Within Ericsson there is a continuous activity of traffic modeling. Traffic modeling is a practice to analyze traffic patterns and determine necessary resources to handle it optimally. This activity focuses on gathering and analyzing live network measurements, implementing and presenting traffic models. One example of concept in packet traffic modeling is transmission object log which is an aggregation of packet data traces from a measured network over a transmission period. These trace logs that are simple list of all transmission objects contain a vast number of data. When the amount of data increases in these logs several problems can occur such as expensive analysis time, costly data storage and even statistical analysis and data processing in software environments run out of memory. On the other hand, sophisticated and costly computing systems are required for analysis and storage of the data. Therefore, monitoring and analyzing these large traces motivate data reduction. The goal of this thesis is to reduce the number of traffic objects in large object trace logs while preserving the statistical characteristics of the original transmission objects.    Sampling techniques are wildly used to cope with the issues of large amount of data in network monitoring. First, this thesis aims to assess the impact of two sampling techniques as a reduction method. Second, to analyze traffic characteristics and showing the effects of sampling, some statistical properties of both original and sampled datasets as well as their distribution plots will be discussed. The distortion introduced by sampling as the distance between the distribution of properties for sampled and unsampled traffic is also presented by a statistical metric. One of the issues in sampling technique is the sampling size. In order to estimate the sampling size and reduce the logs to a certain level, the concept of offline marginal utility as a complementary method to sampling is proposed in this report. The thesis also makes some suggestions as further works to reduce the logs by having less impact on the object characteristics.

Most SCADA devices have a few built-in self-defence mechanisms and tend to implicitly trust communications received over the network. Therefore, monitoring and forensic analysis of network traffic is a critical prerequisite for building an effective defense around SCADA units. In this thesis work, We provide a comprehensive forensic analysis of network traffic generated by the PCCC(Programmable Controller Communication Commands) protocol and present a prototype tool capable of extracting both updates to programmable logic and crucial configuration information. The results of our analysis shows that more than 30 files are transferred to/from the PLC when downloading/uplloading a ladder logic program using RSLogix programming software including configuration and data files. Interestingly, when RSLogix compiles a ladder-logic program, it does not create any lo-level representation of a ladder-logic file. However the low-level ladder logic is present and can be extracted from the network traffic log using our prototype tool. the tool extracts SMTP configuration from the network log and parses it to obtain email addresses, username and password. The network log contains password in plain text.

Due to it being increasingly common that users' data is encrypted, the Internet service providers today find it difficult to adapt their service for the users' needs. Previously popular methods of classifying users data does not work as well today and new alternatives is therefore desired to give the users an optimal experience.This study focuses specifically on classifying data flows into video and non-video flows with the use of machine learning algorithms and with a focus on runtime performance. In this study the tested algorithms are created in Python and then exported into a C code implementation, more specifically the random forest and the gradient boosting trees algorithm.The goal is to find the algorithm with the fastest classification time relative to its accuracy, making the classification as fast as possible and the classification model to require as little space as possible.The results show that random forest was significantly faster at classification than gradient boosting trees, with initial tests showing it to be roughly 7 times faster after compiler optimization. After optimizing the C code random forest could classify more than 250,000 data flows each second with decent accuracy. Neither of the two algorithms required a lot of space (<3 megabyte). / HITS, 4707

The diploma thesis deals with the processing of raw data from vehicle tracking by means of GPS in order to obtain traffic quantities as a possible source of data for traffic surveys and subsequent analysis in the field of traffic modeling.

This paper deals with traffic signs recognition. Red color area is obtained by thresholding in HSV color model. Selected radiometric deskriptors, Hough transform deskriptors and neural networs are used to classification. In conclusion has been designed complex decision algorithm.

This thesis is considering with network traffic analysis and prediction of real networks default services. The first part of this paper is containing the theoretical explanation of the mathematical model’s needs. These models are mainly used as a part of simulation algorithms which are describing the processes of network traffic simulations. The second part is describing the process how to apply the models to mathematically analyze the captured traffic. The capture is including all kind of packet types which can appear on the real network. At the last part of the thesis is described the detailed design of the prediction algorithm’s which are developed in programing language of Matlab® Mathworks®.

Theses deals with network traffic modeling focused on elaboration by time series analysis. The nature of network traffic is discussed above all http traffic. First three chapters are theoretical, which describes time series and basic models, linear AR, MA, ARMA, ARIMA and nonlinear ARCH. Other chapters define terms like self-similarity and long range dependence. It is demonstrated a failure of conventional models which cannot capture these specific properties of network data traffic. On the basis of study in chapter 6. is closely described the combined ARIMA/GARCH model and its parameter estimation procedure. Applied part of this theses deals with procedure of estimation and fitting the estimation model to observed network traffic. After an estimation a few future values are predicted on the basis of estimated model. These predicted values are consequently compared with real data.

No description available.

No description available.

No description available.