Identifying the nature of data flows can help improve network service and security. Most existing solutions usually simplify the traffic classification to protocol and application identification based on some uniqueness assumptions. However, in the real world these assumptions aren’t always reasonable due to the abuse of multiplexing techniques. In this work, a new scheme is proposed from a different perspective that aims to directly identify the content inside a data flow without considering the external protocols and applications. We use wavelet to obtain the time-scale signals of each data flow and develop a new hidden Markov tree (HMT) with an embedding deep neural network (DNN) to model these signals. Each hidden state of the HMT represents a specific signal generation pattern. Transition of hidden states describes the time-scale context of the signal patterns. DNN is used to describe the probabilistic relationship between the implicit patterns and the observed time-scale signals. We derive new algorithms for the model and create an instance for each type of traffic, which projects the data flows into a multi-dimensional decision space and achieves their content identification through a classifier. Numerical experiments using real datasets are presented to validate the proposed scheme. Performance-related issues and comparisons with related works are discussed.

Distributed threat-events are one of the main challenges faced in computer networks. Although a lot of research has been conducted for these issues, the situation has not been significantly improved. Different from existing victim-centric approaches, in this article we propose a new network-centric approach for the detection of distributed threat-events. The distributed network is treated as a holistic system that consists of spatially interconnected network elements. Network events are detected by the dynamic behavior analysis of the distributed networks. We develop a model consisting of two-layer random fields to describe the time-varying traffic forwarding behavior of the distributed networks. The bottom layer describes the interaction and influence of the network elements under the action of network events. Markovianity is adopted to characterize the spatiotemporal context of each network element’s behavior patterns. The top layer describes each network element’s traffic features driven by the underlying behavior patterns. A Gaussian mixture model is used to capture the statistical features of the network traffic for each behavior pattern. We derive algorithms for parameter estimation and event detection. Numerical experiments using real datasets and different network scenarios are presented to validate the proposed approach. Performance-related issues and comparison with related works are discussed.

With the rapid development of web-based applications, clicking on hyperlinks has become a general means for accessing various network services. Understanding the visiting behavior of web users not only helps improve the personalized service quality and user experience, but also plays an important role in network management and early threat detection. Click-stream identification is a fundamental issue for user behavior analysis. However, most existing approaches are designed for non-encrypted HTTP requests and only focus on server-side scenarios, which makes them inapplicable to the increasingly popular HTTPS and network-side management. In this work, we propose an encryption-independent scheme from a network-side perspective that adopts the web traffic collected at the network boundary to identify the HTTP(S) requests generated by the click actions of web users. The proposed scheme employs hidden Markov models (HMMs) to describe the time-varying behavior of click and non-click web traffic. A deep neural network (DNN) is integrated into the HMMs to capture the context of web traffic, which eliminates the limitations caused by the independence hypothesis of the traditional HMMs. Finally, a DNN-based rear classifier is proposed to determine the type of HTTP(S) requests according to the fitting degree between the HTTP(S) requests and the HMM-based behavior models. We derive the algorithms for model learning and click identification. Experiments are conducted to validate the proposed approach. Performance-related issues and comparisons are discussed. Results show that both the average precision and recall rate of the proposed approach exceed 92%, which is better than most existing benchmark methods in terms of performance and stability.

With the rapid increase of mobile devices, the computing load of roadside cloudlets is fast growing. When the computation tasks of the roadside cloudlet reach the limit, the overload may generate heat radiation problem and unacceptable delay to mobile users. In this paper, we leverage the characteristics of buses and propose a scalable fog computing paradigm with servicing offloading in bus networks. The bus fog servers not only provide fog computing services for the mobile users on bus, but also are motivated to accomplish the computation tasks offloaded by roadside cloudlets. By this way, the computing capability of roadside cloudlets is significantly extended. We consider an allocation strategy using genetic algorithm (GA). With this strategy, the roadside cloudlets spend the least cost to offload their computation tasks. Meanwhile, the user experience of mobile users are maintained. The simulations validate the advantage of the propose scheme.

