Generating graphs using computational models is a critical activity with numerous applications, including social network research and biological network modeling. Despite sig-nificant breakthroughs in graph-generating technologies, modern machine learning for simulating complex real-world networks still requires effective improvement. Specifically, the ability to conditionally generate graphs while accounting for local and global structural elements has not been fully explored. This study presents a novel approach to graph generation that combines Transformer encoders' strong contextual understanding with Long Short Term Memory (LSTM) decoders' sequence modeling capabilities, all within a Conditional Variational Auto Encoder (CVAE) framework. Our methodology aims to fine-tune the structural features of generated graphs more accurately, representing an advancement in conditional graph generation. Our results, based on extensive tests versus standard generative models utilizing graph datasets, show that our model can more clearly tune global-level structural features' values better than conventional models.

In recent years, there has been a growing demand for techniques to artificially generate graphs. Various proposals have been made for graph generation models using machine learning. Among these models, GraphTune is a model that allows to specify the features of the generated graphs. GraphTune has not achieved sufficient accuracy when specified values are in ranges where there are few samples in the training dataset. Therefore, in this paper, we propose a method to improve the accuracy of GraphTune by retraining it using graphs generated by the model itself. Through experiments using real-world graphs, we demonstrate that the higher accuracy can be achieved compared to the conventional method.

In domains of cybersecurity, recent advancements in Machine Learning (ML) and Deep Learning (DL) have significantly enhanced Network Intrusion Detection Systems (NIDS), improving the effectiveness of cybersecurity operations. However, attackers have also leveraged ML/DL to develop sophisticated models that generate adversarial packets capable of evading NIDS detection. Consequently, defenders must study and analyze these models to prepare for the evasion attacks that exploit NIDS detection mechanisms. Unfortunately, conventional generation models often rely on unrealistic assumptions about attackers' knowledge of NIDS components, making them impractical for real-world scenarios. To address this issue, we present DiffuPac, a first-of-its-kind generation model designed to generate adversarial packets that evade detection without relying on specific NIDS components. DiffuPac integrates a pre-trained Bidirectional Encoder Representations from Transformers (BERT) with diffusion model, which, through its capability for conditional denoising and classifier-free guidance, effectively addresses the real-world constraint of limited attacker knowledge. By concatenating malicious packets with contextually relevant normal packets and applying targeted noising only to the malicious packets, DiffuPac seamlessly blends adversarial packets into genuine network traffic. Through evaluations on real-world datasets, we demonstrate that DiffuPac achieves strong evasion capabilities against sophisticated NIDS, outperforming conventional methods by an average of 6.69 percentage points, while preserving the functionality and practicality of the generated adversarial packets.

In recent years, various services have been provided through high-speed and high-capacity wireless networks on mobile communication devices, necessitating stable communication regardless of indoor or outdoor environments. To achieve stable communication, it is essential to implement proactive measures, such as switching to an alternative path and ensuring data buffering before the communication quality becomes unstable. The technology of Wireless Link Quality Estimation (WLQE), which predicts the communication quality of wireless networks in advance, plays a crucial role in this context. In this paper, we propose a novel WLQE model for estimating the communication quality of wireless networks by leveraging sequential information. Our proposed method is based on Long Short-Term Memory (LSTM), enabling highly accurate estimation by considering the sequential information of link quality. We conducted a comparative evaluation with the conventional model, stacked autoencoder-based link quality estimator (LQE-SAE), using a dataset recorded in real-world environmental conditions. Our LSTM-based LQE model demonstrates its superiority, achieving a 4.0% higher accuracy and a 4.6% higher macro-F1 score than the LQE-SAE model in the evaluation.

In the field of communication network management, graph-based simulations using network topology models represented as graphs are widely adopted. In graph-based simulations, because there is a limited number of real network graph data that researchers and experts can access, the technique of generating graphs that mimic the features of real networks using graph generative models is essential. In this context, machine learning-based graph generative models have been rapidly advancing recently. In particular, in terms of the accuracy of reproducing the features of generated graphs, sequence data-based graph generative models have been successful. In this paper, we propose a method based on 2nd-order random walk as an alternative to DFS code, which is used for graph-to-sequence conversion in GraphTune, one of the sequence data-based graph generative models. We conducted experiments on a small dataset with limited diversity on a real graph dataset and confirmed that the model using the proposed method is at best 54.68% more accurate than the model using the conventional method.

A Network Intrusion Detection System (NIDS) is a tool that identifies potential threats to a network. Recently, different flow-based NIDS designs utilizing Machine Learning (ML) algorithms have been proposed as solutions to detect intrusions efficiently. However, conventional ML-based classifiers have not seen widespread adoption in the real world due to their poor domain adaptation capability. In this research, our goal is to explore the possibility of using sequences of flows to improve the domain adaptation capability of network intrusion detection systems. Our proposal employs natural language processing techniques and Bidirectional Encoder Representations from Transformers framework, which is an effective technique for modeling data with respect to its context. Early empirical results show that our approach has improved domain adaptation capability compared to previous approaches. The proposed approach provides a new research method for building a robust intrusion detection system.

