Characterizing network traffic behaviour using granule‐based association rule mining

Association rule mining is one important technique to characterize the behaviour of network traffic. However, mining association rules from network traffic data still have three obstacles such as efficiency, huge number of results and insufficiency to represent the behaviour of network traffic. Aiming to tackle these issues, this paper presents a granule‐based association rule mining approach, called association hierarchy mining. The proposed approach adopts top‐down rule mining strategy to directly generate interesting rules according to subjectively specified rule template hierarchies, which improves the efficiency of rule generation and subjectively filters user uninterested rules. The approach also proposes to prune a new type of redundant rules defined by this research to reduce the number of rules. Finally, the approach introduces the concept of diversity, aiming to select the interesting rules for better interpreting the behaviour of network traffic. The experiments performed on the MAWI network traffic traces show the efficiency and effectiveness of the proposed approach. Copyright © 2016 John Wiley & Sons, Ltd.     

HANDY: a hybrid association rules mining approach for network layer discovery of services for mobile ad hoc network

Mobile ad hoc network (MANET) is an infrastructure-less network formed between a set of mobile nodes. The discovery of services in MANET is a challenging job due to the unique properties of network. In this paper, a novel service discovery framework called hybrid association rules based network layer discovery of services for ad hoc networks (HANDY) has been proposed. HANDY provides three major research contributions. At first, it adopts a cross-layer optimized design for discovery of services that is based on simultaneous discovery of services and corresponding routes. Secondly, it provides a multi-level ontology-based approach to describe the services. This resolves the issue of semantic interoperability among the service consumers in a scalable fashion. Finally, to further optimize the performance of the discovery process, HANDY recommends exploiting the inherent associations present among the services. These associations are used in two ways. First, periodic service advertisements are performed based on these associations. In addition, when a response of a service discovery request is generated, correlated services are also attached with the response. The proposed service discovery scheme has been implemented in JIST/SWANS simulator. The results demonstrate that the proposed modifications give rise to improvement in hit ratio of the service consumers and latency of discovery process.     

A federated semi-supervised learning approach for network traffic classification

The classification of network traffic, which involves classifying and identifying the type of network traffic, is the most fundamental step to network service improvement and modern network management. Classic machine learning and deep learning methods have widely adopted in the field of network traffic classification. However, there are two major challenges in practice. One is the user privacy concern in cross-domain traffic data sharing for the purpose of training a global classification model, and the other is the difficulty to obtain large amount of labeled data for training. In this paper, we propose a novel approach using federated semi-supervised learning for network traffic classification, in which the federated server and clients from different domains work together to train a global classification model. Among them, unlabeled data are used on the client side, and labeled data are used on the server side. The experimental results derived from a public dataset show that the accuracy of the proposed approach can reach 97.81%, and the accuracy gap between the federated learning approach and the centralized training method is minimal.     

一种改进的隐私保护关联规则挖掘算法

隐私保护数据挖掘旨在不访问真实数据的情况下,获得隐藏在数据中的模式或规则。文中介绍隐私保护数据挖掘的几种算法。针对基于部分隐藏随机化回答数据隐私保护挖掘算法(RRPH)中使用多参数扰动数据后,K项集真实支持度计算时间成本高的弊端,提出基于粒度技术的部分隐藏随机化回答数据隐私保护挖掘算法(BRRPH)。该算法在RRPH算法的基础上,使用Bitmap表示技术粒度化数据,把支持度计算的数据处理方式转换成粒度计算的方式,项集真实支持度计算转变成了粒度的交集计算。实验表明在不改变准确性和隐私性的情况下,算法时间效率有大幅度的提高。     

A framework for characterizing disaster-based network survivability

This paper formulates a general framework that includes and extends the existing definitions for network survivability. Based on this framework, network survivability is characterized by a survivability function rather than a single-value survivability measure, and various quantities of interest can be derived from the function. Examples are the expected survivability, the worst-case survivability, the r-percentile survivability, and the probability of zero survivability. The survivability function is especially useful for the study of large-scale disasters. For illustration, the authors derive the survivability function in closed form for a simple ring network under link failures. They also discuss the general procedure for finding survivability functions for complex networks, and show that the survivability function reveals useful information about a network. This framework provides a unified and practical approach to analyzing and designing highly survivable communications networks     

A new hybrid constraint-based approach for 3G network planning

This letter proposes a novel constraint-based 3G network planning model and a novel hybrid approach for optimizing the 3G network planning problem. Computational results show that the model and the approach are more efficient than the mathematical model and the existing heuristics. Optimal solutions are always obtained for small and medium sized problems. For larger sized problems, the final results are on average within 5.77%-7.48% of the lower bounds. The proposed hybrid approach can be an efficient tool for tackling a wide range of combinatorial NP-hard problems.     

