Data Mining and Machine Learning for Analysis of Network Traffic

Transcription

1 Data Miig ad Machie Learig for Aalysis of Network Traffic Ljiljaa Trajković Commuicatio Networks Laboratory School of Egieerig Sciece Simo Fraser Uiversity, Vacouver, British Columbia Caada

2 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 2

3 lhr: 535,102 odes ad 601,678 liks December 27, 2017 City Uiversity of Hog Kog, Hog Kog 3

4 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 4

5 Measuremets of etwork traffic Traffic measuremets: help uderstad characteristics of etwork traffic are basis for developig traffic models are used to evaluate performace of protocols ad applicatios Traffic aalysis: provides iformatio about the etwork usage helps uderstad the behavior of etwork users Traffic predictio: importat to assess future etwork capacity requiremets used to pla future etwork developmets December 27, 2017 City Uiversity of Hog Kog, Hog Kog 5

6 Traffic modelig: self-similarity Self-similarity implies a fractal-like behavior Data o various time scales have similar patters Implicatios: o atural legth of bursts bursts exist across may time scales traffic does ot become smoother whe aggregated (ulike Poisso traffic) it is ulike Poisso traffic used to model traffic i telephoe etworks as the traffic volume icreases, the traffic becomes more bursty ad more self-similar December 27, 2017 City Uiversity of Hog Kog, Hog Kog 6

7 Self-similarity Self-similarity implies a fractal-like behavior: data o various time scales have similar patters A wide-sese statioary process X() is called (exactly secod order) self-similar if its autocorrelatio fuctio satisfies: r (m) (k) = r(k), k 0, m = 1, 2,,, where m is the level of aggregatio December 27, 2017 City Uiversity of Hog Kog, Hog Kog 7

8 Self-similar processes Properties: slowly decayig variace log-rage depedece Hurst parameter (H) Processes with oly short-rage depedece (Poisso): H = 0.5 Self-similar processes: 0.5 < H < 1.0 As the traffic volume icreases, the traffic becomes more bursty, more self-similar, ad the Hurst parameter icreases December 27, 2017 City Uiversity of Hog Kog, Hog Kog 8

9 Self-similarity: ifluece of time-scales Geuie MPEG traffic trace E+06 5.E E+05 4.E+06 bits/time uit bits/time uit 6.E+05 4.E+05 bits/time uit 3.E+06 2.E E+05 1.E time uit = 160 ms (4 frames) 0.E time uit = 640 ms (16 frames) 0.E time uit = 2560 ms (64 frames) W. E. Lelad, M. S. Taqqu, W. Williger, ad D. V. Wilso, O the self-similar ature of Etheret traffic (exteded versio), IEEE/ACM Tras. Netw., vol. 2, o 1, pp. 1-15, Feb December 27, 2017 City Uiversity of Hog Kog, Hog Kog 9

10 Self-similarity: ifluece of time-scales Sythetically geerated Poisso model E+06 5.E E+05 4.E+06 bits/time uit bits/time uit 6.E+05 4.E+05 bits/time uit 3.E+06 2.E E+05 1.E time uit = 160 ms (4 frames) 0.E time uit = 640 ms (16 frames) 0.E time uit = 2560 ms (64 frames) W. E. Lelad, M. S. Taqqu, W. Williger, ad D. V. Wilso, O the self-similar ature of Etheret traffic (exteded versio), IEEE/ACM Tras. Netw., vol. 2, o 1, pp. 1-15, Feb December 27, 2017 City Uiversity of Hog Kog, Hog Kog 10

11 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 11

12 Case study: BCNET BCNET is the hub of advaced telecommuicatio etwork i British Columbia, Caada that offers services to research ad higher educatio istitutios The BCNET etwork is high-speed fiber optic research etwork British Columbia's etwork exteds to 1,400 km ad coects Kamloops, Kelowa, Price George, Vacouver, ad Victoria December 27, 2017 City Uiversity of Hog Kog, Hog Kog 12