Network traffic modeling is a fundamental problem in communication. A traffic model should be able to capture and reproduce various properties of a real trace. Despite the widespread success of most numerical models in various applications, few actually focus on the oscillation behavior proven to be one of the basic properties in network traffic. In this paper, a new mathematical method is proposed to model and synthesize stationary and nonstationary oscillatory processes of network traffic. The proposed model is based on the structure of the hierarchical hidden Markov model, which includes two nested hidden Markov chains and one observable process. The first-layer hidden Markov chain with variable state-duration controls the time-varying oscillatory process. Conditional on the first-layer Markov chain, the local fluctuation process is modeled by the second-layer hidden Markov chain. Algorithms are derived for inference of model parameters and traffic synthesis. The proposed approach is compared with four classical models for performance evaluation. The selected performance criterion includes time structure, statistical properties, self-similarity, queuing behavior and multiscale properties. The flexibility and accuracy of the proposed model results in a close fit to the real traces.

A novel server-side defense scheme is proposed to resist the Web proxy-based distributed denial of service attack. The approach utilizes the temporal and spatial locality to extract the behavior features of the proxy-to-server traffic, which makes the scheme independent of the traffic intensity and frequently varying Web contents. A nonlinear mapping function is introduced to protect weak signals from the interference of infrequent large values. Then, a new hidden semi-Markov model parameterized by Gaussian-mixture and Gamma distributions is proposed to describe the time-varying traffic behavior of Web proxies. The new method reduces the number of parameters to be estimated, and can characterize the dynamic evolution of the proxy-to-server traffic rather than the static statistics. Two diagnosis approaches at different scales are introduced to meet the requirement of both fine-grained and coarse-grained detection. Soft control is a novel attack response method proposed in this work. It converts a suspicious traffic into a relatively normal one by behavior reshaping rather than rudely discarding. This measure can protect the quality of services of legitimate users. The experiments confirm the effectiveness of the proposed scheme.

We present an analysis of virus spread in wireless sensor networks (WSNs) through a modified susceptible-infective (SI) epidemic model. In a traditional SI model, once a sensor node is attacked by a virus, the infective node can spread the virus to its neighboring nodes, which further spread the virus to their neighbors; the process continues until the whole network fails. To overcome this weakness, we propose a modified SI model by leveraging the sleep mode of WSNs for the virus spread control. The modified SI model can improve the network anti-virus capability without causing any extra hardware effort and signaling overhead. We derive the explicit solutions for the modified SI model, which can capture both the spatial and temporal dynamics of the virus spread process. Numerical results are presented to validate our analysis.

A new two-layer hidden Markov model is proposed to describe the arrival rate process of Web traffic. The macro state process of the first underlying layer is used to describe the large-scale trends of network traffic. The sub-state process of the second underlying layer is used to describe the small-scale fluctuations that are happening during the duration of a given macro state. Experiments are implemented to validate the proposed model.

We analyze the performance of a wireless system consisting of a set of secondary users opportunistically sharing bandwidth with a set of primary users over a coverage area. The secondary users employ spectrum sensing to detect channels that are unused by the primary users and hence make use of the idle channels. If an active secondary user detects the presence of a primary user on a given channel, it releases the channel and switches to another idle channel, if one is available. In the event that no channel is available, the call waits in a buffer until either a channel becomes available or a maximum waiting time is reached. Spectrum sensing errors on the part of a secondary user cause false alarm and mis-detection events, which can potentially degrade the quality-of-service experienced by primary users. We derive system performance metrics of interest such as blocking probabilities. Our results suggest that opportunistic spectrum sharing can significantly improve spectrum efficiency and system capacity, even under unreliable spectrum detection. The proposed model and analysis method can be used to evaluate the performance of future opportunistic spectrum sharing systems.