ODAM: An optimized distributed association rule mining algorithm

Association rule mining is an active data mining research area. However, most ARM algorithms cater to a centralized environment. In contrast to previous ARM algorithms, we have developed a distributed algorithm, called optimized distributed association mining, for geographically distributed data sets. ODAM generates support counts of candidate itemsets quicker than the other DARM algorithms and reduces the size of average transactions, data sets, and message exchanges.     

基于关联规则挖掘的无线电频谱占用预测

无线电频谱占用预测是认知无线电研究中的关键技术之一。实验采用中星世通CS-805 F可搬移监测测向系统对四川省成都市的GSM900上行频段(890~915 MHz)和广播电视业务的部分频段(750~806 MHz)进行了为期24 h的实地监测,针对频谱监测中产生的大量历史数据,选用了部分周期模式的关联规则挖掘方法,挖掘频谱使用中存在的频繁模式,并由信道占用频繁模式生成强关联规则,得到特定业务频段的使用规律,从而实现无线电频谱的占用预测。实验结果表明,该方法在两个业务频段的占用预测均取得了较好的效果,准确率分别可达74.02%和83.98%。另外,实验指出了该算法的敏感参数并进行了简要分析。实验对研究认知无线电设备实施动态频谱接入和提高频谱使用率有一定意义。     

基于FP-GROWTH算法的关联规则挖掘算法研究

互联网世界的数据每年都在成倍增长,但是对用户有用的信息却好像在减少,用户淹没在数据的海洋中,虽然类似于Google这样的搜索引擎可以帮用户找到需要的信息,但是正确率和查全率都不尽如人意。数据挖掘是兴起于20世纪90年代的一项用于决策支持的新技术。FP-GROWTH算法只进行2次数据库扫描。它不使用侯选集,直接压缩数据库成一个频繁模式树,最后通过这棵树生成关联规则。文章研究FP-GROWTH算法理论的同时实现了一个简单算法演示的系统。系统包括算法的执行,对数据库的修改、查询、删除的操作。最后,对FP-GROWTH算法和Apriori算法进行了比较。     

基于Spark的精准关联规则挖掘算法实现

为在大数据环境中精确地进行关联规则挖掘,基于分布式框架Spark,改进关联规则挖掘算法Apriori,解决使用该算法处理大规模数据时遇到的单机内存资源限制和性能缺陷,同时保证结果准确度。利用开源数据集和海量轨迹数据集评估算法的有效性,实验结果表明:与传统方法相比,改进后的Apriori算法进行规则挖掘能够得到相同准确度的结果,并且通过增加处理节点的数量灵活扩展待挖掘数据规模,从而使关联规则挖掘不再受数据规模限制。     

数据关联规则挖掘理论与数据算法的探讨

在众多不确定因素很强的数据中,如何挖掘数据是非常重要的,这时候关联规则挖掘理论就出现了.因此,在数据挖掘的领域中,关联规则有着突出的研究地位.本文从关联规则的产生背景和相关概念做出了论述.     

An adaptive network traffic prediction approach for LDoS attacks detection

Low‐rate denial of service (LDoS) attacks reduce throughput and degrade quality of service (QoS) of network services by sending out attack packets with relatively low average rate. LDoS attack flows are difficult to detect from normal traffic since it has the property of low average rate. The research on network traffic analysis and modeling shows that network traffic measurement data are irregular nonlinear time series. To characterize and analyze network traffic between attack and non‐attack situations, the adaptive normal and abnormal ν‐support vector regression (ν‐SVR) prediction models are constructed on the basis of the reconstructed phase space. In this paper, the dimension of reconstructed phase space for ν‐SVR is optimized by Bayesian information criteria method, and the parameter in the radial basis function is adaptively adjusted by minimizing the within‐class distance and maximizing the between‐class distance in the feature space. The nonthreshold decision function is obtained through calculating the prediction error of adaptive normal and abnormal ν‐SVR prediction models, which is adopted to detect LDoS attacks. Experiments in NS‐2 environment show that the adaptive ν‐SVR prediction model can effectively predict the network traffic measurement time series, and the probability distribution of time series generated by the adaptive ν‐SVR prediction model is quite similar to that of the network traffic measurement data. Experiments also clearly demonstrate the superiority of the proposed approach in LDoS attacks detection.     

基于云平台的并行关联规则挖掘算法分析

自云计算技术出现之后,数据挖掘技术取得了突破性发展。数据挖掘系统不仅实现了低成本、高效率运行,并且系统储存空间和系统可扩展性也在不断扩大,大大提高了数据挖掘效率。这里简要阐述了基于云平台的并行关联规则挖掘算法分析的研究意义,并对基于Hadoop的数据挖掘系统和数据算法设计进行了详细介绍。     

A heuristic approach for designing hybrid PONs employing WDM and OCDMA with asymmetric traffic distribution

In this paper we examine the resource provisioning aspects in a passive optical network (PON) employing wavelength-division multiplexing (WDM) and optical code-division multiple access (OCDMA) techniques. A judicious resource allocation scheme is proposed for a given set of optical codes and wavelengths with due consideration to the traffic asymmetry between upstream and downstream transmissions. The proposed scheme employs some initial heuristic estimates, followed by a subsequent open search mode towards reaching an optimal solution. The search mechanism in the provisioning scheme is carried out by employing some network performance metrics and evaluated using the appropriate analytical models.     