13 BCNET packet capture December 27, 2017 City Uiversity of Hog Kog, Hog Kog 13

14 BCNET packet capture BCNET trasits have two service providers with 10 Gbps etwork liks ad oe service provider with 1 Gbps etwork lik Optical Test Access Poit (TAP) splits the sigal ito two distict paths The sigal splittig ratio from TAP may be modified The Data Capture Device (NijaBox 5000) collects the real-time data (packets) from the traffic filterig device December 27, 2017 City Uiversity of Hog Kog, Hog Kog 14

15 Net Optics Director 7400: applicatio diagram Net Optics Director 7400 is used for BCNET traffic filterig It directs traffic to moitorig tools such as NijaBox 5000 ad FlowMo December 27, 2017 City Uiversity of Hog Kog, Hog Kog 15

16 Network moitorig ad aalyzig: Edace card Edace Data Acquisitio ad Geeratio (DAG) 5.2X card resides iside the NijaBox 5000 It captures ad trasmits traffic ad has time-stampig capability DAG 5.2X is a sigle port Peripheral Compoet Itercoect Exteded (PCIx) card ad is capable of capturig o average Etheret traffic of 6.9 Gbps December 27, 2017 City Uiversity of Hog Kog, Hog Kog 16

17 Real time etwork usage by BCNET members December 27, 2017 City Uiversity of Hog Kog, Hog Kog 17

18 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 18

19 Case study: E-Comm etwork E-Comm etwork: a operatioal truked radio system servig as a regioal emergecy commuicatio system The E-Comm etwork is capable of both voice ad data trasmissios Voice traffic accouts for over 99% of etwork traffic A group call is a stadard call made i a truked radio system More tha 85% of calls are group calls A distributed evet log database records every evet occurrig i the etwork: call establishmet, chael assigmet, call drop, ad emergecy call December 27, 2017 City Uiversity of Hog Kog, Hog Kog 19

20 E-Comm etwork December 27, 2017 City Uiversity of Hog Kog, Hog Kog 20

21 E-Comm etwork architecture Users Trasmitters/Repeaters PSTN PBX Dispatch cosole * 8 # Vacouver I B M Network switch Other EDACS systems Buraby Database server Data gateway Maagemet cosole December 27, 2017 City Uiversity of Hog Kog, Hog Kog 21

22 Traffic data 2001 data set: 2 days of traffic data to (110,348 calls) 2002 data set: 28 days of cotiuous traffic data to (1,916,943 calls) 2003 data set: 92 days of cotiuous traffic data to (8,756,930 calls) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 22

23 Observatios Presece of daily cycles: miimum utilizatio: ~ 2 PM maximum utilizatio: 9 PM to 3 AM 2002 sample data: cell 5 is the busiest others seldom reach their capacities 2003 sample data: several cells (2, 4, 7, ad 9) have all chaels occupied durig busy hours December 27, 2017 City Uiversity of Hog Kog, Hog Kog 23

24 Call arrival rate i 2002 ad 2003: cyclic patters Number of calls Time (hours) 2002 Data 2003 Data the busiest hour is aroud midight the busiest day is Thursday Number of calls 12 x 104 Sat. Su. Mo. Tue. Wed. Thu. Fri. Time (days) useful for schedulig periodical maiteace tasks Data 2003 Data December 27, 2017 City Uiversity of Hog Kog, Hog Kog 24

25 Modelig ad characterizatio of traffic We aalyzed voice traffic from a public safety wireless etwork i Vacouver, BC call iter-arrival ad call holdig times durig five busy hours from each year (2001, 2002, 2003) Statistical distributio ad the autocorrelatio fuctio of the traffic traces: Kolmogorov-Smirov goodess-of-fit test autocorrelatio fuctios wavelet-based estimatio of the Hurst parameter B. Vujičić, N. Cackov, S. Vujičić, ad Lj. Trajković, Modelig ad characterizatio of traffic i public safety wireless etworks, i Proc. SPECTS 2005, Philadelphia, PA, July 2005, pp December 27, 2017 City Uiversity of Hog Kog, Hog Kog 25

26 Erlag traffic models Erlag B Erlag C N N A A N P N! B = P! N x C = N N A N 1 x N A A A N + x! x! N! N A x= 0 x= 0 P B : probability of rejectig a call P c : probability of delayig a call N : umber of chaels/lies A : total traffic volume December 27, 2017 City Uiversity of Hog Kog, Hog Kog 26