We develop a general framework for analyzing the performance of an opportunistic spectrum sharing (OSS) wireless system at the session level with Markovian arrivals and phasetype service times. The OSS system consists of primary or licensed users of the spectrum and secondary users that sense the channel status and opportunistically share the spectrum resources with the primary users in a coverage area. When a secondary user with an active session detects an arrival of a primary session in its current channel, the secondary user leaves the channel quickly and switches to an idle channel, if one is available, to continue the session. Otherwise, the secondary session is preempted and moved to a preemption queue. The OSS system is modeled by a multi-dimensional Markov process. We derive explicit expressions for the related transition rate matrices using matrix-analytic methods. We also obtain expressions for several performance measures of interest, and present both analytic and simulation results in terms of these performance measures. The proposed OSS model encompasses a large class of specific models as special cases, and should be useful for modeling and performance evaluation of future opportunistic spectrum sharing systems.

We propose an adaptive spectrum detection mechanism for cognitive radios in a dynamic traffic environment. Cognitive radios generate secondary calls, which opportunistically make use of channels left idle by primary traffic generated by the licensed radios in the system. Spectrum detection for the cognitive radios is formulated as a hypothesis testing problem based on the Bayes criterion to minimize average cost. The maximum likelihood estimates of the prior probabilities for the hypothesis test are obtained from the dynamics of both traffic types of traffic using a Markovian model of the system channel occupancy. The spectrum detection scheme is extended to incorporate cooperation among multiple secondary users. Our numerical results suggest that the adaptive spectrum detection scheme can achieve significantly better error performance than a static scheme that ignores the prior probabilities, especially under light primary traffic conditions. Cooperative spectrum detection among multiple users can further reduce the false alarm and misdetection probabilities.

In an opportunistic spectrum sharing system, secondary users equipped with cognitive radios opportunistically access spectrum that is not being used by the primary users, i.e., the licensed spectrum users, without causing harmful interference to the primary users. We present an analytical performance model of opportunistic spectrum access in a military environment consisting of a group of secondary users sharing a set of channels with primary users in a coverage area. A secondary user occupying a given channel detects when a primary user accesses the channel and then either moves to another idle channel or is placed in a virtual queue where it waits until either a channel becomes available or a maximum waiting time is reached. Using a two-dimensional Markov model, we derive expressions for the blocking probabilities and reconnection probability and evaluate the performance metrics under a range of parameter settings.

In an opportunistic spectrum sharing (OSS) wireless network there are two types of users: primary users and secondary users. The primary users own the license for the system bandwidth, while the secondary users opportunistically share the spectrum resources with the primary users. When a secondary user detects a call arrival from a primary user in its current channel, the secondary user leaves the channel immediately and switches to an idle channel, if one is available, to continue the call. Otherwise, the secondary user is preempted. Call arrivals from primary users and secondary users in the OSS system are modeled by a Markovian arrival process (MAP) which captures correlation in the aggregate arrival process consisting of the two types of call arrivals. We derive the stationary probability vector using matrix-analytic methods and obtain expressions for a set of key performance measures. We present numerical results for a sample scenario.

We introduce a new system performance measure due to handoff called handoff interference, which characterizes the additional interference noise induced by the handoff process. The handoff interference experienced by a mobile unit is determined by the parameters of the handoff algorithm. We present an exact analysis of the handoff interference and the outage probability and develop a discrete-time method to efficiently and accurately compute these performance metrics along arbitrary trajectories in a cellular network. Our numerical results reveal critical tradeoffs among the critical handoff performance metrics, which should be taken into account in dimensioning the handoff parameters to optimize system performance. We discuss an example handoff design problem, which illustrates how to dimension the handoff parameters to optimize this tradeoff using the proposed handoff analysis.

We analyze the performance of a wireless system that allows opportunistic spectrum sharing. The system consists of a set of primary users sharing a set of channels over a coverage area. The resources allocated to the primary users are shared opportunistically with a set of secondary users. The secondary users are capable of detecting channels that are unused by the primary users and then making use of the idle channels. If no channel is available for a secondary call, the call waits in a buffer until either a channel becomes available or a maximum waiting time is reached. We compute the blocking probabilities, mean reconnection probability, channel utilization, and total carried traffic in the system. Our results suggest that opportunistic spectrum sharing can significantly improve the efficiency of a wireless system, without negatively impacting the performance seen by the primary users.

