Anomaly detection of network traffic based on autocorrelation principle

Network anomalies caused by network attacks can significantly degrade or even terminate network services. A Real-time and reliable detection of anomalies is essential to rapid anomaly diagnosis, anomaly mitigation, and malfunction recovering. Unlike most detection methods based on the statistical analysis of the packet headers （Such as IP addresses and ports）, a new approach only using network traffic volumes is proposed to detect anomalies reliably. Our method is based on autocorrelation function to judge whether anomalies have happened. In details, the correlation coefficients of normal and anomaly data fluctuate slightly respectively, while those of the overlapped data composed of them fluctuate greatly. Experimental results on network traffic volumes transformed from 1999 DARPA intrusion evaluation data set show that this method can effectively detect network anomalies, while avoiding the high false alarms rate.     

Analysis of YouTube’s traffic adaptation to dynamic environments

The popular Internet service, YouTube, has adopted by default the HyperText Markup Language version 5 (HTML5). With this adoption, YouTube has moved to Dynamic Adaptive Streaming over HTTP (DASH) as Adaptive BitRate (ABR) video streaming technology. Furthermore, rate adaptation in DASH is solely receiver-driven. This issue motivates this work to make a deep analysis of YouTube’s particular DASH implementation. Firstly, this article provides a state of the art about DASH and adaptive streaming technology, and also YouTube traffic characterization related work. Secondly, this paper describes a new methodology and test-bed for YouTube’s DASH implementation traffic characterization and performance measurement. This methodology and test-bed do not make use of proxies and, moreover, they are able to cope with YouTube traffic redirections. Finally, a set of experimental results are provided, involving a dataset of 310 YouTube’s videos. The depicted results show a YouTube’s traffic pattern characterization and a discussion about allowed download bandwidth, YouTube’s consumed bitrate and quality of the video. Moreover, the obtained results are cross-validated with the analysis of HTTP requests performed by YouTube’s video player. The outcomes of this article are applicable in the field of Quality of Service (QoS) and Quality of Experience (QoE) management. This is valuable information for Internet Service Providers (ISPs), because QoS management based on assured download bandwidth can be used in order to provide a target end-user’s QoE when YouTube service is being consumed.     

Sub-optimal control with observer of a two-lane highway traffic flow†

This paper deals with the optimum control of traffic flow on a two-lane highway, in the macroscopic, and thus deterministic, theory. For the ease of the reader, the nonlinear partial differential equations of the system are first straightforwardly derived from the well-known equation of conservation of vehicles. Then the system is linearized around a nominal trajectory and the problem is defined as the optimum control of the deviation of the system from this nominal state. To Bolve this problem the state of the system is expanded as a series of complete orthogonal function, and in this way the initial linear distributed system is converted into an infinite-dimensional linear system with lumped parameter. A 2N-order truncated version is considered (therefore the sub-optimal approach) and the theory of the observer is applied when the number of available observation measurements is less than the order of the system. Considerations on the practical implementation of the control system are given.     

Helicopter pilots’ views of air traffic controller responsibilities: a mismatch

Abstract

Controllers and pilots must work together to ensure safe and efficient helicopter flight within the London control zone. Subjective ratings of pilot perception of controller responsibility for five key flight tasks were obtained from thirty helicopter pilots. Three types of airspace were investigated. Results indicate that there is variation in pilot understanding of controller responsibility compared to the formal regulations that define controller responsibility. Significant differences in the perception of controller responsibility were found for the task of aircraft separation in class D airspace and along helicopter routes. Analysis of the patterns of response suggests that task type rather than the airspace type may be the key factor. Results are framed using the concept of a shared mental model. This research demonstrates that pilots flying in complex London airspace have an expectation of controller responsibility for certain flight tasks, in certain airspace types that is not supported by aviation regulation.

Practitioner Summary: The responsibility for tasks during flight varies according to the flight rules used and airspace type. Helicopter pilots may attribute responsibility to controllers for tasks when controllers have no responsibility as defined by regulation. This variation between pilot perceptions of controller responsibility could affect safety within the London control zone.     