27 Hourly traces Call holdig ad call iter-arrival times from the five busiest hours i each dataset (2001, 2002, ad 2003) Day/hour No. Day/hour No. Day/hour No :00 16: :00 01: :00 17: :00 20: :00 21:00 3,718 3,707 3,492 3,312 3, :00 05: :00 23: :00 24: :00 01: :00 01:00 4,436 4,314 4,179 3,971 3, :00 23: :00 24: :00 24: :00 03: :00 02:00 4,919 4,249 4,222 4,150 4,097 December 27, 2017 City Uiversity of Hog Kog, Hog Kog 27

28 Statistical distributios Fourtee cadidate distributios: expoetial, Weibull, gamma, ormal, logormal, logistic, log-logistic, Nakagami, Rayleigh, Ricia, t-locatio scale, Birbaum-Sauders, extreme value, iverse Gaussia Parameters of the distributios: calculated by performig maximum likelihood estimatio Best fittig distributios are determied by: visual ispectio of the distributio of the trace ad the cadidate distributios Kolmogorov-Smirov test of potetial cadidates December 27, 2017 City Uiversity of Hog Kog, Hog Kog 28

29 Call iter-arrival times: pdf cadidates Probability desity Traffic data Expoetial model Logormal model Weibull model Gamma model Rayleigh model Normal model Call iter-arrival time (s) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 29

30 Call iter-arrival times: K-S test results (2003 data) Distributio Expoetial Weibull Gamma Logormal Parameter , 22:00 23: , 23:00 24: , 23:00 24: , 02:00 03: , 01:00 02:00 h p k h p k h p k h p 1.015E E E E E-21 k December 27, 2017 City Uiversity of Hog Kog, Hog Kog 30

31 Call iter-arrival times: estimates of H Traces pass the test for time costacy of a: estimates of H are reliable Day/hour H Day/hour H Day/hour H :00 16: :00 01: :00 17: :00 20: :00 21: :00 05: :00 23: :00 24: :00 01: :00 01: :00 23: :00 24: :00 24: :00 03: :00 02: December 27, 2017 City Uiversity of Hog Kog, Hog Kog 31

32 Call holdig times: pdf cadidates Probability desity Traffic data Logormal model Gamma model Weibull model Expoetial model Normal model Rayleigh model Call holdig time (s) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 32

33 Call holdig times: estimates of H All (except oe) traces pass the test for costacy of a oly oe ureliable estimate (*): cosistet value Day/hour H Day/hour H Day/hour H :00 16: :00 05: :00 23: :00 01: :00 23: :00 24: :00 17: :00 24: :00 24: * :00 20: :00 01: :00 03: :00 21: :00 01: :00 02: December 27, 2017 City Uiversity of Hog Kog, Hog Kog 33

34 Call iter-arrival ad call holdig times Day/hour Avg. (s) Day/hour Avg. (s) Day/hour Avg. (s) iter-arrival holdig 15:00 16: :00 05: :00 23: iter-arrival holdig 00:00 01: :00 23: :00 24: iter-arrival holdig 16:00 17: :00 24: :00 24: iter-arrival holdig 19:00 20: :00 01: :00 03: iter-arrival holdig 20:00 21: :00 01: :00 02: Avg. call iter-arrival times: 1.08 s (2001), 0.86 s (2002), 0.84 s (2003) Avg. call holdig times: 3.91 s (2001), 3.96 s (2002), 4.13 s (2003) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 34

35 Busy hour: best fittig distributios Distributio Busy hour Call iter-arrival times Call holdig times Weibull Gamma Logormal a b a b µ σ :00 16: :00 01: :00 17: :00 05: :00 23: :00 24: :00 23: :00 24: :00 24: December 27, 2017 City Uiversity of Hog Kog, Hog Kog 35