A graph is a very common and powerful data structure used for modeling communication and social networks. Models that generate graphs with arbitrary features are important basic technologies in repeated simulations of networks and prediction of topology changes. Although existing generative models for graphs are useful for providing graphs similar to real-world graphs, graph generation models with tunable features have been less explored in the field. Previously, we have proposed GraphTune, a generative model for graphs that continuously tune specific graph features of generated graphs while maintaining most of the features of a given graph dataset. However, the tuning accuracy of graph features in GraphTune has not been sufficient for practical applications. In this paper, we propose a method to improve the accuracy of GraphTune by adding a new mechanism to feed back errors of graph features of generated graphs and by training them alternately and independently. Experiments on a real-world graph dataset showed that the features in the generated graphs are accurately tuned compared with conventional models.

Identifying influencers in a given social network has become an important research problem for various applications, including accelerating the spread of information in viral marketing and preventing the spread of fake news and rumors. The literature contains a rich body of studies on identifying influential source spreaders who can spread their own messages to many other nodes. In contrast, the identification of influential brokers who can spread other nodes' messages to many nodes has not been fully explored. Theoretical and empirical studies suggest that involvement of both influential source spreaders and brokers is a key to facilitating large-scale information diffusion cascades. Therefore, this paper explores ways to identify influential brokers from a given social network. By using three social media datasets, we investigate the characteristics of influential brokers by comparing them with influential source spreaders and central nodes obtained from centrality measures. Our results show that (i) most of the influential source spreaders are not influential brokers (and vice versa) and (ii) the overlap between central nodes and influential brokers is small (less than 15%) in Twitter datasets. We also tackle the problem of identifying influential brokers from centrality measures and node embeddings, and we examine the effectiveness of social network features in the broker identification task. Our results show that (iii) although a single centrality measure cannot characterize influential brokers well, prediction models using node embedding features achieve F1 scores of 0.35--0.68, suggesting the effectiveness of social network features for identifying influential brokers.

With the development of graph applications, generative models for graphs have been more crucial. Classically, stochastic models that generate graphs with a pre-defined probability of edges and nodes have been studied. Recently, some models that reproduce the structural features of graphs by learning from actual graph data using machine learning have been studied. However, in these conventional studies based on machine learning, structural features of graphs can be learned from data, but it is not possible to tune features and generate graphs with specific features. In this paper, we propose a generative model that can tune specific features, while learning structural features of a graph from data. With a dataset of graphs with various features generated by a stochastic model, we confirm that our model can generate a graph with specific features.

In this paper, we investigate the convergence speed of the Arimoto-Blahut algorithm. For many channel matrices, the convergence speed is exponential, but for some channel matrices it is slower than exponential. By analyzing the Taylor expansion of the defining function of the Arimoto-Blahut algorithm, we will make the conditions clear for the exponential or slower convergence. The analysis of the slow convergence in this paper is new. Based on this analysis, we will compare the convergence speeds of the Arimoto-Blahut algorithm numerically with the values obtained in our theorems for several channel matrices. The purpose of this paper is to obtain a complete understanding of the convergence speed of the Arimoto-Blahut algorithm.

In network evaluation through simulations, accurately modeling traffic of real networks is difficult. Even if accurate traffic modeling is achieved, it is also difficult to accurately estimate a rate of rare packet loss events. For accurate estimations of rare events, Importance Sampling (IS) based on the change-of-measure technique using traffic models has been investigated. However, these studies are inapplicable for traffic traces of real networks since the applicable traffic models are extremely limited. In this paper, we propose a model-less approach to accurately estimate a packet loss rate through a simulation without directly modeling traffic. The change-ofmeasure is achieved based on traffic traces of networks in our model-less approach. We evaluated the applicability of the modelless approach on a G/M/1/K system with a traffic trace of a real network and confirmed that the model-less approach achieves up to 145 times accurate than normal a trace-driven Monte Carlo (MC) simulation.

For the design of delay/loss sensitive applications (e.g., audio/video conferencing, IP telephony, or telesurgery), it is important to accurately measure metrics along an end-to-end path. To improve the accuracy of end-to-end delay measurements, in our previous work, we have proposed a parallel flow monitoring technique. In this technique, delay samples of a target flow increase by utilizing the observation results of other flows sharing the source/destination with the target flow. In this paper, we extend this delay measurement technique to loss measurements and enable it to fully utilize information of all flows including flows with different source and destination. We confirmed that the proposed method reduces the error of loss rate estimations by 57.5% on average in ns-3 simulations.

