Border Gateway Protocol (BGP) anomalies, such as route hijacks, misconfigurations, and worm-induced disruptions, significantly threaten global Internet stability. While machine learning (ML) methods have improved anomaly detection, critical challenges persist: limited availability of comprehensive IPv6/IPv4 labeled datasets and significant preprocessing delays that prevent real-time anomaly classification. This research deals with extending established dataset-generation methods to create robust, parallel datasets for IPv4 and IPv6 anomalies. It further evaluates advanced ML models, including LSTM, Transformers, and Graph Neural Networks (GNNs), specifically focusing on reducing detection latency. Our approach aims to integrate optimized preprocessing workflows, diversified datasets, and streaming-based inference. We expect this will improve anomaly detection accuracy and speed, moving closer to practical real-time BGP anomaly detection.

The development of IoT across various fields emphasizes the need for real-time network traffic classification to maintain security, simplify resources, and address evolving threats. Traditional methods like port-based and deep packet inspection fail with encrypted traffic, privacy constraints, and slow processing, while deep learning solutions face limitations with insufficient data and latency in IoT environments. To overcome these challenges, this research presents a hybrid AI framework that seamlessly combines AI techniques for fast and accurate classification. Through a five-phase process-data preparation, feature engineering, model design, interpretability and optimization, and deployment and validation-it merges synthetic traffic generation and semi-supervised methods to improve data scarcity. Optimized deep neural networks and GAN networks will be used for classification and anomaly detection. Moreover, the results will be enhanced by applying explainable artificial intelligence for transparency. This framework aims to improve latency and accuracy, outperforming current approaches.

Realistic network traffic generation is essential for evaluating the performance, security, and scalability of modern communication systems. Traditional methods, such as traffic replay systems and statistical models, while useful, often fall short in capturing the complexity and variability of real-world network scenarios. Recent advancements in Artificial Intelligence (AI), especially Large Language Models (LLMs) like ChatGPT, have introduced new approaches to synthetic traffic generation. This paper presents a novel architecture using OpenAI’s GPT-3.5 Turbo to generate synthetic network traffic, with a focus on creating multi-protocol conversations that are indistinguishable from real-world interactions. Through fine-tuning and prompt engineering, the proposed system successfully generates packet- and conversation-level network traffic for ICMP, ARP, DNS, TCP and HTTP protocols. Additionally, by integrating a Mixture of Experts (MoE) architecture, this model simulates real-world network conversations with high accuracy, being able to generate a conversation combining ARP, DNS, TCP and HTTP without packet or protocol errors. The results show how the application of LLMs in network traffic generation improves realism and adaptability, establishing this approach as a valuable tool for future security testing and network performance evaluation. In addition, the proposed methodology is easily adaptable to other LLMs available both through APIs and to be downloaded and executed on your own computer.

Web browsing privacy is a matter of paramount importance for the Internet users. While they try to protect themselves from being monitored by getting advantage of encryption or VPNs, users’ privacy is still unaccomplished, even taking into account the tangled web, with several domains visited at the same time in a single web page, or IP addresses of a cloud provider shared by several sites. In this work, we provide a novel approach to identify user web browsing that only takes into account the IP addresses that the user has connected to and without performing any DNS reverse resolutions. We use this sequence of addresses as an input of different state-of-the-art deep learning models, such as multi-layer perceptron and transformers, which are able to accurately identify which was the website actually visited among Alexa’s World Top 500 most visited domains. Moreover, we have also studied other factors, such as the dependence on the DNS server used to resolve the visited IP addresses, the accuracy for the top domains (e.g., Google, YouTube, Facebook, etc.), data augmentation by packet sampling simulation to improve our results, the impact on packet sampling and the fine-tuning and possible impact of model parameters or the scalability of our approach. We conclude that, using only a 10% of the packets, we can identify the visited website with an accuracy and F1 score between 94% and 95%.

Server load estimation is key in balancing traffic between servers when optimizing data center resources. Intrusive methods are sometimes difficult or impossible to implement. Therefore, non-intrusive estimation methods are the best alternative in these cases. The objective of this paper is to present a server load estimation method based on external network traffic measurements obtained in a vantage point close to the server. Statistical distributions of TCP SYN response time, that is, the time from SYN to SYN+ACK segments at the server side, are used to fit Burr Type XII heavy tail distribution mixtures. The fitting algorithm, based on maximum likelihood estimation, is developed in detail in this paper. Experimental data shows that the median of the fitted distribution correlates within the 95% confidence interval of the server load figures and, thus, it can be used as a non-intrusive and accurate method to measure it. This new method can be applied to almost any existing load balancing algorithm, as it does not make any assumption about the server, which is considered a black box.

