The frequent and large-scale network attacks have led to an increased need for developing techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks, anomalies and to appropriately take action to contain the attacks before they have had time to propagate across the network. In this dissertation, we suggest a technique for traffic anomaly detection based on analyzing the correlation of destination IP addresses and distribution of image-based signal in postmortem and real-time, by passively monitoring packet headers of traffic. This address correlation data are transformed using discrete wavelet transform for effective detection of anomalies through statistical analysis. Results from trace-driven evaluation suggest that the proposed approach could provide an effective means of detecting anomalies close to the source. We present a multidimensional indicator using the correlation of port numbers as a means of detecting anomalies. We also present a network measurement approach that can simultaneously detect, identify and visualize attacks and anomalous traffic in real-time. We propose to represent samples of network packet header data as frames or images. With such a formulation, a series of samples can be seen as a sequence of frames or video. Thisenables techniques from image processing and video compression such as DCT to be applied to the packet header data to reveal interesting properties of traffic. We show that ??scene change analysis?? can reveal sudden changes in traffic behavior or anomalies. We show that ??motion prediction?? techniques can be employed to understand the patterns of some of the attacks. We show that it may be feasible to represent multiple pieces of data as different colors of an image enabling a uniform treatment of multidimensional packet header data. Measurement-based techniques for analyzing network traffic treat traffic volume and traffic header data as signals or images in order to make the analysis feasible. In this dissertation, we propose an approach based on the classical Neyman-Pearson Test employed in signal detection theory to evaluate these different strategies. We use both of analytical models and trace-driven experiments for comparing the performance of different strategies. Our evaluations on real traces reveal differences in the effectiveness of different traffic header data as potential signals for traffic analysis in terms of their detection rates and false alarm rates. Our results show that address distributions and number of flows are better signals than traffic volume for anomaly detection. Our results also show that sometimes statistical techniques can be more effective than the NP-test when the attack patterns change over time.

Traffic congestion is a one hundred billion dollar problem in the US. The cost of congestion has been trending upward over the last few decades, but has experienced slight decreases in recent years partly due to the impact of congestion reduction strategies. The impact of these strategies is however largely experienced on freeways and not arterials. This discrepancy in impact is partially linked to the lack of real-time, arterial traffic information. Toward this end, this research effort seeks to address the lack of arterial traffic information. To address this dearth of information, this effort developed a methodology to provide accurate estimates of arterial performance measures to transportation facility managers and travelers in real-time. This methodology employs transmitted point sensor data to drive an online, microscopic traffic simulation model. The feasibility of this methodology was examined through a series of experiments that were built upon the successes of the previous, while addressing the necessary limitations. The results from each experiment were encouraging. They successfully demonstrated the method's likely feasibility, and the accuracy with which field estimates of performance measures may be obtained. In addition, the method's results support the viability of a "real-world" implementation of the method. An advanced calibration process was also developed as a means of improving the method's accuracy. This process will in turn serve to inform future calibration efforts as the need for more robust and accurate traffic simulation models are needed. The success of this method provides a template for real-time traffic simulation modeling which is capable of adequately addressing the lack of available arterial traffic information. In providing such information, it is hoped that transportation facility managers and travelers will make more informed decisions regarding more efficient management and usage of the nation's transportation network.

As roadside and in-vehicle sensors are deployed under the Connected Vehicle Research program (formerly known as Vehicle Infrastructure Integration initiative and Intellidrive), an increasing variety of traffic data is becoming available in real time. This real time traffic data is shared among vehicles and between vehicles and traffic management centers through wireless communication. This course of events creates an opportunity for mobile computing and online traffic simulations. However, online traffic simulations require faster than real time running speed with high simulation resolution, since the purpose of the simulations is to provide immediate future traffic forecast based on real time traffic data. However, simulating at high resolution is often too computationally intensive to process a large scale network on a single processor in real time. To mitigate this limitation an online ad hoc distributed simulation with optimistic execution is proposed in this study. The objective of this study is to develop an online traffic simulation system based on an ad hoc distributed simulation with optimistic execution. In this system, data collection, processing, and simulations are performed in a distributed fashion. Each individual simulator models the current traffic conditions of its local vicinity focusing only on its area of interest, without modeling other less relevant areas. Collectively, a central server coordinates the overall simulations with an optimistic execution technique and provides a predictive model of traffic conditions in large areas by combining simulations geographically spread over large areas. This distributed approach increases computing capacity of the entire system and speed of execution. The proposed model manages the distributed network, synchronizes the predictions among simulators, and resolves simulation output conflicts. Proper feedback allows each simulator to have accurate input data and eventually produce predictions close to reality. Such a system could provide both more up-to-date and robust predictions than that offered by centralized simulations within a single transportation management center. As these systems evolve, the online traffic predictions can be used in surface transportation management and travelers will benefit from more accurate and reliable traffic forecast.

