Towards a Robust and Scalable TCP Flavors Prediction Model from Passive Traffic

Engelstad

2018 IEEE 17th International Symposium on Network Computing and Applications (NCA)

et al. 2018

Self Cite

Long Short-Term Memory (LSTM) neural networks are a state-of-the-art techniques when it comes to sequence learning and time series prediction models. In this paper, we have used LSTM-based Recurrent Neural Networks (RNN) for building a generic prediction model for Transmission Control Protocol (TCP) connection characteristics from passive measurements. To the best of our knowledge, this is the first work that attempts to apply LSTM for demonstrating how a network operator can identify the most important system-wide TCP per-connection states of a TCP client that determine a network condition (e.g., cwnd) from passive traffic measured at an intermediate node of the network without having access to the sender. We found out that LSTM learners outperform the state-of-the-art classical machine learning prediction models. Through an extensive experimental evaluation on multiple scenarios, we demonstrate the scalability and robustness of our approach and its potential for monitoring TCP transmission states related to network congestion from passive measurements. Our results based on emulated and realistic settings suggest that Deep Learning is a promising tool for monitoring system-wide TCP states from passive measurements and we believe that the methodology presented in our paper may strengthen future research work in the computer networking community.

Section: Prediction Of Tcp Variantsmentioning

confidence: 99%

Recurrent Neural Network-Based Prediction of TCP Transmission States from Passive Measurements

Engelstad

2018 IEEE 17th International Symposium on Network Computing and Applications (NCA)

et al. 2018

Self Cite

“…Detecting the implementation of a TCP variant passively is a challenging task and this, we believe, is the reason why no previous works use it to passively fingerprint remote and local OSes. However, in our case, we already have a general solution for this difficulty presented in our previous works [17,18,19]. The reason why we focus on the implementations of the underlying TCP variant as a feature in our OS classifier model is due to the fact that different OSes are doing slightly different implementations of TCP.…”

Section: Contributionsmentioning

confidence: 99%

“…Furthermore, we were only allowed to collect TCP headers of the traffic flows, while we could not collect complete traffic captures, due to privacy protection and legal reasons. In the next step, the cwnd behavior is used to predict the underlying TCP variant as explained in further detail in our previous works [17,18,19]. As we can see in the bottom right part of Figure 2, The predicted TCP variant is finally used as an input feature to the OS fingerprinting process.…”

Section: B Realistic Trafficmentioning

confidence: 99%

A Machine-Learning-Based Tool for Passive OS Fingerprinting With TCP Variant as a Novel Feature

IEEE Internet Things J.

Kure

et al. 2021

Self Cite

With the emergence of Internet of Things (IoT), securing and managing large, complex enterprise network infrastructure requires capturing and analyzing network traffic traces in real-time. An accurate passive Operating System (OS) fingerprinting plays a critical role in effective network management and cybersecurity protection. Passive fingerprinting doesn't send probes that introduce extra load to the network and hence it has a clear advantage over active fingerprinting since it also reduces the risk of triggering false alarms. This paper proposes and evaluates an advanced classification approach to passive OS fingerprinting by leveraging state-of-the-art classical machine learning and deep learning techniques. Our controlled experiments on benchmark data, emulated and realistic traffic is performed using two approaches. Through an Oracle-based machine learning approach, we found that the underlying TCP variant is an important feature for predicting the remote OS. Based on this observation, we develop a sophisticated tool for OS fingerprinting that first predicts the TCP flavor using passive traffic traces and then uses this prediction as an input feature for another machine learning algorithm for predicting the remote OS from passive measurements. This paper takes the passive fingerprinting problem one step further by introducing the underlying predicted TCP variant as a distinguishing feature. In terms of accuracy, we empirically demonstrate that accurately predicting the TCP variant has the potential to boost the evaluation performance from 84% to 94% on average across all our validation scenarios and across different types of traffic sources. We also demonstrate a practical example of this potential, by increasing the performance to 91.3% and 95.22% on average using a tool for loss-based and a combination of loss and delay-based TCP variant prediction in an emulated setting. To the best of our knowledge, this is the first study that explores the potential for using the knowledge of the TCP variant to significantly boost the accuracy of passive OS fingerprinting.

“…However, our work in this paper relies on a passive measurement technique. In a closely related previous work [15], we presented a machine learning-based approach to identify the underlying traditional loss-based TCP variants which yield accuracies of 93.51% and 95% on emulated and realistic scenarios respectively. The cwnd prediction performance result of the loss-based variants across different scenario settings is presented in Table I.…”

Section: Related Workmentioning

confidence: 99%

“…Hence, in this paper, we want to substantially address this problem by building a two-dimensional space model and see if the β is dependent on queueing delay or not. This helps us to expand our previous method [15] to address bigger cases covering both loss-based and delay-based TCP congestion control algorithms.…”

Section: Related Workmentioning

confidence: 99%

Classification of Delay-based TCP Algorithms From Passive Traffic Measurements

Engelstad

2019 IEEE 18th International Symposium on Network Computing and Applications (NCA)

2019

Self Cite

Identifying the underlying TCP variant from passive measurements is important for several reasons, e.g., exploring security ramifications, traffic engineering in the Internet, etc. In this paper, we are interested in investigating the delay characteristics of widely used TCP algorithms that exploit queueing delay as a congestion signal. Hence, we present an effective TCP variant identification methodology from traffic measured passively by analyzing β, the multiplicative back-off factor to decrease the cwnd on a loss event, and the queueing delay values. We address how the β as a function of queueing delay varies and how the TCP variants of delay-based congestion control algorithms can be predicted both from passively measured traffic and real measurements over the Internet. We further employ a novel non-stationary time series approach from a stochastic nonparametric perspective using a two-sided Kolmogorov-Smirnov test to classify delay-based TCP algorithms based on the α, the rate at which a TCP sender's side cwnd grows per window of acknowledged packets, parameter. Through extensive experiments on emulated and realistic scenarios, we demonstrate that the data-driven classification techniques based on probabilistic models and Bayesian inference for optimal identification of the underlying delay-based TCP congestion algorithms give promising results. We show that our method can also be applied equally well to loss-based TCP variants.