Web browsing analytics provides insights on the websites that users access, which affects their privacy. Although this analysis might be seen as an easy task, different problems, such as encryption, the tangled web, with several domains visited at the same time in a single web page, or IP addresses of a cloud provider shared by several sites, make it a though job. However, despite these issues, users' privacy is still unaccomplished, as we show in this work. We provide a novel approach that only takes into account the IP addresses that the user has connected to without performing any reverse DNS lookup. We use this sequence of addresses as an input of a neural network, which is able to identify accurately which was the website actually visited among Alexa's World Top 500 most visited domains. Moreover, we have also studied other factors, such as the dependence on the DNS server used to resolve the visited IP addresses, the accuracy for the top domains (e.g., Google, YouTube, Facebook, etc.), data augmentation to improve our results, or the impact on packet sampling. In this last case, we conclude that, using only a 10% of the packets, we can identify the visited website with an accuracy of 93%, whereas it can be over 97% if there is no packet sampling and we use data augmentation.

In an Internet arena where the search engines and other digital marketing firms’ revenues peak, other actors still have open opportunities to monetize their users’ data. After the convenient anonymization, aggregation, and agreement, the set of websites users visit may result in exploitable data for ISPs. Uses cover from assessing the scope of advertising campaigns to reinforcing user fidelity among other marketing approaches, as well as security issues. However, sniffers based on HTTP, DNS, TLS or flow features do not suffice for this task. Modern websites are designed for preloading and prefetching some contents in addition to embedding banners, social networks’ links, images, and scripts from other websites. This self-triggered traffic makes it confusing to assess which websites users visited on purpose. Moreover, DNS caches prevent some queries of actively visited websites to be even sent. On this limited input, we propose to handle such domains as words and the sequences of domains as documents. This way, it is possible to identify the visited websites by translating this problem to a text classification context and applying the most promising techniques of the natural language processing and neural networks fields. After applying different representation methods such as TF–IDF, Word2vec, Doc2vec, and custom neural networks in diverse scenarios and with several datasets, we can state websites visited on purpose with accuracy figures over 90%, with peaks close to 100%, being processes that are fully automated and free of any human parametrization.

In network management, it is important to model baselines, trends, and regular behaviors to adequately deliver network services. However, their characterization is complex, so network operation and system alarming become a challenge. Several problems exist: Gaussian assumptions cannot be made, time series have different trends, and it is difficult to reduce their dimensionality. To overcome this situation, we propose Deep-FDA, a novel approach for network service modeling that combines functional data analysis (FDA) and neural networks. Specifically, we explore the use of functional clustering and functional depth measurements to characterize network services with time series generated from enriched flow records, showing how this method can detect different separated trends. Moreover, we augment this statistical approach with the use of autoencoder neural networks, improving the classification results. To evaluate and check the applicability of our proposal, we performed experiments with synthetic and real-world data, where we show graphically and numerically the performance of our method compared to other state-of-the-art alternatives. We also exemplify its application in different network management use cases. The results show that FDA and neural networks are complementary, as they can help each other to improve the drawbacks that both analysis methods have when are applied separately.

Periods of low load have been used for the scheduling of non-interactive tasks since the early stages of computing.Nowadays, the scheduling of bulk transfers-i.e., large-volume transfers without precise timing, such as database distribution, resources replication or backups-stands out among such tasks, given its direct effect on both the performance and billing of networks.Through visual inspection of traffic-demand curves of diverse points of presence (PoP), either a network, link, Internet service provider or Internet exchange point, it becomes apparent that lowuse periods of bandwidth demands occur at early morning, showing a noticeable convex shape.Such observation led us to study and model the time when such demands reach their minimum, on what we have named valley time of a PoP, as an approximation to the ideal moment to carry out bulk transfers.After studying and modeling single-PoP scenarios both temporally and spatially seeking homogeneity in the phenomenon, as well as its extension to multi-PoP scenarios or paths-a meta-PoP constructed as the aggregation of several single PoPs-, we propose a final predictor system for the valley time.This tool works as an oracle for scheduling bulk transfers, with different versions according to time scales and the desired trade-off between precision and complexity.The evaluation of the system, named VTP, has proven its usefulness with errors below an hour on estimating the occurrence of valley times, as well as errors around 10% in terms of bandwidth between the prediction and actual valley traffic.