36 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 36

37 Case study: ChiaSat DirecPC system ChiaSat hybrid satellite etwork Employs geosychrous satellites deployed by Hughes Network Systems Ic. Provides data ad televisio services: DirecPC (Classic): uidirectioal satellite data service DirecTV: satellite televisio service DirecWay (Hughet): ew bi-directioal satellite data service that replaces DirecPC DirecPC trasmissio rates: 400 kb/s from satellite to user 33.6 kb/s from user to etwork operatios ceter (NOC) usig dial-up Improves performace usig TCP splittig with spoofig December 27, 2017 City Uiversity of Hog Kog, Hog Kog 37

38 ChiaSat DirecPC system December 27, 2017 City Uiversity of Hog Kog, Hog Kog 38

39 Network ad traffic data ChiaSat: etwork architecture ad TCP Aalysis of billig records: aggregated traffic user behavior Aalysis of tcpdump traces: geeral characteristics TCP optios ad operatig system (OS) figerpritig etwork aomalies December 27, 2017 City Uiversity of Hog Kog, Hog Kog 39

40 ChiaSat data: aalysis Traffic predictio: autoregressive itegrative movig average (ARIMA) was successfully used to predict uploaded traffic (but ot dowloaded traffic) wavelet + autoregressive model outperforms the ARIMA model Q. Shao ad Lj. Trajkovic, Measuremet ad aalysis of traffic i a hybrid satellite-terrestrial etwork, Proc. SPECTS 2004, Sa Jose, CA, July 2004, pp December 27, 2017 City Uiversity of Hog Kog, Hog Kog 40

41 Aalysis of collected data Aalysis of patters ad statistical properties of two sets of data from the ChiaSat DirecPC etwork: billig records tcpdump traces Billig records: daily ad weekly traffic patters user classificatio: sigle ad multi-variable k-meas clusterig based o average traffic hierarchical clusterig based o user activity December 27, 2017 City Uiversity of Hog Kog, Hog Kog 41

42 ChiaSat data: aalysis ChiaSat traffic is self-similar ad o-statioary Hurst parameter differs depedig o traffic load Modelig of TCP coectios: iter-arrival time is best modeled by the Weibull distributio umber of dowloaded bytes is best modeled by the logormal distributio The distributio of visited websites is best modeled by the discrete Gaussia expoetial (DGX) distributio December 27, 2017 City Uiversity of Hog Kog, Hog Kog 42

43 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 43

44 Iteret topology Iteret is a etwork of Autoomous Systems: groups of etworks sharig the same routig policy idetified with Autoomous System Numbers (ASN) Autoomous System Numbers: assigmets/as-umbers Iteret topology o AS-level: the arragemet of ASes ad their itercoectios Aalyzig the Iteret topology ad fidig properties of associated graphs rely o miig data ad capturig iformatio about Autoomous Systems (ASes) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 44

45 Variety of graphs Radom graphs: odes ad edges are geerated by a radom process Erdős ad Réyi model Small world graphs: odes ad edges are geerated so that most of the odes are coected by a small umber of odes i betwee Watts ad Strogatz model (1998) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 45

46 Scale-free graphs Scale-free graphs: graphs whose ode degree distributio follow power-law rich get richer Barabási ad Albert model (1999) Aalysis of complex etworks: discovery of spectral properties of graphs costructig matrices describig the etwork coectivity December 27, 2017 City Uiversity of Hog Kog, Hog Kog 46

47 Aalyzed datasets Sample datasets: Route Views: TABLE_DUMP B / IGP : : : :3000 NAG RIPE: TABLE_DUMP B / IGP : :3010 NAG December 27, 2017 City Uiversity of Hog Kog, Hog Kog 47

48 Iteret topology at AS level Datasets collected from Border Gateway Protocols (BGP) routig tables are used to ifer the Iteret topology at AS-level December 27, 2017 City Uiversity of Hog Kog, Hog Kog 48

49 Iteret topology The Iteret topology is characterized by the presece of various power-laws: ode degree vs. ode rak eigevalues of the matrices describig Iteret graphs (adjacecy matrix ad ormalized Laplacia matrix) Power-laws expoets have ot sigificatly chaged over the years Spectral aalysis reveals ew historical treds ad otable chages i the coectivity ad clusterig of AS odes over the years December 27, 2017 City Uiversity of Hog Kog, Hog Kog 49

