Immense growth of network usage and the associated proliferation of network, traffic, traffic classes, and diverse QoS requirements pose numerous challenges for network operators. Though data-driven approaches can provide better solutions for these challenges, limited data has been a barrier to developing those methods with high resiliency. In this work, we propose SyNIG (Synthetic Network Traffic Generation through Time Series Imaging), which utilizes Generative Adversarial Networks (GANs) for network traffic synthesis by converting time series data to a specific image format called GASF (Gramian Angular Summation Field). With GASF images we encode correlation between samples in 1D signals on a single 2D pixel map. Taking three types of network traffic; video streaming, accessing websites and IoT, we synthesize over 200,000 traces using over 40,000 original traces generalizing our method for different network traffic. We validate our method by demonstrating the fidelity of the synthetic data and applying them to several network related use cases showing improved performance.

Supervised machine learning is often used to detect phishing websites. However, the scarcity of phishing data for training purposes limits the classifier's performance. Further, machine learning algorithms are prone to adversarial attacks: small perturbations on attack data can bypass the classifier. These problems make machine learning less effective for phishing detection. We propose two Generative Adversarial Network (GAN) based approaches that synthesize phishing and legitimate samples to mimic real-world websites. Information about real-world datasets is obtained from ten publicly available phishing datasets which are used by the AAE (Adversarial Autoencoder) and WGAN (Wasserstein GAN) for generating synthetic data. Using both real and synthesized data, we demonstrate how to implement classifiers with higher performance and more resistance to adversarial attacks. We propose a set of hypotheses and validate them through experiments to demonstrate: (i) indistinguishability of synthesized samples from actual ones, (ii) susceptibility of classifiers to adversarial attacks, (iii) mitigating adversarial attacks by training on larger datasets that include correctly labeled synthesized samples, and (iv) better performance of classifiers trained on large datasets. Our AAE and WGAN have been trained on a wide range of datasets, making us optimistic about its widespread applicability.

Tracking individuals or groups based on their hidden and/or emergent behaviors is an indispensable task in homeland security, mental health evaluation, and consumer analytics. On-line and off-line communication patterns, behavior profiles and social relationships form complex dynamic evolving knowledge graphs. Investigative search involves capturing and mining such large-scale knowledge graphs for emergent profiles of interest. While graph databases facilitate efficient and scalable operations on complex heterogeneous graphs, dealing with incomplete, missing and/or inconsistent information and need for adaptive querying pose major challenges. We address these by proposing an inexact graph pattern matching method, which is implemented in a graph database with a scoring mechanism that helps identify hidden behavioral patterns. PINGS (Procedures forINvestigativeGraphSearch), a graph database library of procedures for investigative graph search is presented. Results presented demonstrate the capability of detecting individuals/groups meeting query criteria as well as the iterative query performance in graph databases. We evaluate our approach on three datasets: a synthetically generated radicalization dataset, a publicly available patient’s ICU hospitalization stays dataset, and a crime dataset. These varied datasets demonstrate the wide-range applicability and the enhanced effectiveness of observing suspicious or latent trends in investigative domains.

Unlike the traditional Internet application such as web browsing and peer-to-peer(P2P), video streaming has been dominating the global network traffic for the past few years, raising many challenges for network providers. With the popularity of interactive videos, a.k.a 360° videos, resource requirement for video streaming has been further increased. Prior identification of these video traffic is useful for effective provisioning of network resources, yet it is difficult due to the end-to-end encryption of data. However, with the recent advances in Machine Learning (ML) methods, prior identification of these resource-demanding traffic types has become viable. Nonetheless, they require more training data, without which leads to poor performance. Collecting more training data may also pose issues related to delayed training time. To remedy this problem, in this paper, we propose a novel Generative Adversarial Network (GAN) based data generation solution to synthesise video streaming data targeting 360°/normal video classification. Taking over 600 actual video traces and generating ≈ 30000 new traces, our post-classification results show that we can achieve 5 - 15% of accuracy improvement compared to only having actual traces.

Malicious actors often use phishing attacks to compromise legitimate users' credentials. Machine learning is a promising approach for phishing detection. While the accuracy of machine learning algorithms is often dependent on the training data, very little attack data for training is available. We propose an approach for augmenting existing datasets that can be used by machine learning algorithms. We use an Adversarial Autoencoder (AAE) to generate samples that mimic the phishing websites and provide metrics to assess the quality of the generated samples. We test these samples against models trained with real-world data. Some of generated samples are able to evade existing detection model. We then use a portion of these samples in training. The new machine learning models are more robust and have higher accuracy. In other words, real-world phishing site data augmented with AAE synthesized data used for training the model is more effective for phishing detection.