Many network management actions need a simultaneous consideration of several elements' state. This is becoming an even more complex matter with the advent of reconfigurable deployments, where scaling functions up can prevent performance bottlenecks. Therefore, fine-grained detection of significant burdens arises as a cornerstone to optimize their monitoring and operation. We present advanced distributed passive retrieval of information, and statistical multi-point analysis (AdPRISMA), a passive monitoring system intended to fit models for network delay measurements with clustering elements to improve representation of central and extreme behaviors. As distinguishing features, it relies on cost-effective multi-point round-trip time (RTT) passive network measurements, and is able to select a suitable parametric model optimizing the trade-off between fitting and complexity. AdPRISMA can correlate records collected from several vantage points and detect where performance issues are most likely to appear; adjust alarms in terms of the probability of events; and adapt its behavior to dynamic network conditions while presenting a fair identification of anomalous situations. We evaluate AdPRISMA with experiments both in virtual environments and with real-world data to provide evidences of its applicability and capabilities to represent network elements' delay.

In this paper, we present an efficient hardwareimplementation of a video encoder optimized for ultra low-latency, using the Logarithmic Hop Encoding algorithm. This design provides the following features: (i) A maximum marginal output latency of 23 clock cycles, (ii) small area requirements, (iii) proven rate up to 95 Millions of pixels per second in a low-end FPGA (i.e. FHD video can be streamed), (iv) on-the-fly configuration, (v) scalable architecture. The proposed design has been tested in a real video transmission scenario, where the video transmitter prototype is implemented using a ZynqBerry board, leveraging all SoC capabilities.

Online Quality of Service (QoS) assessment in high speed networks is one of the key concerns for service providers, namely to detect QoS degradation on-the-fly as soon as possible and avoid customers’ complaints. In this regard, a Key Performance Indicator (KPI) is the number of TCP retransmissions per flow, which is related to packet losses or increased network and/or client/server latency. However, to accurately detect TCP retransmissions the whole sequence number list should be tracked which is a challenging task in multi-Gb/s networks. In this paper we show that the simplest approach of counting as a retransmission a packet whose sequence number is smaller than the previous one is enough to detect pathological flows with severe retransmissions. Such a lightweight approach eliminates the need of tracking the whole TCP flow history, which severely restricts traffic analysis throughput. Our findings show that low False Positive Rates (FPR) and False Negative Rates (FNR) can be achieved in the detection of such pathological flows with severe retransmissions, which are of paramount importance for QoS monitoring. Most importantly, we show that live detection of such pathological flows at 10 Gb/s rate per processing core is feasible.

The scheduling of bulk transfers such as database distribution, resources replication and security backups, and other non-time-critical tasks has a direct effect on both the performance and cost of a network. We propose to face this problem by studying the valley times - i.e., the minimum use during off-peak periods of a network - as suitable moments to carry out such tasks. To do so, we characterize them considering the valley-hour, which we define as the opposite to the well-known variable busy-hour. Our analysis, based on 6-year-long measurements from 12 points of presence in the Spanish Research and Education Network (RedIRIS), has guided us to model the valley-hour as a Gaussian process. After that, we compare its behavior in different points and detect the main factors that explain its variance, finding significant heterogeneity. With the resulting conclusions, we have proposed a system to predict valley-hours in RedIRIS with errors below an hour for most of the cases.

Network management actions require the retention of data representing the temporal evolution of network state, mainly in the form of time series. Nonetheless, storing and exploiting those measurements is becoming a challenge as the production rate of such data is continuously increasing and data lasting for long time periods are used. To scale up the storage and improve both the analysis and visualization of network measurements, we apply Functional Principal Components Analysis (FPCA) to extract the most meaningful functional features for network time series, pruning those with low informational importance. We compare such algorithm with other state-of-the-art proposals, and show that it achieves lower error for the representation of atypical observations even with higher compression ratios.