50 Traffic aomalies Slammer, Nimda, ad Code Red I aomalies affected performace of the Iteret Border Gateway Protocol (BGP) BGP aomalies also iclude: Iteret Protocol (IP) prefix hijacks, miss-cofiguratios, ad electrical failures Techiques for detectig BGP aomalies have recetly gaied visible attetio ad importace December 27, 2017 City Uiversity of Hog Kog, Hog Kog 50

51 Aomaly detectio techiques Classificatio problem: assigig a aomaly or regular label to a data poit Accuracy of a classifier depeds o: extracted features combiatio of selected features uderlyig model Goal: Detect Iteret routig aomalies usig the Border Gateway Protocol (BGP) update messages December 27, 2017 City Uiversity of Hog Kog, Hog Kog 51

52 BGP features Approach: Defie a set of 37 features based o BGP update messages Extract the features from available BGP update messages that are collected durig the time period whe the Iteret experieced aomalies: Slammer Nimda Code Red I December 27, 2017 City Uiversity of Hog Kog, Hog Kog 52

53 Feature selectio Select the most relevat features for classificatio usig: Fisher Miimum Redudacy Maximum Relevace (mrmr) Odds Ratio Decisio Tree Fuzzy Rough Sets December 27, 2017 City Uiversity of Hog Kog, Hog Kog 53

54 Aomaly classificatio Trai classifiers for BGP aomaly detectio usig: Support Vector Machies (SVM) Log Short-Term Memory (LSTM) Neural Network Hidde Markov Models (HMM) Naive Bayes (NB) Decisio Tree Extreme Learig Machie (ELM) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 54

55 Feature extractio: BGP messages Border Gateway Protocol (BGP) eables exchage of routig iformatio betwee gateway routers usig update messages BGP update message collectios: Réseaux IP Europées (RIPE) uder the Routig Iformatio Service (RIS) project Route Views Available i multi-threaded routig toolkit (MRT) biary format December 27, 2017 City Uiversity of Hog Kog, Hog Kog 55

56 BGP: kow aomalies Aomaly Date Duratio (mi) Slammer Jauary 25, Nimda September 18-20, ,521 Code Red I July 19, Evet Date Peers Moscow power blackout May 2005 AS 1853, AS 12793, AS AS 9121 routig table leak Dec AS 1853, AS 12793, AS AS 3561 improper filterig Apr AS 3257, AS 3333, AS 286 Paix domai hijack Ja AS 12956, AS 6762, AS 6939, AS 3549 As-path error Oct AS 3257, AS 3333, AS 6762, AS 9057 AS 3356/AS 714 de-peerig Oct AS 13237, AS 8342, AS 5511, AS December 27, 2017 City Uiversity of Hog Kog, Hog Kog 56

57 Traiig ad test datasets Dataset Traiig dataset Test dataset 1 Slammer ad Nimda Code Red I 2 Slammer ad Code Red I Nimda 3 Nimda ad Code Red I Slammer 4 Slammer Nimda ad Code Red I 5 Nimda Slammer ad Code Red I 6 Code Red I Slammer ad Nimda 7 Slammer, Nimda, ad Code Red I RIPE or BCNET December 27, 2017 City Uiversity of Hog Kog, Hog Kog 57

58 Slammer worm Seds its replica to radomly geerated IP addresses Destiatio IP address gets ifected if: or it is a Microsoft SQL server a persoal computer with the Microsoft SQL Server Data Egie (MSDE) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 58

59 Nimda worm Propagates through messages, web browsers, ad file systems Viewig the message triggers the worm payload The worm modifies the cotet of the web documet files i the ifected hosts ad copies itself i all local host directories December 27, 2017 City Uiversity of Hog Kog, Hog Kog 59

60 Code Red I worm Takes advatage of vulerability i the Microsoft Iteret Iformatio Services (IIS) idexig software It triggers a buffer overflow i the ifected hosts by writig to the buffers without checkig their limit December 27, 2017 City Uiversity of Hog Kog, Hog Kog 60

