Traffic analysis at short time-scales: an empirical case study from a 3G cellular network

Ricciato, Fabio; Hasenleithner, Eduard; Romirer-Maierhofer, Peter

doi:10.1109/tnsm.2008.080102

Cited by 14 publications

(10 citation statements)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Notably, the traces used in [1]- [3] date after the "explosion" of scanning traffic that is documented in [13]. In another work, we have found that such traffic has an impact on global rate (and delay) statistics, introducing large spikes, some of which appear regularly and periodically (see [14]). More in general, the impact of unwanted traffic on the wavelet spectrum of real traces is a point that deserves further study.…”

Section: Mapping To Realitymentioning

confidence: 99%

On the Role of Flows and Sessions in Internet Traffic Modeling: An Explorative Toy-Model

Ricciato

Coluccia

D’Alconzo

et al. 2009

GLOBECOM 2009 - 2009 IEEE Global Telecommunications Conference

View full text Add to dashboard Cite

Abstract-In this work we present a simple toy-model that is able to explain certain empirical observations reported in a set of previous papers by Hohn et al.[1]-[3] about the wavelet spectrum of real traffic traces. Therein, the authors found that the wavelet spectrum is substantially invariant to flow scrambling and truncation, suggesting that super-flow structures above the transport layer -i.e., sessions -can be ignored for modeling the packet arrival process. Based on the proposed toy-model, we offer an interpretation framework that goes in the opposite direction, wherein sessions, not transport-layer flows, should be taken as the main structural entities in simplified on/off models.

show abstract

Section: Mapping To Realitymentioning

confidence: 99%

On the Role of Flows and Sessions in Internet Traffic Modeling: An Explorative Toy-Model

Ricciato

Coluccia

D’Alconzo

et al. 2009

GLOBECOM 2009 - 2009 IEEE Global Telecommunications Conference

View full text Add to dashboard Cite

show abstract

“…Only when cross traffic is close to the bottleneck link capacity for long time, the extra delay can reach the order of seconds [9] and the adversary could mistakenly infer that the RRC state was IDLE. Given the bursty nature of traffic in mobile networks [19] we deem this as an extreme scenario. In fact, mobile devices are typically used for short periods of time, and non-user generated traffic is produced by background apps and services regularly downloading short updates from the network (e.g., social network status updates, emails, and so on).…”

Section: Factors Affecting the Detection Accuracymentioning

confidence: 99%

Exploiting Delay Patterns for User IPs Identification in Cellular Networks

Perta

Barbera

Mei

2014

Privacy Enhancing Technologies

View full text Add to dashboard Cite

Abstract. A surprisingly high number of mobile carriers worldwide do not block unsolicited traffic from reaching their mobile devices from the open Internet or from within the cellular network. This exposes mobile users to a class of lowresource attacks that could compromise their privacy and security. In this work we describe a methodology that allows an adversary to identify a victim device in the cellular network by just sending messages to its user through one or more messaging apps available today on the mobile market. By leveraging network delays produced by mobile devices in different radio states and the timeliness of push notifications, we experimentally show how our methodology is able to quickly identify the target device within 20 messages in the worst case through measurements on a large mobile network.

show abstract

“…traffic originated by unproductive (and often illegitimate) activities like scanning and flooding -see e.g. [8], [9] and references therein. Such traffic might experience a loss rate considerably higher than the rest of legitimate traffic: for example, in a previous study of traffic from a real network [9] we found that high-rate packet bursts originated by sequential scanning were causing micro-congestion events, i.e.…”

Section: Loss Metricsmentioning

confidence: 99%

“…Moreover, we used nmap [15] to produce high-rate scanning traffic, as representative of the unwanted traffic that is found in the real Internet (see e.g. [9] and references therein): bursts of TCP SYN directed towards different destinations are produced approximately every 10 minutes. Every burst has a duration of 5-6 seconds, and a gross bitrate of 2.5 Mbps and 0.8 Mbps respectively in the high and low load scenarios.…”

Section: Testbed Validation a Testbed Settingmentioning

confidence: 99%

One-way loss measurements from IPFIX records

Ricciato¹,

Strohmeier²,

Dorfinger³

et al. 2011

2011 IEEE International Workshop on Measurements and Networking Proceedings (M&N)

View full text Add to dashboard Cite

In this work we describe a methodology to estimate one-way packet loss from IPFIX or NetFlow flow records collected at two monitoring points. The proposed method does not require tight synchronization between the two monitoring points, nor it relies upon external routing information. It can run online or offline, and can work on legacy IPFIX/NetFlow traces which were not collected for the specific purpose of loss estimation. In this preliminary work we describe the estimation procedure and present early validation results from a real testbed.

show abstract

Traffic analysis at short time-scales: an empirical case study from a 3G cellular network

Cited by 14 publications

References 12 publications

On the Role of Flows and Sessions in Internet Traffic Modeling: An Explorative Toy-Model

On the Role of Flows and Sessions in Internet Traffic Modeling: An Explorative Toy-Model

Exploiting Delay Patterns for User IPs Identification in Cellular Networks

One-way loss measurements from IPFIX records

Contact Info

Product

Resources

About