This research focuses on the input shape of CNN-based application traffic. The previously proposed multi-input model CNN classification method classified applications through various shapes of features derived from fixed-length packets, achieving a higher classification accuracy compared to traditional CNNs. However, it had limitations such as vulnerability to overfitting despite its high classification accuracy and slow inference speed. To overcome these challenges, we introduce a lightweight version of the previously proposed MISCNN, called MISCNN+. MISCNN+ demonstrated approximately 2.9 times faster inference speed and a 3.6% improvement in classification accuracy compared to the previous version.

By the rapid development of the Internet and online applications, traffic classification has changed to an important topic in the field of network management. Although many studies have been conducted in recent years, designing a robust classification model remains a major challenge. Even though previous researches have focused on changing the layer structure within the deep learning model, they do not consider the input shape that best represents the traffic. To this end, a new traffic classification method is presented in this paper that aims to utilize various input shape that can be derived from fixed-length packet bytes. The proposed method utilized MISCNN (Multi Input Shape Convolution Neural Network) to generate robust traffic classification model that can be used in many domains. Various experiments were carried out to verify superiority of proposed method for the tasks of traffic classification and application identification. According to the obtained results, MISCNN achieved higher score compared to previous researches that utilized only 2D square input shape and 1D linear input shape on the ISCX VPN-nonVPN dataset.

SaaS is a cloud-based application service that allows users to use applications that work in a cloud environment. SaaS is a subscription type, and the service expenditure varies depending on the license, the number of users, and duration of use. For efficient network management, security and cost management, accurate detection of user behavior for SaaS applications is required. In this paper, we propose a rule-based traffic analysis method for the user behavior detection. We conduct comparative experiments with signature-based method by using the real SaaS application and demonstrate the validity of the proposed method.

Since the development of Bitcoin, the first blockchain-based cryptocurrency, many cryptocurrencies have formed and have traded in markets. The integrity and anonymity of cryptocurrency was enough to raise its value and its price gained worldwide attention. Therefore, many studies are being carried out to predict the price of cryptocurrency for make a profit. We cluster time series through K-Medoids algorithm and train and evaluate each cluster with predictive models. We also examine the predictive performance in Bitcoin price according to the various distance measurement of clustering.

Protocol reverse engineering represents a very powerful and important tool for network management and security. To cope with the emergence and evolution of rapidly increasing numbers of unknown protocols, automation is of great importance. Many methods for supporting the automation of the various steps for protocol reverse engineering have been investigated; however, there has been no method to automate the analysis of the target network environment. Most methods are designed only for application layer protocols, and all others are designed for specific environments. Given any unknown communication, we must be able to infer the structure of the protocol. However, there has been no research on automatic reverse engineering of protocols when both the protocol and the target network environment are entirely unknown. Here, we propose an automatic protocol reverse engineering approach that is designed to be generally applicable, regardless of the specific network environment. We demonstrate the feasibility of the proposed approach by applying it to several protocols in various layers of the TCP/ IP reference model.

Since Bitcoin, the first cryptocurrency that applied blockchain technology was developed by Satoshi Nakamoto, the cryptocurrency market has grown rapidly. Along with this growth, many vulnerabilities and attacks are threatening the Bitcoin ecosystem, which is not only at the bitcoin network-level but also at the service level that applied it, according to the survey. We intend to analyze and detect DDoS attacks on the premise that bitcoin's network-level data and service-level DDoS attacks with bitcoin are associated. We evaluate the results of the experiment according to the proposed metrics, resulting in an association between network-level data and service-level DDoS attacks of bitcoin. In conclusion, we suggest the possibility that the proposed method could be applied to other blockchain systems.

The online cryptocurrency bitcoin, created based in blockchain technology, is attracting the attention of individuals, businesses and the government as well. As interest in blockchain technology and cryptocurrency has steadily increased over the past few years, trading volume and market size of cryptocurrency have increased at an astonishing speed. As a result, analysis and monitoring measures for blockchain networks, blocks, and transactions have become an important issue. In this paper, the method of clustering applied dimension reduction as a method of bitcoin network analysis is proposed. The proposed method applies the analysis way using K-means algorithm with PCA to block data in bitcoin collected by this research team.

Along with the development of high-speed Internet and smart devices, various attack methods were emerged, and attack traffic has also changed into various and complex forms. In order to provide reliable services and efficient management of network resources, it is essential to detect and analyze the attack traffic. While various application and attack traffic detection or classification methods have been studied, but signature-based methods are still mainstream of the most. In this paper, we propose the seed based sequential grouping model for attack traffic detection. Model consists of two main indices, which are similarity and connectivity index. In addition to model, we define the set of optimal thresholds of each index by using our balancing algorithm and define it as Guideline. By applying the proposed model to the actual attack traffic, we demonstrate that the model has high detection accuracy and completeness.

Today, as the network environment increases, various types of traffic patterns generated for each application and service are generated, and traffic analysis methods that can classify traffic applications and services are being studied. In particular, Skype is a VoIP service that is serviced by Microsoft and is currently the most widely used internationally. For this reason, the importance of Skype traffic detection is growing in terms of network management. In order to overcome the limitations of signature and machine learning based detection methods and to more accurately analyze and detect the current Skype traffic pattern, this paper presents a comprehensive Skype traffic detection system that combines pattern, list and signature based application detection methods. The proposed system is applied to various Skype traffic collected through campus network to verify accuracy and detection rate.

Applications are becoming more complicated and diverse as the network environment grows day by day. So, it is important to classify application traffic accurately. Although there are many ways to classify applications traffic, machine learning based approaches are becoming more efficient in nowadays. This is because machine learning methods are more appropriate than existing methods for accurate and efficient applications traffic classification. Payload signature methods have limitations to deal with various patterns and increasing application traffic complexity. In this paper, we propose a method for extracting flow features and a system for classifying applications traffic based on Machine Learning.