Quality of Service (QoS) and Experience (QoE) monitoring is a must during the management of services deployed over the Internet. This is particularly critical for Voice over IP (VoIP), as its degradation is immediately perceived by end users. From our experience, we highlight the impact that TCP segmentation exerts on online VoIP monitoring systems. On the one hand, it makes difficult to interpret the segmented signaling messages for application monitoring. On the other hand, complete messages do not provide information about packet level behavior, which is necessary for internetworking layer monitoring. Paradoxically, the Network Management community has not paid much attention to this fact, although it compromises several VoIP management tasks. To fill in this gap, we provide an empirical evaluation of its impact for the most popular VoIP signaling protocols using traces from enterprise networks, and present the architecture and heuristic that we are currently developing to partially solve the effect of the segmentation. Our proposal avoids the overhead of reconstructing the entire data stream and, at the same time, it enables the analysis of the packets that are actually sent. To do so, it maps TCP flags with segmented application messages, and exploits data structures that reduce latency. In this way, our solution paves the way for online monitoring tools that take into account both internetworking and application layers performance.

Networks are currently essential for computing: It is therefore essential to guarantee the quality of network links in order to ensure a proper operation of computing systems. However, a widespread deployment of network monitoring devices might not be economically feasible. In this paper, we propose the use of Programmable System-on-Chip FPGAs (PSoCs) for enabling a comprehensive testing of networks. Software-only solutions are no longer valid, because the timescales of current networks call for custom-hardware solutions. Thus, we show that PSoCs are a perfect fit for network quality monitoring devices, by mapping the required measurements to the capabilities of such devices. In order to demonstrate the benefits of PSoCs to monitor the quality of network links, we have developed a prototype based on Xilinx Zynq that is capable of measuring the key performance indicators of Gigabit Ethernet networks, namely: available bandwidth, packet loss, delay and jitter. The monitoring probe features GPS-based timestamping, thus enabling the construction of network delay maps. We present the benefits of the proposed approach in terms of cost and simplicity, and we also show how it could be expanded to multi-Gb/s networks.

Network managers have to deal with tons of measurement data provided by monitoring systems. Such data is difficult to both process and translate into concrete management actions. As an attempt to make managerial work easier, we propose a novel statistical approach that summarizes the behavior of network flow characteristics - e.g., flow sizes or durations. Bearing in mind that losses in the summarized information can lead to restricted or even erroneous conclusions, our approach solves this by exploiting the probability integral transform theorem. This theorem allows the definition of a set of intervals, mapped into concrete categories, where the number of flows according to a given characteristic would be uniformly distributed among categories. This eases the use of both statistical tests and simple visual inspection to detect changes in the behavior of the characteristic under analysis, as typically abrupt changes are understood as signs of intrusion, malfunction or other types of anomalies. This proposal gave rise to the visualization and analytical framework Dictyogram, which has been applied to monitor the Spanish Academic Network - more than one million users. Its results are shown as a case study assessing the usefulness of our proposal.

Hybrid Software-Defined Networks (SDNs) are growing at a remarkable speed, so network administrators need to deal with the configuration of a plethora of devices including OpenFlow elements, traditional equipment, and nodes supporting both OpenFlow and traditional features. The OpenFlow Management and Configuration Protocol (OF-CONFIG) is positioned as a solid candidate for the remote configuration of OpenFlow devices, but the fact that OF-CONFIG relies on NETCONF for its transport constrains its potential considerably. Indeed, the lack of comprehensive and standardized data models has hindered the utilization of NETCONF itself in traditional networks, and will likely confine OF-CONFIG to an elementary set of configurations until the expected data models arrive. In this paper, we present a semantic-based approach that eases and automates the configuration of network devices while complementing the capabilities of OF-CONFIG and NETCONF. Our main contributions can be summarized as follows. First, we have formalized the semantics of the switch/router configuration domain using the Web Ontology Language (OWL). Second, we have developed an Ontology-Based Information Extraction (OBIE) system from the Command-Line Interface (CLI) of network devices. Third, we have defined a learning algorithm that enables automated interpretation of CLIs' configuration capabilities in heterogeneous (multi-vendor) network scenarios. The potential of our approach is demonstrated through experiments carried out on different network elements.

Network Management tasks are currently characterized by their diversity both in terms of the situations that must be faced and the data used to reach conclusions. This complex and changing context imposes diverse needs and restrictions that must be covered by management tools in order for them to be useful. In order to face current challenges, we propose the application of Functional Data Analysis (FDA) techniques in the different functional areas of Network Management. FDA can be applied to network data compression, definition of baselines, anomaly detection, or traffic classification as well as forecasting for network dimensioning.

