Recurrent Neural Network-Based Prediction of TCP Transmission States from Passive Measurements

Hagos, Desta Haileselassie; Engelstad, Paal E.; Yazidi, Anis; Kure, Øivind

doi:10.1109/nca.2018.8548064

Cited by 8 publications

(15 citation statements)

References 25 publications

(41 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Detecting the implementation of a TCP variant passively is a challenging task and this, we believe, is the reason why no previous works use it to passively fingerprint remote and local OSes. However, in our case, we already have a general solution for this difficulty presented in our previous works [17,18,19]. The reason why we focus on the implementations of the underlying TCP variant as a feature in our OS classifier model is due to the fact that different OSes are doing slightly different implementations of TCP.…”

Section: Contributionsmentioning

confidence: 99%

“…Furthermore, we were only allowed to collect TCP headers of the traffic flows, while we could not collect complete traffic captures, due to privacy protection and legal reasons. In the next step, the cwnd behavior is used to predict the underlying TCP variant as explained in further detail in our previous works [17,18,19]. As we can see in the bottom right part of Figure 2, The predicted TCP variant is finally used as an input feature to the OS fingerprinting process.…”

Section: B Realistic Trafficmentioning

confidence: 99%

“…Long Short-Term Memory (LSTM) models: We have explored an approach to classify the underlying OS from passive measurements using LSTM-based RNN architecture by combining the basic TCP/IP features and the underlying TCP variant shown in Table 2 as input vectors. For more details about LSTM applied in the context of computer networks, we refer the reader to our previous paper [18]. We trained our LSTM model over 500 epochs of the training samples with a batch size of 250 as values in time-series.…”

Section: B Deep Learning Approachesmentioning

confidence: 99%

“…The OS fingerprinter then uses that TCP variant prediction as an input feature to make the OS prediction illustrated in the upper part of Figure 2. The TCP variant is predicted by analyzing the famous sawtooth pattern behavior of estimated cwnd of TCP, which is computed based on the outstanding bytes-in-flight [18,19]. This is presented in more detail in the next section.…”

Section: E Objectives Of Our Experimentsmentioning

confidence: 99%

See 3 more Smart Citations

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

Hagos

Yazidi

Kure

et al. 2021

IEEE Internet Things J.

Self Cite

View full text Add to dashboard Cite

With the emergence of Internet of Things (IoT), securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real-time. An accurate passive Operating System (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting doesn't send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This paper proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This paper takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.3% and 95.22% on average using a tool for loss-based and a combination of loss and delay-based TCP variant prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

show abstract

Section: Contributionsmentioning

confidence: 99%

Section: B Realistic Trafficmentioning

confidence: 99%

Section: B Deep Learning Approachesmentioning

confidence: 99%

Section: E Objectives Of Our Experimentsmentioning

confidence: 99%

See 2 more Smart Citations

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

Hagos

Yazidi

Kure

et al. 2021

IEEE Internet Things J.

Self Cite

View full text Add to dashboard Cite

show abstract

“…Various works deal with identifying CC variants. There are two main categories for these approaches: Identification approaches using passive [2,6,13,18,20] or active [19,24] measurements.…”

Section: Related Workmentioning

confidence: 99%

DeePCCI

Sander

Rüth

Hohlfeld

et al. 2019

Proceedings of the 2019 Workshop on Network Meets AI &Amp; ML - NetAI'19

View full text Add to dashboard Cite

Transport protocols use congestion control to avoid overloading a network. Nowadays, different congestion control variants exist that influence performance. Studying their use is thus relevant, but it is hard to identify which variant is used. While passive identification approaches exist, these require detailed domain knowledge and often also rely on outdated assumptions about how congestion control operates and what data is accessible. We present DeePCCI, a passive, deep learning-based congestion control identification approach which does not need any domain knowledge other than training traffic of a congestion control variant. By only using packet arrival data, it is also directly applicable to encrypted (transport header) traffic. DeePCCI is therefore more easily extendable and can also be used with QUIC.

show abstract

Deep Learning Based Traffic Prediction Method for Digital Twin Network

et al. 2023

View full text Add to dashboard Cite

Network traffic prediction (NTP) can predict future traffic leveraging historical data, which serves as proactive methods for network resource planning, allocation, and management. Besides, NTP can also be applied for load generation in simulated and emulated as well as digital twin networks (DTNs). This paper focuses on accurately predicting background traffic matrix (TM) of typical local area network (LAN) for traffic synchronization in DTN. A survey is firstly conducted on DTN, conventional model, and deep learning based NTP methods. Then, as the major contribution, a linear feature enhanced convolutional long short-term memory (ConvLSTM) model based NTP method is proposed for LAN. An autoregressive unit is integrated into the ConvLSTM model to improve its linear prediction ability. In addition, this paper further optimizes the proposed model from both spatial and channel-wise dimensions. Particularly, a traffic pattern attention (TPA) block and a squeeze & excitation (SE) block are derived and added to the enhanced ConvLSTM (eConvLSTM) model. Comparative experiments demonstrate that the eConvLSTM model outperforms all the baselines. It can improve the prediction accuracy by reducing the mean square error (MSE) up to 10.6% for one-hop prediction and 16.8% for multi-hops prediction, compared to the legacy CovnLSTM model, with still satisfying the efficiency requirements. The further enhancement of the eConvLSTM model can additionally reduce the MSE about 2.1% for one-hop prediction and 4.2% for multi-hops prediction, with slightly degrading efficiency. The proposed eConvLSTM model based NTP method can play a vital role on DTN traffic synchronization.

show abstract

Recurrent Neural Network-Based Prediction of TCP Transmission States from Passive Measurements

Cited by 8 publications

References 25 publications

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

DeePCCI

Deep Learning Based Traffic Prediction Method for Digital Twin Network

Contact Info

Product

Resources

About