improve the performance, we optimize the method. We uses the LSTM to pre-process the data to extract the feature firstly. Then we make the feature as the input of DBN to classify the communication protocol. Finally we make simulation to verify the effectiveness of the proposed algorithm. Simulation results show that the proposed algorithm has very good performance to classify the communication protocol. INDEX TERMS LSTM, DBN, wireless channel, protocol classification.

show abstract

“…Quek, T.Q.S., see 1386-1397 Quek, Tony Q. S., see 2026-2038 Syrjala, V., see 1674-1687 Vetter, P., see Li, J., J-SAC Aug. 20141575-1584 Vishwanath Member, A., Hinton, K., Ayre, R.W.A., and Tucker, R.S., Modeling Energy Consumption in High-Capacity Routers and Switches; J-SAC Aug. 2014 1524-1532 Viswanath, P., see Geng, Q., J- SAC Sept. 20141699-1706 Vokkarane, V.M., see 2000-2012 Tavakoli Hullar, B., +, J-SAC Oct. 20141907-1918 High …”

mentioning

confidence: 99%

2014 Index IEEE Journal on Selected Areas in Communications Vol. 32

2014

IEEE J. Select. Areas Commun.

View full text Add to dashboard Cite

Efficient Methods for Early Protocol Identification

Cited by 10 publications

References 17 publications

An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection

An Unsupervised Deep Learning Model for Early Network Traffic Anomaly Detection

Communication Protocol Classification Based on LSTM and DBN

2014 Index IEEE Journal on Selected Areas in Communications Vol. 32

Contact Info

Product

Resources

About