A game–theoretic analysis of the implications of overlay network traffic on ISP peering

Inter-ISP traffic flow determines the settlement between ISPs and affects the perceived performance of ISP services. In today’s Internet, the inter-ISP traffic flow patterns are controlled not only by ISPs’ policy-based routing configuration and traffic engineering, but also by application layer routing. The goal of this paper is to study the economic implications of this shift in Internet traffic control assuming rational ISPs and subscribers. For this purpose, we build a general traffic model that predicts traffic patterns based on subscriber distribution and abstract traffic controls such as caching functions and performance sensitivity functions. We also build a game–theoretic model of subscribers picking ISPs, and ISPs making provisioning and peering decisions. In particular, we apply this to a local market where two ISPs compete for market share of subscribers under two traffic patterns: “Web” and “P2P overlay”, that typifies the transition the current Internet is going through. Our methodology can be used to quantitatively demonstrate that (1) while economy of scale is the predominant property of the competitive ISP market, P2P traffic may introduce unfair distribution of peering benefit (i.e. free-riding); (2) the large ISP can restore more fairness by reducing its private capacity (bandwidth throttling), which has the drawback of hurting business growth; and (3) ISPs can reduce the level of peering (e.g. by reducing peering bandwidth) to restore more fairness, but this has the side-effect of also reducing the ISPs’ collective bargaining power towards subscribers.     

Analysis of the performance characteristics of controllers’ strategies in en route air traffic control tasks

For addressing human factor issues in the air traffic control (ATC) domain, further comprehension of controllers’ working methods during actual work is required. The objective of the present research is to analyze the performance characteristics of control strategies, which can be a major means to manage a traffic situation and workload for controllers, by using our process visualization tool of ATC tasks called COMPASi (COMPAS in interactive mode/COMPAS: COgnitive system Model for simulating Projection-based behaviors of Air traffic controllers in dynamic Situations). The computer-based simulation using COMPASi has clearly demonstrated the performance differences in the types of control strategies derived from a high-fidelity human-in-the-loop simulation (HITLS) for safety, efficiency of completing ATC tasks, and fuel economy of aircraft in a specific situation, and also differences in their tolerance of situational variability. The analysis results have been supported by performance evaluations carried out by ATC training instructors. In addition, a comparative analysis between simulation results under several simulation conditions by COMPASi and evaluation results by the instructor has strongly implied that the tolerance for the variability of situations might be a major factor in selection of control strategies by a controller. These contributions of the present research may be useful for practical purposes such as further improvement of education and training for controllers.     

Robust identification for multi-section freeway traffic models

1IntroductionIt is important to estimate the densityandspeed oftrafficfor the safetyandtraffic control .For decades ,manyresearchwork have been done to estimate traffic density, trafficvolume ,average speed,and other parameters[1,2] .Theproblemof estimating dynamic traffic has been involved inparts of those research work[1 ~4] .By means of O_Dmatrix,some researchers have also made a series of studiesof traffic prediction and traffic layout estimation[5] .However , most of the research work m…     

Is three the magic number? The role of ergonomic principles in cross country comprehension of road traffic signs

Abstract

Road sign comprehension plays an important part in road safety management, particularly for those drivers who are travelling in an unfamiliar country. Previous research has established that comprehension can be improved if signs are designed to adhere to ergonomic principles. However, it may be difficult for sign designers to incorporate all the principles into a single sign and may thus have to make a judgement as to the most effective ones. This study surveyed drivers in three countries to ascertain their understanding of a range of road signs, each of which conformed in varying degrees and combinations to the ergonomic principles. We found that using three of the principles was the most effective and that the most important one was that relating to standardisation; the colours and shapes used were key to comprehension. Other concepts which related to physical and spatial characteristics were less important, whilst conceptual compatibility did not aid comprehension at all.

Practitioner Summary: This study explores how road sign comprehension can be improved using ergonomic principles, with particular reference to cross-border drivers. It was found that comprehension can be improved significantly if standardisation is adhered to and if at least three principles are used.     

Deploying a network of smart cameras for traffic monitoring on a “city kernel”

A relevant aspect when evaluating the city smartness is related to the innovative approach to urban traffic management. We present a system called city kernel, designed to handle several subsystems, each addressing a specific sensor network and we describe an infrastructure for wide traffic control via a vision sensor network. This infrastructure consists of a network of smart cameras operating over an outdoor public lighting thanks to power line communication technology and equipped with a vehicle counting and classification algorithm. We discuss the deployment of this network on the city kernel and some related services exposed to urban actors.     

Characteristics of YouTube network traffic at a campus network – Measurements,models, and implications

User-Generated Content has become very popular since new web services such as YouTube allow for the distribution of user-produced media content. YouTube-like services are different from existing traditional VoD services in that the service provider has only limited control over the creation of new content. We analyze how content distribution in YouTube is realized and then conduct a measurement study of YouTube traffic in a large university campus network. Based on these measurements, we analyzed the duration and the data rate of streaming sessions, the popularity of videos, and access patterns for video clips from the clients in the campus network. The analysis of the traffic shows that trace statistics are relatively stable over short-term periods while long-term trends can be observed. We demonstrate how synthetic traces can be generated from the measured traces and show how these synthetic traces can be used as inputs to trace-driven simulations. We also analyze the benefits of alternative distribution infrastructures to improve the performance of a YouTube-like VoD service. The results of these simulations show that P2P-based distribution and proxy caching can reduce network traffic significantly and allow for faster access to video clips.     

