Towards Oblivious Network Analysis using Generative Adversarial Networks

Lin, Zinan; Moon, Soo-Jin; Zarate, Carolina; Mulagalapalli, Ritika; Kulandaivel, Sekar; Fanti, Giulia; Sekar, Vyas

doi:10.1145/3365609.3365854

Cited by 4 publications

(9 citation statements)

References 24 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Although RareGAN is primarily motivated from the applications in security, networking, and systems, we also consider image generation, both as a useful tool in its own right and to visualize the improvements. This work builds on our previous workshop paper (Section 4.2 of (Lin et al 2019)). The version with full appendix is at (Lin et al 2022).…”

Section: Introductionmentioning

confidence: 91%

“…Server operators want to know which requests trigger these amplification attacks to e.g., drop attack requests. Prior solutions require detailed information about the server, such as source code (Rossow 2014), which may be unavailable (Lin et al 2019).…”

Section: Problem Formulation and Use Casesmentioning

confidence: 99%

“…System operators may therefore want to understand worst-case system performance (e.g., CPU/memory usage or delay in the presence of congestion) and optimize for such scenarios (Pedrosa et al 2018). However, current tools for generating such workloads often rely on a system's source code (Caballero et al 2007;Petsios et al 2017;Pedrosa et al 2018), which may be unavailable (Lin et al 2019;Black, Guttman, and Okun 2021).…”

Section: Problem Formulation and Use Casesmentioning

confidence: 99%

“…Prior domain-specific solutions to these problems rely heavily on prior knowledge (e.g., source code) of the systems, which is often unavailable (Lin et al 2019). Indeed, in response to a recent executive order Improving the Nation's Cybersecurity 1 , the U.S. National Institute of Standards and Technology published guidance highlighting the importance of creating 'black box' tests for device and software security that do not rely on the implementation or source code of systems (Black, Guttman, and Okun 2021).…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

RareGAN: Generating Samples for Rare Classes

Lin

Hao

Fanti

et al. 2022

AAAI

Self Cite

View full text Add to dashboard Cite

We study the problem of learning generative adversarial networks (GANs) for a rare class of an unlabeled dataset subject to a labeling budget. This problem is motivated from practical applications in domains including security (e.g., synthesizing packets for DNS amplification attacks), systems and networking (e.g., synthesizing workloads that trigger high resource usage), and machine learning (e.g., generating images from a rare class). Existing approaches are unsuitable, either requiring fully-labeled datasets or sacrificing the fidelity of the rare class for that of the common classes. We propose RareGAN, a novel synthesis of three key ideas: (1) extending conditional GANs to use labelled and unlabelled data for better generalization; (2) an active learning approach that requests the most useful labels; and (3) a weighted loss function to favor learning the rare class. We show that RareGAN achieves a better fidelity-diversity tradeoff on the rare class than prior work across different applications, budgets, rare class fractions, GAN losses, and architectures.

show abstract

Section: Introductionmentioning

confidence: 91%

Section: Problem Formulation and Use Casesmentioning

confidence: 99%

Section: Problem Formulation and Use Casesmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

RareGAN: Generating Samples for Rare Classes

Lin

Hao

Fanti

et al. 2022

AAAI

Self Cite

View full text Add to dashboard Cite

show abstract

“…They intend to generate valid network packets using GANs. In [13], Z. Lin et al describe preliminary works on how to use GANs for oblivious network analysis, that is, to learn the internal structures and protocol formats of black-box devices. To this purpose, they develop synthetic protocols to show that a GAN is able to learn intra-field and inter-field dependencies, ultimately generating compliant packets for a black-box protocol.…”

Section: Related Workmentioning

confidence: 99%

Generative Deep Learning for Internet of Things Network Traffic Generation

Shahid

Blanc

Jmila

et al. 2020

2020 IEEE 25th Pacific Rim International Symposium on Dependable Computing (PRDC)

View full text Add to dashboard Cite

The rapid development of the Internet of Things (IoT) has prompted a recent interest into realistic IoT network traffic generation. Security practitioners need IoT network traffic data to develop and assess network-based intrusion detection systems (NIDS). Emulating realistic network traffic will avoid the costly physical deployment of thousands of smart devices. From an attacker's perspective, generating network traffic that mimics the legitimate behavior of a device can be useful to evade NIDS. As network traffic data consist of sequences of packets, the problem is similar to the generation of sequences of categorical data, like word by word text generation. Many solutions in the field of natural language processing have been proposed to adapt a Generative Adversarial Network (GAN) to generate sequences of categorical data. In this paper, we propose to combine an autoencoder with a GAN to generate sequences of packet sizes that correspond to bidirectional flows. First, the autoencoder is trained to learn a latent representation of the real sequences of packet sizes. A GAN is then trained on the latent space, to learn to generate latent vectors that can be decoded into realistic sequences. For experimental purposes, bidirectional flows produced by a Google Home Mini are used, and the autoencoder is combined with a Wassertein GAN. Comparison of different network characteristics shows that our proposed approach is able to generate sequences of packet sizes that behave closely to real bidirectional flows. We also show that the synthetic bidirectional flows are close enough to the real ones that they can fool anomaly detectors into labeling them as legitimate.

show abstract

ResolFuzz: Differential Fuzzing of DNS Resolvers

Bushart,

Rossow

2024

Lecture Notes in Computer Science

View full text Add to dashboard Cite

This paper identifies and analyzes vulnerabilities in the DNS infrastructure, with particular focus on recursive DNS resolvers. We aim to identify semantic bugs that could lead to incorrect resolver responses, introducing risks to the internet's critical infrastructure. To achieve this, we introduce ResolFuzz, a mutation-based fuzzer to search for semantic differences across DNS resolver implementations. ResolFuzz combines differential analysis with a rule-based mechanism to distinguish between benign differences and potential threats. We evaluate our prototype on seven resolvers and uncover multiple security vulnerabilities, including inaccuracies in resolver responses and possible amplification issues in PowerDNS Recursor's handling of DNAME Resource Records (RRs). Moreover, we demonstrate the potential for self-sustaining DoS attacks in resolved and trust-dns, further underlining the necessity of comprehensive DNS security. Through these contributions, our research underscores the potential of differential fuzzing in uncovering DNS vulnerabilities.

show abstract

Towards Oblivious Network Analysis using Generative Adversarial Networks

Cited by 4 publications

References 24 publications

RareGAN: Generating Samples for Rare Classes

RareGAN: Generating Samples for Rare Classes

Generative Deep Learning for Internet of Things Network Traffic Generation

ResolFuzz: Differential Fuzzing of DNS Resolvers

Contact Info

Product

Resources

About