The exponential growth of network traffic in modern telecommunications has made the task of analyzing flow data for effective bandwidth estimation increasingly complex and resource-intensive. Accurate estimation of effective throughput is essential for a wide range of network management tasks, including dynamic traffic shaping, congestion control, quality optimization, and anomaly detection. However, traditional packet-based solutions, which rely on inspecting packets across the entire flow duration, demand substantial computational resources and memory, thereby reducing system performance and limiting scalability under high traffic volumes. This paper introduces an efficient sampling method based on linear regression and error reduction to accurately estimate effective throughput. Unlike general sampling methods such as random or systematic sampling, which do not account for actual network conditions or flow dynamics, our approach leverages real-time flow behavior to guide the sampling process. By focusing only on the most informative and impactful portions of each flow, the method significantly reduces the amount of data that needs to be processed while maintaining high estimation accuracy, allowing accurate throughput estimation using less than 15% of the available data, with an estimation error of no more than 10%. These advantages make the proposed method highly suitable for scalable and efficient deployment in diverse real-time network monitoring and traffic analysis environments.

In today’s digital landscape, ensuring the security of cloud environments is critical for organizational resilience, growth, and operational efficiency. As cloud services become more prevalent, so do sophisticated attacks targeting cloud users, making early detection essential. This paper introduces a novel time-based embedding approach for Cloud Services Graph-based Anomaly Detection (CS-GAD) that leverages a Graph Neural Network (GNN) to detect anomalous user behavior. We propose a dynamic tripartite graph to model interactions among users, actions, and cloud services over time. Using behavioral patterns, our GNN generates user embeddings to enable early detection of anomalies. We evaluate this approach on a novel dataset simulating five real-world attacks: cryptojacking, billing abuse, lateral movement, monitor exploitation, and service targeting. The dataset comprises 107,116 Application Programming Interface (API) calls over 32 days, tracking 79 AWS services, with attacks embedded within legitimate cloud traffic. Our results demonstrate that the proposed method achieves a lower false positive rate and higher detection accuracy than a prevailing method, as evidenced by improved accuracy, precision, recall, and F1-score.

Latency is the most impactful on fairness and Quality of Experience (QoE) in First-Person Shooter (FPS) games. High latency degrades the QoE of players, who may leave the game if unsatisfied with their QoE. Modern FPS games make great efforts to maintain an excellent QoE even under a poor Internet connection with high latency. Those efforts include the wide distribution of game servers and many software optimizations to smooth the effect of lags in the games. This study aims to provide insights into QoE estimation for network-intensive applications by examining one of the most prominent FPS games of the past two decades: Call of Duty. We observed that the game dynamically adjusts its network traffic behavior, including packet size and transmission rate, in response to variations in network quality. However, the ISP does not have this capability since the network traffic is encrypted; observing the game’s network traffic does not expose its nature and most certainly does not expose the game player’s intensity, latency, or QoE. We propose a novel technique for estimating latency and QoE in FPS games from an ISP-level perspective. In our evaluation, the model detected problematic latency in near real-time with 81% accuracy and an 80% F1 on a 10-second window, highlighting a trade-off between responsiveness and predictive performance. The dataset generated for this study is publicly available to support further research.

The growing dominance of encrypted network traffic and modern encryption protocols (TLS 1.3, QUIC, DoH) poses significant challenges for accurate network classification, particularly as many existing approaches rely on text- or image-based representations, which fail to adequately capture the inherent structural relationships present in network communication—relationships that are more naturally represented as graphs. In this work, we introduce GraphMux, a graph-based framework that leverages line graph transformations to fuse multiple graph views into a unified representation. We also present three graph-based flow representations (TIG+Chain, StarBurst, and 2Chain) designed to capture both temporal burst dynamics and client–server interaction patterns, using only packet time, direction, and length information, without incorporating any unencrypted statistical features. We evaluate our approach on three datasets: two academic datasets (UTMobileNetTraffic2021 and QUIC PCAP) and a commercial dataset (Flash), using four graph embedding architectures. Across all datasets, GraphMux consistently achieves superior performance, and the proposed graph constructions often yield the best results. Additional experiments examining attribute-selection strategies reveal a strong positive relationship between well-aligned feature assignments and classification accuracy, underscoring the importance of principled attribute design when constructing graph representations for encrypted traffic.