Segment-based adaptive hyper-Erlang model for long-tailed network traffic approximation

Modeling the long-tailedness property of network traffic with phase-type distributions is a powerful means to facilitate the consequent performance evaluation and queuing based analysis. This paper improves the recently proposed Fixed Hyper-Erlang model (FHE) by introducing an adaptive framework (Adaptive Hyper-Erlang model, AHE) to determine the crucially performance-sensitive model parameters. The adaptive model fits long-tailed traffic data set directly with a mixed Erlang distribution in a new divide-and-conquer manner. Compared with the well-known hyperexponential based models and the Fixed Hyper-Erlang model, the Adaptive Hyper-Erlang model is more flexible and practicable in addition to its accuracy in fitting the tail behavior.

Changing the role of the air traffic controller: how will free flight affect memory for spatial events?

At present, air traffic controllers (ATCOs) exercise strict control over routing authority for aircraft movement in airspace. The onset of a free flight environment, however, may well result in a dramatic change to airspace jurisdictions, with aircraft movements for the large part being governed by aircrew, not ATCOs. The present study examined the impact of such changes on spatial memory for recent and non-recent locations of aircraft represented on a visual display. The experiment contrasted present conditions, in which permission for manoeuvres is granted by ATCOs, with potential free flight conditions, in which aircrew undertake deviations without explicit approval from ATCOs. Results indicated that the ATCO role adopted by participants impacted differently on short-term and long-term spatial representations of aircraft manoeuvres. Although informing participants of impending deviations has beneficial effects on spatial representations in the short term, long-term representations of spatial events are affected deleteriously by the presentation of subsequent information pertaining to other aircraft. This study suggests strongly that recognition of the perceptual and cognitive consequences of changing to a free flight environment is crucial if air safety is not to be jeopardized.     

Forecasting traffic flow with spatial–temporal convolutional graph attention networks

Neural Computing and Applications - Traffic flow prediction is crucial for intelligent transportation system, such as traffic management, congestion alleviation and public risk assessment....     

Do air pollution emissions and fuel consumption models for roadways include the effects of congestion in the roadway traffic flow?

Road transport emission and fuel consumption models are currently used extensively to predict levels of air pollution along roadway links and networks. This paper examines how, and to what extent, models which are currently used to predict emissions and fuel consumption from road traffic include the effects of congestion. A classification framework is presented in which a key factor, driving pattern, connects emissions to congestion. Prediction of the effects of different driving patterns in emission models is generally restricted to certain aspects of modelling, i.e. hot-running emissions of regulated pollutants. As a consequence, the effects of congestion are only partially incorporated in the predictions. The majority of emission models explicitly incorporate congestion in the modelling process, but for one important family of emission models, namely average speed models, this could not be determined directly. Re-examination of the (light-duty) driving patterns on which three average speed models (COPERT, MOBILE, EMFAC) are based, shows that it is likely that congestion is represented in these patterns. Since (hot-running) emission factors are based on these patterns, this implies that the emission factors used in these emission models also reflect different levels of congestion. Congestion is thus indirectly incorporated in these models. It is recommended, that, in order to get more accurate (local) emission predictions and to achieve correct application in particular situations, it is important to improve current average speed models by including a congestion algorithm, or alternatively, at least provide information on the level of congestion in the driving patterns on which these models are based and recommendations on what applications the models are suitable for.     

Perceptual control architecture for cyber–physical systems in traffic incident management

Based on Perceptual Control Theory, we study the problem of unified modeling for incompatible approaches of Cyber–Physical Systems (CPSs). Inspired by the effective organization of living systems structure accommodating heterogeneous information processing and environmental interaction, we propose Perceptual Control Architecture of CPSs, and take Traffic Incident Management systems as the modeling research carrier. Throughout the structure of Traffic Incident Management systems, the hierarchical negative feedback is constituted by perceptual and behavioral loops to ensure a mechanism of intelligence behavior. The internal representation is categorized into two intelligent spaces: physical-reflex space and cyber-virtual space. In physical-reflex space, the sensing-actuation mapping of objective world is built, through four levels of distributed traffic infrastructure. In cyber-virtual space, subjective decision using Bayesian reasoning network is defined by three levels: principles, interrelated factors and situation assessment. Through evaluation of field operation in Dalian, the Traffic Incident Management under the developed architecture shows a considerable reduction in response time as well as assessment inaccuracy. The test results explicated the effectiveness of the architecture on integrating complex Cyber–Physical functions. Besides transportation systems, the modeling approach could be a well-defined unified architecture applied to other CPSs.     

