Browsing by Author "Lu, Chun-Nan"

Now showing 1 - 8 of 8

Application classification using packet size distribution and port association
(2009-09-01)
Lin, Ying-Dar
;
Lu, Chun-Nan
;
Lai, Yuan-Cheng
;
Peng, Wei-Hao
;
Lin, Po-Ching
Traffic classification is an essential part in common network management applications such as intrusion detection and network monitoring. Identifying traffic by looking at port numbers is only suitable to well-known applications, while signature-based classification is not applicable to encrypted messages. Our preliminary observation shows that each application has distinct packet size distribution (PSD) of the connections. Therefore, it is feasible to classify traffic by analyzing the variances of packet sizes of the connections without analyzing packet payload. Ill this work, each connection is first transformed into a point in a multi-dimensional space according to its PSD. Then it is compared with the representative points of pre-defined applications and recognized as the application having a minimum distance. Once a connection is identified as a specific application, Port association is used to accelerate the classification by combining it with the other connections of the same session because applications usually use consecutive ports during a session. Using the proposed techniques, packet size distribution and port association, a high accuracy rate, 96% oil average, and low false positive and false negative rates, 4-5%, are achieved. Our proposed method not only works well for encrypted traffic but also can be easily incorporated with a signature-based method to provide better accuracy. (C) 2009 Elsevier Ltd. All rights reserved.
Bug Traces: Identifying and Downsizing Packet Traces with Failures Triggered in Networking Devices
(2014-04-01)
Lin, Ying-Dar
;
Lu, Chun-Nan
;
Lai, Yuan-Cheng
;
Eliezer, Zongo Pawendtaore
;
交大名義發表
Testing networking devices before releasing them onto the market is a way of ensuring quality and robustness. Replaying artificial or real-world traffic is a method to test networking devices. Using real-world traffic is desirable as it uncovers more realistic properties. The challenges of testing with real-world traffic are mainly the high volume of the captured traces and the prolonged time required for replay testing. In order to efficiently reproduce the failures of networking devices and reduce the replay time, it is necessary to reduce the size of the traces that have triggered the failures. In this work, two algorithms used to downsize the traces but still retain the failures they triggered, Binary Downsizing (BD) and Linear Downsizing (LD), are proposed. Meanwhile, a metric called downsizing ratio (DR), the ratio between the size of the downsized traces and that of the original traces, is defined in order to evaluate the efficiency of the trace downsizing. Three kinds of probes following the basic RFC benchmarking requirements, ARP, ICMP, and HTTP requests, are regularly sent to diagnose the devices during the testing. ARP and ICMP probes test the reachability of a networking device hosted on the local network, and HTTP probes check if the device still responds to users\' requests. The evaluation of failure distribution shows that 70 percent of failures happened because they failed to respond to one of the three probes, 23 percent failed to respond to two probes, and 7 percent failed to respond to all probes. From the downsizing experiments, LD was inferred to have a slightly higher DR than that of BD, but BD generally would require fewer iterations than LD.
Hardware Design for Statistical Network Traffic Classifiers
(2016-01-01)
Lu, Chun-Nan
;
Lai, Yuan-Cheng
;
Huang, Chun-Ying
;
Lin, Ying-Dar
;
資訊工程學系
Signature matching is commonly used in network traffic classification and can provide accurate and efficient results. However, it requires constant updates of signatures and can't be applied to encrypted traffic. Statistical behavior-based approaches can avoid the drawback of payload encryption. However, the computational complexity of related statistical features may prevent them being deployed in systems that are expected to respond in limited time. In this work, we combine the advantages of statistics-based classification approaches and hardware design techniques to develop a balanced classifier that can provide timely responses to. Two statistics-based solutions, a message size distribution classifier (MSDC) and a message size sequence classifier (MSSC) which depend on classification accuracy and real timeliness arc proposed. The former aims to identify network flows in an accurate but not-so-fast manner, while the latter aims to provide a lightweight and real-time solution. Simulations showed that MSSC contributed 77.4% and MSDC contributed 22.6% of decision rounds. Furthermore, our design can achieve an accuracy of more than 94% while achieving a throughput of 80 Gbps.
High performance traffic classification based on message size sequence and distribution
(2016-12)
Lu, Chun-Nan
;
Huang, Chun-Ying
;
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
資訊工程學系
Classifying network flows into applications is a fundamental requirement for network administrators. Administrators used to classify network applications by examining transport layer port numbers or application level signatures. However, emerging network applications often send encrypted traffic with randomized port numbers. This makes it challenging to detect and manage network applications. In this paper, we propose two statistics-based solutions, the message size distribution classifier (MSDC) and the message size sequence classifier (MSSC) depending on classification accuracy and real timeliness. The former aims to identify network flows in an accurate manner, while the latter aims to provide a lightweight and real-time solution. The proposed classifiers can be further combined to build a hybrid solution that achieves both good detection accuracy and short response latency. Our numerical results show that the MSDC can make a decision by inspecting less than 300 packets and achieve a high detection accuracy of 99.98%. In contrast, the MSSC classifier can respond by only looking at the very first 15 packets and have a slightly lower accuracy of 94.99%. Our implementations on a commodity personal computer show that running the MSDC, the MSSC, and the hybrid classifier in-line achieves a throughput of 400 Mbps, 800 Mbps, and 723 Mbps, respectively.