In our previous research, we have proposed a parallel flow monitoring method in which the end-to-end delay is accurately measured. The method increases delay samples of a target flow by utilizing the observation results of other flows sharing the source/destination with the target flow. In this paper, we extend this method to loss measurement, and enable it to fully utilize information of all flows including flows with different source and destination. Through NS-3 simulations, we confirmed that the proposed method reduces error of loss rate estimations by 57.5% on average.

It is important to accurately model network traffic when we evaluate Quality of Service (QoS) of networks through simulations. However, for traffic in real networks, it is a tough task to select an appropriate traffic model and tune its parameters. Even if the accurate traffic modeling is achieved, it is also difficult to accurately estimate QoS regarding rare events, such as a packet loss rate in the modern Internet. In this paper, we propose a model-less approach to accurately estimate a packet loss rate through a simulation without directly modeling traffic including real network traffic. We also show the effectiveness of the approach in a simple queueing system as a first step in our development.

In this paper, we investigate the convergence speed of the Arimoto algorithm. By analyzing the Taylor expansion of the defining function of the Arimoto algorithm, we will clarify the conditions for the exponential or 1=N order convergence and calculate the convergence speed. We show that the convergence speed of the 1=N order is evaluated by the derivatives of the Kullback-Leibler divergence with respect to the input probabilities. The analysis for the convergence of the 1=N order is new in this paper. Based on the analysis, we will compare the convergence speed of the Arimoto algorithm with the theoretical values obtained in our theorems.

In this paper, we propose an accurate parallel flow monitoring method using active probe packets. Although multiple probe flows are monitored to measure delays on multiple paths in parallel for most measurement applications, information of only one probe flow of the multiple probe flows is utilized to measure an end-to-end delay on a path in conventional active measurement. In addition to information observed by the flow along the path, information of other flows is also utilized for the measurement in the proposed method. Delays on a flow are accurately measured by partially converting the observation results of a flow to those of another flow. Simulations are performed to confirm that the observation results of 72 parallel flows of active measurement are appropriately converted between each other in the proposed method. When the 99th-percentile of an end-to-end delay for each flow are measured, the proposed method achieves up to 95 % reduction of the error, and the error of the worst flow among all flows are reduced by 28%.

Traffic matrix (TM) estimation has been extensively studied for decades. Although conventional estimation techniques assume that traffic volumes are unchanged between origins and destinations, packets are often discarded on a path due to traffic burstiness, silent failures, etc. This paper proposes a novel TM estimation method that works correctly even under packet drops. The method is established on a Boolean fault localization technique; the technique requires fewer counters though it only determines whether each link is healthy. This paper extends the Boolean technique so as to deal with traffic volumes with error bounds just by a small number of counters. Along with submodular optimization for the minimum counter placement, we evaluate our method with real network datasets.

We consider a search algorithm for the output distribution that achieves the channel capacity of a discrete memoryless channel. We will propose an algorithm by iterated projections of an output distribution onto affine subspaces in the set of output distributions. The problem of channel capacity has a similar geometric structure as that of smallest enclosing circle for a finite number of points in the Euclidean space. The metric in the Euclidean space is the Euclidean distance and the metric in the space of output distributions is the Kullback-Leibler divergence. We consider these two problems based on Amari's α-geometry. Then, we first consider the smallest enclosing circle in the Euclidean space and develop an algorithm to find the center of the smallest enclosing circle. Based on the investigation, we will apply the obtained algorithm to the problem of channel capacity.

The active measurement of network quality, in which probe packets are injected into a network, is hindered by the intrusiveness problem, where the load of the probe traffic itself affects network quality. In this paper, we first demonstrate that there exists a fundamental bound on the accuracy of the conventional active measurement of delay. Second, to transcend that bound, we propose INTEST (INTrusiveness-aware ESTimation), an approach that compensates for delays produced by probe packets for wired networks. We show that INTEST enables an accurate high quantile estimation of delay. We do so through two simulations: a single-hop network composed of a router modeled by M/M/1 queuing, and a realistic multi-hop network modeled by a network simulator.

Active measurement, which can provide end-to-end measurements of network performance, is critical since the Internet is managed by multiple organizations. Recently, on the active measurement of delay and loss, Baccelli et al reported that many probing policies can be used to provide appropriate estimation in addition to the traditional policy based on PASTA property if the volume of probe stream is negligible compared to the traffic stream. Probing schemes with fixed probe packet intervals suffer from the phase-lock phenomenon due to synchronization against the network performance; they do, however, provide superior accuracy. A remaining issue is how to decide the optimal probing policy while taking the phase-lock phenomenon into consideration. In this paper, we propose the probing policy that randomly fluctuates the probe packet interval to avoid the phase-lock phenomenon. We start by clarifying the relationships among the fluctuation magnitude, the properties of the target network, and estimation accuracy, and we discuss the optimal probing policy with regard to the properties of the target network.