Wide availability of computing resources at the edge of the network has lead to the appearance of new services based on peer-to-peer architectures. In a peer-to-peer network nodes have the capability to act both as client and server. They self-organize and cooperate with each other to perform more efficiently operations related to peer discovery, content search and content distribution. The main goal of this thesis is to obtain a better understanding of the network traffic generated by Gnutella peers. Gnutella is a well-known, heavily decentralized file-sharing peer-to-peer network. It is based on open protocol specifications for peer signaling, which enable detailed measurements and analysis down to individual messages. File transfers are performed using HTTP. An 11-days long Gnutella link-layer packet trace collected at BTH is systematically decoded and analyzed. Analysis results include various traffic characteristics and statistical models. The emphasis for the characteristics has been on accuracy and detail, while for the traffic models the emphasis has been on analytical tractability and ease of simulation. To the author's best knowledge this is the first work on Gnutella that presents statistics down to message level. The results show that incoming requests to open a session follow a Poisson distribution. Incoming messages of mixed types can be described by a compound Poisson distribution. Mixture distribution models for message transfer rates include a heavy-tailed component. / http://www.its.bth.se/staff/dil/

Orientador: Lee Luan Ling / Tese (doutorado) - Universidade Estadual de Campinas, Faculdade de Engenharia Eletrica e de Computação / Made available in DSpace on 2018-08-08T01:26:33Z (GMT). No. of bitstreams: 1 Vieira_FlavioHenriqueTeles_D.pdf: 4214611 bytes, checksum: 755dfe9865aff1214f8e551afde7541d (MD5) Previous issue date: 2006 / Resumo: A modelagem multifractal generaliza os modelos de tráfego existentes na literatura e se mostra apropriada para descrever as características encontradas nos fluxos de tráfego das redes atuais. A presente tese investiga abordagens para alocação de banda, predição de tráfego e estimação de probabilidade de perda de bytes considerando as características multifractais de tráfego. Primeiramente, um Modelo Multifractal baseado em Wavelets (MMW) é proposto. Levando em consideração as propriedades deste modelo, são derivados o parâmetro de escala global, a função de autocorrelação e a banda efetiva para processos multifractais. A capacidade de atualização em tempo real do MMW aliada à banda efetiva proposta permite o desenvolvimento de um algoritmo de estimação adaptativa de banda efetiva. Através deste algoritmo é introduzido um esquema de provisão adaptativo de banda efetiva. Estuda-se também a alocação de banda baseada em predição de tráfego. Para este fim, propõe-se um preditor adaptativo fuzzy de tráfego, o qual é aplicado em uma nova estratégia de alocação de banda. O preditor fuzzy adaptativo proposto utiliza funções de base ortonormais baseadas nas propriedades do MMW. Com relação à probabilidade de perda para tráfego multifractal, derivase uma expressão analítica para a estimação da probabilidade de perda de bytes considerando que o tráfego obedece ao MMW. Além disso, uma caracterização mais completa do comportamento de fila é efetuada pela obtenção de limitantes para a probabilidade de perda e para a ocupação média do buffer em termos da banda efetiva do MMW. Por fim, é apresentado um esquema de controle de admissão usando o envelope efetivo proposto para o MMW oriundo do cálculo de rede estatístico, que garante que os fluxos admitidos obedeçam simultaneamente aos requisitos de perda e de retardo. As simulações realizadas evidenciam a relevância das propostas apresentadas / Abstract: Multifractal modeling generalizes the existing traffic models and is believed to be appropriate to describe the characteristics of traffic flows of modern communication networks. This thesis investigates some novel approaches for bandwidth allocation, traffic prediction and byte loss probability estimation, by considering the multifractal characteristics of the network traffic. Firstly, a Wavelet based Multifractal Model (WMM) is proposed. Taking into account the properties of this multifractal model, we derive the global scaling parameter, the autocorrelation function and the effective bandwidth for multifractal processes. The real time updating capacity of the WMM in connection with our effective bandwidth proposal allows us to develop an algorithm for adaptive effective bandwidth estimation. Then, through this algorithm, an adaptive bandwidth provisioning scheme is introduced. In this work, we also study a prediction-based bandwidth allocation case. For this end, we develop an adaptive fuzzy predictor, which is incorporated into a novel bandwidth allocation scheme. The proposed adaptive fuzzy predictor makes use of orthonormal basis functions based on the properties of the WMM. Additionally, we derive an analytical expression for the byte loss probability estimation assuming that the traffic obeys the MMW. Besides, a more complete characterization of the queuing behavior is carried out through the estimation of the bounds for the loss probability and mean queue length in buffer in terms of the WMM based effective bandwidth. Finally, an admission control scheme is presented that uses the WMM based effective envelope derived through the statistical network calculus, guaranteeing that the admitted flows simultaneously attend the loss and delay requirements. The computer simulation results confirm the relevance of the presented proposals / Doutorado / Telecomunicações e Telemática / Doutor em Engenharia Elétrica