This paper presents a semantic web-based architecture to share alerts among Security Information Management Systems (SIMS). Such architecture is useful if two or more SIMS from different domains need to know information about alerts happening in the other domains, which is of vital importance for an early response to network incidents. For this, each SIMS has a knowledge base that contains the security alerts. This knowledge base can be queried from other SIMS, using standard semantic web protocols. To assess this architecture, both risk analysis and botnet detection use cases have been developed. The former one is based on the interoperability provided by this architecture. Rule-based reasoning is also used for the latter case. The performance of both use cases has been evaluated, providing some results.

Currently, virtualization is a proven technology that potentially provides a great opportunity for industry growth and research, due to its advantages in flexibility and cost reduction. However, designing virtual network environments is a complex process that requires great effort. For this, the work proposed in this paper is focused on applying modeling techniques to characterize virtual network environments. Firstly, we have analyzed the existing approaches to model virtualized infrastructures. Based on this analysis, we have designed a generic model to characterize and manage virtual network environments based on the CIM Schema. To asses the feasibility of our approach, we have implemented a CIM client based on this model, which enables to deploy virtual network environments automatically, independently of the used underlying virtualization platform. The test results using this client demonstrated the efficiency of this implementation, which was evaluated with Xen and VMware Server.

To address the evolution of security incidents in current communication networks it is important to react quickly and efficiently to an attack. The RED (Reaction after Detection) project is defining and designing solutions to enhance the detection/reaction process, improving the overall resilience of IP networks to attacks and help telecommunication and service providers to maintain sufficient quality of service and respect service level agreements. Within this project, a main component is in charge of instantiating new security policies that counteract the network attacks. This paper proposes an ontology-based approach to instantiate these security policies. This technology provides a way to map alerts into attack contexts, which are used to identify the policies to be applied in the network to solve the threat. For this, ontologies to describe alerts and policies are defined, using inference rules to perform such mappings.

In the development of accurate capacity planning and network resource dimensioning models, network operators must handle representative information about the traffic volumes traversing its network. However, the amount of traffic measurements available over which to perform such analysis, processing and storage is overwhelming. For this reason, the research community has understood the importance of finding an effective mechanism to reduce (or subsample) such huge amount of data, with minimum loss of information.

Testbeds are controlled experimentation platforms where solutions (software, architectures, etc.) can be developed, deployed and tested in an environment that resembles real utilization conditions. This paper describes a model-driven methodology for automatic testbed reconfiguration which solves the problems of manual interaction and inter-testbed scenario reutilization. It is based in a high-level testbed-independent model of the desired scenario (so it can be applied to any testbed in general) which is particularized to testbed-specific scenario models for automatic deployment and management by model-based tools. The paper also details our practical experiences applying the methodology to two quite different use cases: VNUML-based virtual testbeds and the GMPLS-enabled optical network of ADRENALINE testbed® (each one with its own model-based automatic deployment tools), thus assessing the feasibility and generality of the proposed approach.

The optical burst switching (OBS) paradigm proposes a new set of transmission protocols and network architectures that permits the high-utilization of the raw bandwidth available by dense wavelength division multiplexing at a moderate computational cost. Accordingly, it is necessary to extend the management plane of such networks to include the particular aspects of OBS, in order to guarantee the appropriate network operation. This paper analyzes the information required for the management of such OBS networks and proposes a new information model based on observed management use-cases. A simple data model is also specified to reduce the computational burden, but compliant with the modeled information.

This paper explains the problem of introducing management instrumentation in distributed application in a way that makes this instrumentation transparent to their developers. The paper proposes different approaches for the achievement of this transparency and describes how they were validated in two scenarios involving the management of distributed applications for e-commerce environments.

This paper describes the design and implementation of an SNMP-based management system for the CORBA-based electronic brokerage application that has been implemented within the scope of the ABS (Architecture for Information Brokerage Service) ACTS Project. The management system is based on the use of an SNMP-CORBA gateway that uses the JIDM (joint inter-domain management) specification translation algorithms and incorporates ideas from the services and facilities contained in the SNMP part of the JIDM interaction translation documents. The paper also focuses on the way the management information has been instrumented within the CORBA application trying to make it transparent with respect to the developers of the functional aspects of the managed application.