Section 1: TCP Measurements.- On the Impact of Bursting on TCP Performance.- A Study of Burstiness in TCP Flows.- On the Stationarity of TCP Bulk Data Transfers.- Section 2: Application Measurements.- Toward the Accurate Identification of Network Applications.- A Traffic Identification Method and Evaluations for a Pure P2P Application.- Analysis of Peer-to-Peer Traffic on ADSL.- Analysis of Communities of Interest in Data Networks.- Section 3: Network Inference and Problem Diagnosis.- Binary Versus Analogue Path Monitoring in IP Networks.- Exploiting the IPID Field to Infer Network Path and End-System Characteristics.- New Methods for Passive Estimation of TCP Round-Trip Times.- Detecting Duplex Mismatch on Ethernet.- Section 4: Topology Measurements.- Improved Algorithms for Network Topology Discovery.- Using Simple Per-Hop Capacity Metrics to Discover Link Layer Network Topology.- Revisiting Internet AS-Level Topology Discovery.- Section 5: Wireless Network Measurements.- Application, Network and Link Layer Measurements of Streaming Video over a Wireless Campus Network.- Measurement Based Analysis of the Handover in a WLAN MIPv6 Scenario.- Section 6: Monitoring Facilities.- A Distributed Passive Measurement Infrastructure.- lambdaMON - A Passive Monitoring Facility for DWDM Optical Networks.- Section 7: Routing and Traffic Engineering Measurements.- Internet Routing Policies and Round-Trip-Times.- Traffic Matrix Reloaded: Impact of Routing Changes.- Some Observations of Internet Stream Lifetimes.- Section 8: Spectroscopy and Bandwidth Estimation.- Spectroscopy of Traceroute Delays.- Measuring Bandwidth Between PlanetLab Nodes.- Comparison of Public End-to-End Bandwidth Estimation Tools on High-Speed Links.- Section 9: Poster Session.- Traffic Classification Using a Statistical Approach.- Self-Learning IP Traffic Classification Based on Statistical Flow Characteristics.- Measured Comparative Performance of TCP Stacks.- Applying Principles of Active Available Bandwidth Algorithms to Passive TCP Traces.- A Network Processor Based Passive Measurement Node.- A Merged Inline Measurement Method for Capacity and Available Bandwidth.- Hopcount and E2E Delay: IPv6 Versus IPv4.- Scalable Coordination Techniques for Distributed Network Monitoring.- Evaluating the Accuracy of Captured Snapshots by Peer-to-Peer Crawlers.- HOTS: An OWAMP-Compliant Hardware Packet Timestamper.- Practical Passive Lossy Link Inference.- Merging Network Measurement with Data Transport.

Passive and active network measurement : 6th International Workshop, PAM 2005, Boston, MA, USA, March 31-April 1, 2005 : proceedings

Encrypted network data classification has received considerable attention in the industry and research communities for a long time. However, the emergence of new private applications and encryption protocols has brought more new challenges. The primary task of classification is to determine whether the sample is encrypted. When the specification of private protocol is unpublished, only the whole sample can be processed, and thus the unencrypted field which coexists with the encrypted field will seriously lower the classification effect. To tackle this problem, an algorithm based on data reconstruction and moment eigenvector is proposed, which can not only estimate the encryption result but also locate the encrypted field in each data sample. In the algorithm, the encryption probability sequence is calculated firstly by data reconstruction and CNN (Convolutional Neural Network) model transfer. Then, based on the derivative of the encryption probability sequence, the suspected encrypted field set is generated. Finally, encrypted field matching is performed based on the similarity of the four-dimensional moment eigenvector, and thus the possible encrypted field of each sample is obtained. The proposed algorithm achieved a recall rate of 93% and a precision rate of 72% in an experiment of distinguishing the encrypted/unencrypted ones of complex data. The forward coverage, reverse coverage, and F1 value in identifying encrypted field reached 89%, 90%, and 90%, respectively. Compared with the encrypted field matching methods based on the K-Nearest Neighbor algorithm, Dynamic Time Warping, Runs test, and Frequency test, the method proposed in this paper exhibited salient advantages.

/pdf/an-encrypted-field-locating-algorithm-for-private-protocol-q4fbhgmkcd.pdf

An Encrypted Field Locating Algorithm for Private Protocol Data Based on Data Reconstruction and Moment Eigenvector

The accurate identification of encrypted data stream helps to regulate illegal data, detect network attacks and protect users' information. In this paper, a novel encrypted data stream identification algorithm is introduced. The proposed method is based on randomness characteristics of encrypted data stream. We use a l1-norm regularized logistic regression to improve sparse representation of randomness features and Fuzzy Gaussian Mixture Model (FGMM) to improve identification accuracy. Experimental results demonstrate that the method can be adopted as an effective technique for encrypted data stream identification.

Zhisong Pan

Papers

Encrypted data stream identification using randomness sparse representation and fuzzy Gaussian mixture model