An analytical traffic model and three queue management schemes are developed for a heterogeneous multihop mobile ad hoc network (MANET). The traffic model is built by a two-dimensional Markov process and some important performance metrics are developed. Based on the obtained metrics, three queue management schemes with QoS (quality of service) provisioning are developed for dynamic traffic conditions. Performance comparisons among the three schemes are presented

Recently mobile ad hoc networks (MANETs) are attracting increasing attention. Much work has been done by using various simulations tools. In this paper, we evaluate the performance of MANETs by analytic modeling. Based on two-dimensional Markov processes, several analytical models for packet traffic flow and connection availability are built by considering the impact of various types of failures. Some interesting performance metrics are then determined, e.g., steady state path availability (SSPA), mean end-to-end packet delay (EEPD), and loss of packets due to unavailability (LPU). The developed models and metrics are expected to serve as the first step for performance evaluation and guide for protocol design of MANETs

An analytical modeling method is developed for the evaluation of integrated 3G/WLAN networks. To adapt the feature of the emerging wireless networks efficiently and to cover many possible situations in reality, the cell residence times are modeled generally. The channel occupancy times, the horizontal and vertical handoff rates as well as some interesting performance measures are derived and calculated. Both analysis and numerical results show that the performance of the 3G network is significantly increased when the integrated 3G/WLAN network is employed, and that the performance of integrated 3G/WLAN network is improved greatly when the WLANs are in the hot-spot areas. The method developed here is expected to be useful for modeling and performance evaluation of other type of networks, such as the 3G network with the infrastructureless-mode WLANs or ad-hoc networks

The rapid growth of wireless services and mobile users drives a great interest in cellular networks with a hierarchical structure. Hierarchical cellular networks (HCNs) can provide high system capacity, efficient channel utilization and inherent load-balancing capability. In this paper, a two-layer hierarchical cellular network with bidirectional overflow and take-back strategies under generally distributed cell residence times is considered. An analytical model and a performance analysis method are developed, and a number of important performance measures are evaluated. The developed model and analysis method can be easily extended to multi-layer HCNs

This paper presents a new channel allocation scheme with preemptive priority for the integrated voice/data mobile network. Based on the scheme, a two-dimensional Markov process is built, and the steady-state probability is solved by the matrix-analytic method. The preemptive priority mechanism introduced gives more benefit to voice traffic at the expense of degrading some data traffic, while the victim buffer compensates the degradation and has no negative effect on voice traffic. From the analysis and numerical results, we can conclude that our scheme can guarantee different QoS requirements from different traffic classes, and significantly improve the channel utilization.

This paper presents an analytical model of adaptive bandwidth allocation scheme, called complete sharing with preemptive priority (CSPP) scheme, for multi-service wireless cellular networks. It employs movable boundaries to consider distinguishing the performance between multiple services, and uses the complete sharing approach to maximize the bandwidth utilization. Besides, the CSPP scheme captures the elastic data traffic by using a degradation/compensation mechanism and considers preemptive priority (PP) mechanism for voice traffic, while the degradation of data traffic by PP mechanism is compensated through a victim buffer. The analysis and numerical results demonstrate that our scheme can guarantee different QoS requirements from different traffic classes and improve the bandwidth utilization efficiency.

This paper presents an analytical model of channel allocations with preemptive priority to study the handoff performance for integrated voice/data mobile networks. By analyzing the system as a quasi-birth-and-death process, we obtain the steady state probabilities and some interesting performance measures, such as new voice (new data) blocking probability, handoff voice (handoff data) dropping probability, the channel utilization, and the busy period time in the cell. From the analysis and numerical results, we can conclude that our scheme can provide complete service differentiation and different QoS guarantee for different traffic classes, and get pretty good channel utilization by appropriate threshold parameter design. The performance measures obtained in the paper are very useful in evaluating the needed resource of future wireless mobile networks.