61 Feature extractio: BGP messages Defie 37 features Sample every miute durig a five-day period: the peak day of a aomaly two days prior ad two days after the peak day 7,200 samples for each aomalous evet: 5,760 regular samples (o-aomalous) 1,440 aomalous samples Imbalaced dataset December 27, 2017 City Uiversity of Hog Kog, Hog Kog 61

62 BGP features Feature Defiitio Category 1 Number of aoucemets Volume 2 Number of withdrawals Volume 3 Number of aouced NLRI prefixes Volume 4 Number of withdraw NLRI prefixes Volume 5 Average AS-PATH legth AS-path 6 Maximum AS-PATH legth AS-path 7 Average uique AS-PATH legth AS-path 8 Number of duplicate aoucemets Volume 9 Number of duplicate withdrawals Volume 10 Number of implicit withdrawals Volume December 27, 2017 City Uiversity of Hog Kog, Hog Kog 62

63 BGP features Feature Defiitio Category 11 Average edit distace AS-path 12 Maximum edit distace AS-path 13 Iter-arrival time Maximum edit distace =, where = (7,..., 17) Maximum AS-path legth =, where = (7,..., 15) Volume AS-path AS-path 34 Number of IGP packets Volume 35 Number of EGP packets Volume 36 Number of icomplete packets Volume 37 Packet size (B) Volume December 27, 2017 City Uiversity of Hog Kog, Hog Kog 63

64 Feature selectio algorithms Employed to select the most relevat features: Fisher Miimum Redudacy Maximum Relevace (mrmr) Odds Ratio Decisio Tree Fuzzy Rough Sets December 27, 2017 City Uiversity of Hog Kog, Hog Kog 64

65 Feature selectio: decisio tree Dataset Traiig data Selected Features Dataset 1 Slammer + Nimda 1 21, 23 29, Dataset 2 Slammer + Code Red I 1 22, 24 29, Dataset 3 Code Red I + Nimda 1 29, Either four (30, 31, 32, 33) or five (22, 30, 31, 32, 33) features are removed i the costructed trees maily because: features are umerical ad some are used repeatedly December 27, 2017 City Uiversity of Hog Kog, Hog Kog 65

66 Aomaly classificatio Trai classifiers for BGP aomaly detectio usig: Support Vector Machies (SVM) Log Short-Term Memory (LSTM) Neural Network Hidde Markov Models (HMM) Naive Bayes (NB) Decisio Tree Extreme Learig Machie (ELM) December 27, 2017 City Uiversity of Hog Kog, Hog Kog 66

67 Aomaly classifiers: LSTM Repeatig modules for the LSTM eural etwork: iput layer, LSTM layer with oe LSTM cell, ad output layer. December 27, 2017 City Uiversity of Hog Kog, Hog Kog 67

68 Aomaly classifiers: LSTM Accuracy (%) F-Score (%) Test dataset RIPE BCNET Test dataset LSTMu 1 Code Red I LSTMu 2 Nimda LSTMu 3 Slammer Accuracy (%) F-Score (%) Test dataset RIPE BCNET Test dataset LSTMb 1 Code Red I LSTMb 2 Nimda LSTMb 3 Slammer December 27, 2017 City Uiversity of Hog Kog, Hog Kog 68

69 Aomaly classifiers: decisio tree Accuracy (%) F-Score (%) Traiig dataset Test dataset RIPE BCNET Test dataset Dataset 1 Code Red I Dataset 2 Nimda Dataset 3 Slammer Each path from the root ode to a leaf ode may be trasformed ito a decisio rule A set of rules that are obtaied from a traied decisio tree may be used for classifyig usee samples December 27, 2017 City Uiversity of Hog Kog, Hog Kog 69

70 Roadmap Itroductio Traffic collectio, characterizatio, ad modelig Case studies: telecommuicatio etwork: BCNET public safety wireless etwork: E-Comm satellite etwork: ChiaSat packet data etworks: Iteret Coclusios December 27, 2017 City Uiversity of Hog Kog, Hog Kog 70