Not available / text

This thesis presents a statistical analysis of weaving in a managed lane system which is evolving from a High-Occupancy Vehicle (HOV) system to a High-Occupancy Toll system (HOT). Weaving was, assessed along the I-85 corridor in Atlanta, during three different phases in the conversion from HOV to HOT: 1) the existing HOV managed lane system prior to conversion to HOT lanes, 2) after restriping of some weaving zones but prior to conversion of the HOV lanes to HOT lanes and, 3) after the HOT managed lane system opened. Each phase was analyzed to see how weaving behavior into and out of the managed lane system was affected by changes in the system. To accomplish the analysis, video was collected using Georgia Department of Transportation cameras along the corridor. The videos were transferred to an Android Tablet, in which an App developed by the research team was used to record data from the videos. Using the processed weaving data, a comparison of weaving activity during each phase was performed. Data were also analyzed across time of day, speed differentials, and whether the weaves in question were performed legally (within established weaving zones) or illegally (across double-solid striped lane markings). After a comparison of weaving behavior along different variables, a regression tree analysis was completed. The analysis showed that weaving intensity increased as the system was converted from HOV to HOT. However, illegal weaving decreased significantly once the HOT system was in place, perhaps due to stricter enforcement or perhaps due to driver response to illegally entering and leaving tolled lanes. The regression tree analyses indicated that weaving intensity was highly dependent upon whether it was legal or illegal to weave and upon the phase of conversion during which the weave occurred.

This thesis evaluates the performance of a vehicle detection technology, Automated License Plate Recognition (ALPR) camera systems, with regards to its ability to produce real-time travel time information in active work zones. A literature review was conducted to investigate the ALPR technology as well as to identify other research that has been conducted using ALPR systems to collect travel time information. Next, the ALPR technology was tested in a series of field deployments in both an arterial and a freeway environment. The goal of the arterial field deployment was to evaluate the optimal ALPR camera angles that produce the highest license plate detection rates and accuracy percentages. Next, a series of freeway deployments were conducted on corridors of I-285 in Atlanta, Georgia in order to evaluate the ALPR system in active work zone environments. During the series of I-285 freeway deployments, ALPR data was collected in conjunction with data from Bluetooth and radar technologies, as well as from high definition video cameras. The data collected during the I-285 deployments was analyzed to determine the ALPR vehicle detection rates. Additionally, a script was written to match the ALPR reads across two data collection stations to determine the ALPR travel times through the corridors. The ALPR travel time data was compared with the travel time data produced by the Bluetooth and video cameras with a particular focus on identifying travel time biases associated with each given technology. Finally, based on the knowledge gained, recommendations for larger-scale ALPR work zone deployments as well as suggestions for future research are provided.

No description available.

The issue of providing Quality of Service (QoS) in the Internet is becoming more and more important because of two phenomena: (1) the growth of the value added services that require QoS (e.g., VPNs, IPTV) and (2) network convergence towards a unified IP-based architecture, for voice, image and data services. In this context, the limitations of existing QoS technologies emerge: it is currently difficult for an operator to guarantee that its network can offer a specific level of service. Furthermore, it is hard to ensure a consistent treatment of end-to-end QoS-sensitive flow that cross networks controlled by several operators. Indeed, the control on such traffic flows is shared between all the traversed operators. In the thesis, we have studied these issues. Specifically, we have addressed the problems of routing and dynamic traffic engineering at inter-domain level. We have proposed several algorithmic solutions to compute paths subject to multiple performance constraints. Analytical studies and simulations show that our algorithms are efficient and scalable. Finally, we have integrated our solutions into an architecture that is under ongoing standardization by the IETF and we have studied the protocol adaptations required for the deployment of our algorithms. Our work represents an important step towards more effective inter-domain traffic management in traffic engineered networks

Anläßlich des Festkolloquiums 60 Jahre Elektrische Bahnen stellt sich die Professur vor. Es wird ein Überblick zur Geschichte der Professur gegeben.

REROUTE SEQUENCE PLANNING IN MULTIPROTOCOL LABEL SWITCHING NETWORKS The growth of the Internet has caused the development of new protocols that enable IP networks to be engineered efficiently. One such protocol, Multiprotocol Label Switching (MPLS) enables IP datagrams in backbone networks to be forwarded based on the label switching forwarding paradigm. In MPLS networks, rerouting of Label Switching Paths (LSPs) can be needed in order to attain a better resource utilization in the network. In this case, a sequence of LSPs has to be found for their one by one reconfiguration without service interruption, involving the constraint that the link capacities should not be violated at any time during the rerouting process. This reroute sequence planning problem for LSPs is NP-complete. In previous works, the conditions of existence of any feasible reroute sequence are examined and algorithms are described for solving the problem, but it was shown that the problem is computationally hard in real-world situations because of the large amount of routers and LSPs in the network. In this work, we deal with the problem of reroute sequence planning problem of LSPs and present alternative solutions for the case when there is no feasible solution. We introduce a tool for the post-processing phase when a capacity violation is occurred during the sequence planning. We present an algorithm trying to reconfigure LSPs while allowing some interruption or degradation of traffic during the rerouting process.