Comment on “A general model for long-tailed network traffic approximation”

The recent paper by Wang et al. (J. Supercomput. 38:155–172, 2006) proposed a Hyper Erlang model for long-tailed network traffic approximation. The paper argued that traditional models such as the Pareto, Weibull and log normal distributions are difficult to apply because of “their complex representations and theoretical properties”. The paper went on to say that the Pareto distribution “does not have analytic Laplace transform, and many other heavy-tailed distributions, such as Weibull and log normal also do not have closed-form Laplace transforms”. In the following, we would like to show that one can actually derive explicit expressions for Laplace transforms of heavy-tailed distributions. The next three sections provide explicit expressions for the Laplace transforms of the Pareto, Weibull and the log-normal distributions. To the best of our knowledge, these are the first known results on Laplace transforms of heavy-tailed distributions.

---

CTAC: Control traffic tunneling attacks’ countermeasures in mobile wireless networks

Multihop wireless ad hoc and sensor networks open the door for great networking opportunities especially in scenarios where it is infeasible or expensive to deploy significant networking infrastructure. However, the open communication media and the lack of networking infrastructure make these networks vulnerable to a wide range of security attacks. A particularly devastating attack is the control traffic tunneling attack, where a malicious node records control traffic at one location and tunnels it to a colluding node, possibly far away, which replays it locally. One of the control traffic attacks’ incarnations is the wormhole attack that can be used to prevent route establishment by preventing nodes from discovering legitimate routes that are more than two hops away. These attacks have been addressed by many researchers, however, most of the presented work is either limited to static scenarios, require expensive hardware or suffer from high overhead and performance degradation. In this paper, we present a scalable countermeasure for the control traffic tunneling attack, called CTAC, which alleviates these drawbacks and efficiently mitigates the attack in both static and mobile networks. CTAC uses trusted nodes called cluster heads (CH) for global tracking of node locations and profile keeping. Local monitoring is used to detect and isolate malicious nodes locally. Additionally, when sufficient suspicion builds up at a CH, it enforces a global isolation of the malicious node from the whole network. The performance gain, the relatively low overhead, and the positive impact of CTAC on the data traffic fidelity are brought out through analysis and extensive simulation using ns-2. The results show that CTAC achieves higher detection ratio and faster isolation time while considerably decreases the overhead energy and the end-to-end delay compared to the state-of-the art schemes.     

Adaptive Search Radius – Using hop count to reduce P2P traffic

Peer-to-Peer (P2P) file sharing accounts for a very significant part of the Internet’s traffic, affecting the performance of other applications and translating into significant peering costs for ISPs. It has been noticed that, just like WWW traffic, P2P file sharing traffic shows locality properties, which are not exploited by current P2P file sharing protocols.We propose a peer selection algorithm, Adaptive Search Radius (ASR), where peers exploit locality by only downloading from those other peers which are nearest (in network hops). ASR ensures swarm robustness by dynamically adapting the distance according to file part availability. ASR aims at reducing the Internet’s P2P file sharing traffic, while decreasing the download times perceived by users, providing them with an incentive to adopt this algorithm. We believe ASR to be the first locality-aware P2P file sharing system that does not require assistance from ISPs or third parties nor modification to the server infrastructure.We support our proposal with extensive simulation studies, using the eDonkey/eMule protocol on SSFNet. These show a 19 to 29% decrease in download time and a 27 to 70% reduction in the traffic carried by tier-1 ISPs. ASR is also compared (favourably) with Biased Neighbour Selection (BNS), and traffic shaping. We conclude that ASR and BNS are complementary solutions which provide the highest performance when combined. We evaluated the impact of P2P file sharing traffic on HTTP traffic, showing the benefits on HTTP performance of reducing P2P traffic.A plan for introducing ASR into eMule clients is also discussed. This will allow a progressive migration to ASR enabled versions of eMule client software.ASR was also successfully used to download from live Internet swarms, providing significant traffic savings while finishing downloads faster.     

Airborne traffic monitoring in large areas using LiDAR data – theory and experiments

This article investigates the theoretical background for airborne LiDAR (light detection and ranging) and ALS (airborne laser scanning) systems that are used to monitor traffic from airborne platforms. An object moving with a velocity deviating from the assumptions incorporated in the scanning process will generally appear both stretched and sheared – motion artefacts. To study the impact of these deformations on the ALS data, the analytic relations between an arbitrarily moving object and its conjugate in the ALS data have been examined and adapted to concrete airborne specifications. Furthermore, a complete scheme is proposed to analyse urban traffic in real-life situations, which combines vehicle detection successively with the motion classification method, which is the main focus of this article. Finally, the velocity of the moving vehicle can be derived with knowledge about the vehicle shape. The experimental results obtained by using real ALS data were assessed with respect to the reference data concurrently acquired by a video camera to validate the theory.