71 Coclusios Data collected from deployed etworks are used to: evaluate etwork performace characterize ad model traffic (iter-arrival ad call holdig times) idetify treds i the evolutio of the Iteret topology classify traffic ad etwork aomalies December 27, 2017 City Uiversity of Hog Kog, Hog Kog 71

72 Refereces: sources of data RIPE RIS raw data [Olie]. Available: Uiversity of Orego Route Views project [Olie]. Available: CAIDA: Ceter for Applied Iteret Data Aalysis: [Olie]. Available: December 27, 2017 City Uiversity of Hog Kog, Hog Kog 72

73 Refereces: Q. Dig, Z. Li, S. Haeri, ad Lj. Trajkovic, Applicatio of machie learig techiques to detectig aomalies i commuicatio etworks: Datasets ad Feature Selectio Algorithms i Cyber Threat Itelligece, M. Coti, A. Dehghataha, ad T. Dargahi, Eds., Berli: Spriger, to appear. Q. Dig, Z. Li, S. Haeri, ad Lj. Trajkovic, Applicatio of machie learig techiques to detectig aomalies i commuicatio etworks: Classificatio Algorithms i Cyber Threat Itelligece, M. Coti, A. Dehghataha, ad T. Dargahi, Eds., Berli: Spriger, to appear. Q. Dig, Z. Li, P. Batta, ad Lj. Trajkovic, "Detectig BGP aomalies usig machie learig techiques," i Proc. IEEE Iteratioal Coferece o Systems, Ma, ad Cyberetics (SMC 2016), Budapest, Hugary, Oct. 2016, pp M. Cosovic, S. Obradovic, ad Lj. Trajkovic, "Classifyig aomalous evets i BGP datasets," i Proc. The 29th Aual IEEE Caadia Coferece o Electrical ad Computer Egieerig (CCECE 2016), Vacouver, Caada, May 2016, pp M. Cosovic, S. Obradovic, ad Lj. Trajković, Performace evaluatio of BGP aomaly classifiers, i Proc. The Third Iteratioal Coferece o Digital Iformatio, Networkig, ad Wireless Commuicatios, DINWC 2015, Moscow, Russia, Feb. 2015, pp December 27, 2017 City Uiversity of Hog Kog, Hog Kog 73

74 Refereces: Y. Li, H. J. Xig, Q. Hua, X.-Z. Wag, P. Batta, S. Haeri, ad Lj. Trajković, Classificatio of BGP aomalies usig decisio trees ad fuzzy rough sets, i Proc. IEEE Iteratioal Coferece o Systems, Ma, ad Cyberetics, SMC 2014, Sa Diego, CA, October 2014, pp T. Farah ad Lj. Trajkovic, "Aoym: a tool for aoymizatio of the Iteret traffic," i Proc IEEE Iteratioal Coferece o Cyberetics, CYBCONF 2013, Lausae, Switzerlad, Jue 2013, pp N. Al-Rousa, S. Haeri, ad Lj. Trajković, Feature selectio for classificatio of BGP aomalies usig Bayesia models," i Proc. Iteratioal Coferece o Machie Learig ad Cyberetics, ICMLC 2012, Xi'a, Chia, July 2012, pp N. Al-Rousa ad Lj. Trajković, Machie learig models for classificatio of BGP aomalies, i Proc. IEEE Cof. High Performace Switchig ad Routig, HPSR 2012, Belgrade, Serbia, Jue 2012, pp T. Farah, S. Lally, R. Gill, N. Al-Rousa, R. Paul, D. Xu, ad Lj. Trajković, Collectio of BCNET BGP traffic," i Proc. 23rd ITC, Sa Fracisco, CA, USA, Sept. 2011, pp S. Lally, T. Farah, R. Gill, R. Paul, N. Al-Rousa, ad Lj. Trajković, Collectio ad characterizatio of BCNET BGP traffic," i Proc IEEE Pacific Rim Cof. Commuicatios, Computers ad Sigal Processig, Victoria, BC, Caada, Aug. 2011, pp December 27, 2017 City Uiversity of Hog Kog, Hog Kog 74

75 lhr: 535,102 odes ad 601,678 liks December 27, 2017 City Uiversity of Hog Kog, Hog Kog 75