Pokrok při zdokonalování klasifikačních algoritmů je zpomalován nedostatkem dat potřebných pro testování. Reálná data je obtížné získat z důvodu bezpečnosti a ochrany citlivých informací. Existují však generátory syntetických sad pravidel, jako například ClassBench-ng. K vyhodnocení správného fungování, propustnosti, spotřeby energie a dalších vlastností klasifikačních algoritmů je zapotřebí také vhodný síťový provoz. Tématem této práce je tvorba takového generátoru síťového provozu, který by umožnil testování těchto vlastností v kombinaci s IPv4, IPv6 a OpenFlow1.0 pravidly vygenerovanými ClassBench-ng. Práce se zabývá různými způsoby, jak toho dosáhnout, které vedly k vytvoření několika verzí generátoru. Vlastnosti jednotlivých verzí byly zkoumány řadou experimentů. Implementace byla provedena pomocí jazyku Python. Nejvýznamnějším výsledkem je generátor, který využívá principů několika zkoumaných přístupů k dosažení co nejlepších vlastností. Dalším přínosem je nástroj, který bylo nutné vytvořit pro analýzu užitých sad klasifikačních pravidel a vyhodnocení vlastností vygenerovaného síťového provozu.

Master thesis deals with analysis of single board PC which use Linux as operation system. Analysis of individual NIDS systems and examined their properties for choosing right candidate for single board computer which shall be used as network probe for analysis, filtering and logging of network traffic. Part of the work is aimed on development of a interface which is used for configuration of network probe through the web browser. Web interface allows perform basic operations over network probe which influence network traffic or specify, which information shall be logged. Subsequently network parsers were implemented for network protocols using the Scappy library. The conclusion of the thesis contains the design of the security cover for the device according to the IP54 requirements.

The master thesis focuses on the selection of a suitable algorithm for the classification of selected network traffic services and its implementation. The theoretical part describes the available classification approaches together with commonly used algorithms and selected network services. The practical part focuses on the preparation and preprocessing of the dataset, selection and optimization of the classification algorithm and verifying the classification capabilities of the algorithm in the various scenarios of the dataset.

The thesis describes a design and implementation of Nemea system module purposed on generation of records about simulated network attacks. This thesis also contains brief description of Nemea system and several network attacks. Finally, part of this work is description of simulated attacks and methods of simulations.

This thesis deals with the design of hardware unit used for acceleration of the process of securing network traffic within Lawful Interception System developed as a part of Sec6Net project. First aim of the thesis is the analysis of available security mechanisms commonly used for securing network traffic. Based on this analysis, SSH protocol is chosen as the most suitable mechanism for the target system. Next, the thesis aims at introduction of possible variations of acceleration unit for SSH protocol. In addition, the thesis presents a detailed design description and implementation of the unit variation based on AES-GCM algorithm, which provides confidentiality, integrity and authentication of transmitted data. The implemented acceleration unit reaches maximum throughput of 2,4 Gbps.

For high-speed (e.g. more than 1 Gbit/s) filtration of network traffic there are available many of proprietary hardware solutions nowadays. But there are also a couple of free licensed projects that are specialized in high-speed packet processing on common hardware. The goal of thesis is to find such projects, verify that there are filtering tools based on these projects, try to filter 10Gbit/s network traffic by these tools and test them against various filtration settings. Implementation of packet filter that could be used for filtration of network traffic up to 10Gbit/s speed should be the output of this thesis.

Networks connected to the internet are under a constant threat of attacks. To protect against such threats, new techniques utilising already connected hardware have in this thesis been proven to be a viable solution. By equipping network switches with lightweight machine learning models, such as, Decision Tree and Random Forest, no additional devices are needed to be installed on the network.When an attack is detected, the device may notify or take direct actions on the network to protect vulnerable systems. By utilising container software on Westermo's devices, a model has been integrated, limiting its computational resources. Such a system, and its building blocks, are what this thesis has researched and implemented. The system has been validated using multiple different models using a range of parameters.These models have been trained offline on datasets with pre-recorded attacks. The recordings are converted into flows, decreasing dataset size and increasing information density. These flows contain features corresponding to information about the packets and statistics about the flows. During training, a subset of features was selected using a Genetic Algorithm, decreasing the time for processing each packet. After the models have been trained, they are converted to C code, which runs on a network switch. These models are verified online, using a simulated factory, launching different attacks on the network. Results show that the hardware is sufficient for smaller models and that the system is capable of detecting certain types of attacks.

Network traffic forecasting estimates future network traffic based on historical traffic observations. It has a wide range of applications, and substantial attention has been dedicated to this research area. Cellular networks serve as the backbone of modern-day communication systems, which support billions of users throughout the world and can help improve the quality of urban life to a great extent. Therefore, accurate traffic prediction is becoming more important for network planning, control management, and the Quality of Service. Diverse methods, including neural network-based methods and data mining methods, have been used for this goal. The Recurrent Neural family is well known for time series data modeling, which predicts the future time series based on the historical data being fed as input to neural nets which may have large time lags with variable lengths. RNN includes several network architectures, such as vanilla RNN and Long Short Term memory (LSTM), that can learn temporal patterns and long-term dependencies in vast sequences of arbitrary length. This paper proposes three models based on LSTM architecture, a multi-layer LSTM with Auto-Encoder, and an AE-LSTM combined with a Multi-Layer Perceptron neural network. The results of each model are discussed in the paper. Simulation outcomes were implemented in Python and compared to existing algorithms, demonstrating high efficacy and performance.