In-Lab Replay Testing under Real Traffic with a Case Study on WLAN Routers
(2017-03-01)
Lin, Ying-Dar
;
Hwang, Ren-Hung
;
Lu, Chun-Nan
;
Hung, Jui-Tsun
;
資訊工程學系
Replaying artificial or real-world traffic is a method used to test networking devices. Using real-world traffic is desirable as it uncovers more realistic properties such as traffic diversity and complicated user behaviors. In this paper, we propose an in-lab replay testing (ILRT) framework, composed of a monitor, a traffic replayer and a library of real-world traffic traces, to replay captured packet traces to test networking devices. To demonstrate its effectiveness, a total of 28 WLAN routers were tested to evaluate whether they could work stably for an extended time. In our experiments, 53.57% and 100% of devices under test (DUTs) were triggered critical (L1) failures and tolerable (L2) failures, respectively. 21.43% and 100% of DUTs were triggered more than one L 1 and L2 failures, respectively. Among high-spec DUTs, there was 25% of DUTs which were triggered L1 failures. Furthermore, among 458 test results, chance of pass, L1 failure, and L2 failure is 2.84%, 7.86%, and 89.3%, respectively. The results showed that even though these devices have passed traditional lab tests, there is still a good chance for them to fail under real-world traffic.
Session level flow classification by packet size distribution and session grouping
(2012-01-12)
Lu, Chun-Nan
;
Huang, Chun-Ying
;
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
資訊工程學系
Classifying traffic into specific network applications is essential for application-aware network management and it becomes more challenging because modern applications complicate their network behaviors. While port number-based classifiers work only for some well-known applications and signature-based classifiers are not applicable to encrypted packet payloads, researchers tend to classify network traffic based on behaviors observed in network applications. In this paper, a session level flow classification (SLFC) approach is proposed to classify network flows as a session, which comprises of flows in the same conversation. SLFC first classifies flows into the corresponding applications by packet size distribution (PSD) and then groups flows as sessions by port locality. With PSD, each flow is transformed into a set of points in a two-dimension space and the distances between each flow and the representatives of pre-selected applications are computed. The flow is recognized as the application having a minimum distance. Meanwhile, port locality is used to group flows as sessions because an application often uses consecutive port numbers within a session. If flows of a session are classified into different applications, an arbitration algorithm is invoked to make the correction. The evaluation shows that SLFC achieves high accuracy rates on both flow and session classifications, say 99.9% and 99.98%, respectively. When SLFC is applied to online classification, it is able to make decisions quickly by checking at most 300 packets for long-lasting flows. Based on our test data, an average of 72% of packets in long-lasting flows can be skipped without reducing the classification accuracy rates. (C) 2011 Elsevier B.V. All rights reserved.
Three-phase behavior-based detection and classification of known and unknown malware
(2015-07-25)
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
Lu, Chun-Nan
;
Hsu, Peng-Kai
;
Lee, Chia-Yin
To improve both accuracy and efficiency in detecting known and even unknown malware, we propose a three-phase behavior-based malware detection and classification approach, with a faster detector in the first phase to filter most samples, a slower detector in the second phase to observe remaining ambiguous samples, and then a classifier in the third phase to recognize their malware type. The faster detector executes programs in a sandbox to extract representative behaviors fed into a trained artificial neural network to evaluate their maliciousness, whereas the slower detector extracts and matches the LCSs of system call sequences fed into a trained Bayesian model to calculate their maliciousness. In the third phase, we define malware behavior vectors and calculate the cosine similarity to classify the malware. The experimental results show that the hybrid two-phase detection scheme outperforms the one-phase schemes and achieves 3.6% in false negative and 6.8% in false positive. The third-phase classifier also distinguishes the known-type malware with an accuracy of 85.8%. Copyright (c) 2015 John Wiley & Sons, Ltd.
Traffic diversity and code coverage: a preliminary analysis
(2016-02-01)
Lin, Ying-Dar
;
Lai, Yuan-Cheng
;
Lu, Chun-Nan
;
Hung, Jui-Tsun
;
Shao, Chun-Pin
It is generally assumed that using more diverse traffic to test network devices could achieve larger code coverage. However, how to describe the diversity of traffic traces and the relationship between the traffic diversity and code coverage is still an issue. In this paper, the traffic diversity is defined using the number of packets and the size of the subnets involved, and traces having various diversity are used to evaluate the corresponding code coverage for the programs in a network device. Experiment results show that more number of packets or larger size of network segments can generate larger diversity indices and thus larger code coverage. For Snort, as the number of packets increases from 1 to 10,000,000, representative diversity index and the code coverage can increase from 0 to 0.95 on the basis of Simpson\'s index and from 19.1% to 32.2%, respectively. As the size of network segments increases, representative diversity index and the code coverage can increase from 0.41 to 0.82 and from 28.2% to 32.2%, respectively. Similar results can be obtained in the case of Linux kernel. If the mappings among different diversity indices and the corresponding code coverage can be built beforehand, the quality of the tests can improved. Copyright (c) 2014 John Wiley & Sons, Ltd.