A hybrid envelope fluctuations reduction approach using multilayer neural network for MIMO-OFDM signals

One of the major drawback in multi-carrier signals is large envelope fluctuations i.e., high peak-to-average power ratio (PAPR). The objective of this paper is to propose neural network based active gradient project sequence, a computationally efficient hybrid method to reduce PAPR in multiple-input multiple-output orthogonal frequency division multiplexing system without sacrificing BER performance. In this paper, a neural network based trained module of approximate gradient project scheme (AGP-NN) is combined in parallel with partial transmit sequence method. The Levenberg–Marquardt training algorithm is used to train neural network based AGP module. The simulation results show that the proposed technique not only outperforms other conventional techniques but also offers less computational complexity.     

应用Aprion算法实现大规模数据库关联规则挖掘的技术研究

随着信息技术的发展,大数据时代的到来,在这种环境下必须进行数据挖掘工作。从大量的应用数据中将潜在的有价值的知识和信息挖掘出来,以便将其应用在实际工作的改进中。目前,数据挖掘的方法有很多,其中关联规则挖掘技术应用比较广泛,这种数据挖掘方式利用Aprion算法,挖掘出置信度和支持度均比较高的关联信息,反映出数据库中的数据相互之间的复杂性和有趣性,进而挖掘出数据之间的有益关联,促进大规模数据库信息挖掘技术的发展,主要从Aprion算法方面分析大规模数据库关联规则挖掘的技术。     

Analysis and modeling of traffic on a hybrid fiber-coax network

This paper presents the study carried out on the data traffic collected on the network of a cable operator based on hybrid fiber-coax technology, and the subsequent simulation model developed to predict the bandwidth requirements of the network channels. The paper starts with the analysis of the traffic measurements, taken over two periods of time in one year, on all the network's channels. This analysis identifies the main characteristics of the traffic, as well as some relationships between network parameters and their persistence over time. The paper proceeds to present the development of a simulation model, which represents the cable network. This model is built from the results of the traffic analysis and network parameters. The major challenge of this model is to predict the traffic on each channel of the cable network, related to parameters of the network configuration, such as the number of assigned subscribers to the channel and the time of day. To reach this goal, the simulation model has been developed with a modular structure, which gives it flexibility to adapt to changes in the network. The process followed involves the establishment of a traffic model, a system model, and finally, the validation of the results.     

基于组合核函数高斯过程的网络流量预测

为了提高网络流量的预测精度,提出一种组合核函数高斯过程的网络流量预测模型。首先采用混沌理论构建网络流量的学习样本,然后将网络流量的训练样本输入组合函数高斯回归模型进行训练,建立网络流量预测模型,最后采用多个网络流量数据进行单步和多步预测对比测试。结果表明,相对于对比模型,本文模型准确描述了复杂多变的网络流量变化趋势,提高了网络流量的预测精度。     

A new approach for VoIP traffic characterization

The letter proposes a new frame generation model for those audio codecs which handle SID frames and deduces an analytical expression for the mean bit rate at the input of the IP network as a function of the number of frames per packet. The new model is experimentally validated for the G.729B, G.723.1, and GSM AMR codecs. Results show that the error of the estimation of the mean bit rate can be reduced significantly compared to the traditional on-off model.     

A new approach for characterizing structure-dependent hot-carriereffects in drain-engineered MOSFET's

In this paper, we have demonstrated successfully a new approach for evaluating the hot-carrier reliability in submicron LDD MOSFET with various drain engineering. It was developed based on an efficient charge pumping measurement technique along with a new criterion. This new criterion is based on an understanding of the interface state (N_it ) distribution, instead of substrate current or impact ionization rate, for evaluating the hot-carrier reliability of drain-engineered devices. The position of the peak N_it distribution as well as the electric field distribution is critical to the device hot-carrier reliability. From the characterized N_it spatial distribution, we found that the shape of the interface state distribution is similar to that of the electric field. Also, to suppress the spacer-induced degradation, we should keep the peak values of interface state away from the spacer region. In our studied example, for conventional LDD device, sidewall spacer is the dominant damaged region since the interface state in this region causes an additional series resistance which leads to drain current degradation. LATID device can effectively reduce hot-carrier effect since most of the interface states are generated away from the gate edge toward the channel region such that the spacer-induced resistance effect is weaker than that of LDD devices