AI model repositories such as Hugging Face and TensorFlow Hub have become an attractive surface for steganographic malware: attackers exploit the redundancy in float32 weights to embed payloads while preserving model accuracy. Existing AI-model steganalysis methods require tens of thousands of labeled training samples and only detect attacks at high embedding rates ( ≥ 50%), limiting their practical utility. We address both gaps with a few-shot learning approach. We propose a novel parameter-position-stable image representation, Grayscale-Fourpart (GF), that maps float32 weights to a square grayscale image, and pair it with a metric-learning few-shot CNN detector. The detector trains from as few as 6 model files and consistently flags attacks down to 25% embedding rate, with 6% in some cases. We benchmark against a seven-baseline matrix spanning two prior academic method, the canonical raw-byte 1D-CNN paradigm, and four threshold-based statistics, and identify the conjoint conditions under which the simpler baselines collapse and ours retains accuracy. The trained detectors transfer to novel out-of-distribution spread-spectrum attacks despite training only on LSB perturbations. A deployment-feasibility study shows that GF feature extraction scales linearly to 10 8 parameters at ≈ 0.49 s and ∼ 1.77 GiB peak memory, ∼ 352 × faster than the strongest prior baseline at the same scale, making this, to our knowledge, the first AI-model steganalysis pipeline practical for repository-scale deployment. The full code framework, including baseline reproductions, is released as open-source.

This paper examines the challenges in distributing AI models through file transfer mechanisms.Despite advancements in security measures, vulnerabilities persist, necessitating a multi-layered approach to mitigate risks effectively.The physical security of model files is critical, requiring stringent access controls and attack prevention solutions.This paper proposes a novel solution architecture that protects the model architecture and weights from attacks by using Moving Target Defense (MTD), which obfuscates the model, preventing unauthorized access, and enabling detection of changes to the model.Our method is shown to be effective at detecting alterations to the model, such as steganography; it is faster than encryption (0.1 seconds to obfuscate vs. 18 seconds to encrypt for a 2500 MB model), and it preserves the accessibility of the original model file format, unlike encryption.Finally, our code is available at https://github.com/ArielCyber/AI-model-MTD.git.

Recent advancements in Internet protocols, including DNS over HTTPS (DoH) and Encrypted Service Name Indicators (ESNI), are making traditional Deep Packet Inspection (DPI) engines obsolete.Consequently, there is a growing need for nextgeneration traffic classification using artificial intelligence (AI).While DPI automatically categorizes unknown traffic as 'other,' AI-based models cannot automatically handle unknown or Outof-Distribution (OOD) traffic.AI models must effectively detect and classify OOD traffic to ensure robustness, reliability, and accuracy in real-world applications; however, current research often fails to address the challenges of OOD detection.In this paper, we evaluate various state-of-the-art OOD detection techniques for internet traffic classification and explore the drawbacks and advantages of using different threshold levels for the model's tolerance for OOD.Our findings reveal that varying rejection rates have distinct effects on OOD techniques, leading to a change in the optimal strategy for achieving dependable and precise detection across diverse OOD scenarios.We demonstrate that adjusting rejection rates from 10% to 30% can significantly improve the True Detection Rate (TDR) by up to 50%, while the False Detection Rate (FDR) may increase by less than 10%.Moreover, we emphasize that rejection-rate-based evaluation is pivotal for next-generation flow classification, promising a substantial reduction in FDR through rigorous methodological assessment.

File type classification is critical in digital forensics, and file carving. However, the increasing diversity of file formats challenges accurate classification. Traditional methods rely on hand-crafted features or compact neural networks but face long training times, limited training data, and lower accuracy. This paper introduces three novel, content-based file-type classification approaches to address these challenges. These approaches improve accuracy and streamline the integration of new file types using pre-trained models, enhancing both speed and reliability. The first approach utilizes Natural Language Processing (NLP) with a transformer architecture, while the second combines statistical features with a pre-trained model via transfer learning. These methods achieved accuracy rates of 72.4 % and 69.2 %, respectively, surpassing state-of-the-art Convolutional Neural Network (CNN) models. The third approach employs one-shot learning, achieving 100 % accuracy in several scenarios, enabling efficient training with minimal data.

Post-quantum cryptography (PQC) is expected to revolutionize secure communications in next-generation digital ecosystems. Previous and ongoing activities demonstrate that different PQC algorithms significantly impact traffic latency, but they do not yet provide a scheme to assess the existence of the PQC algorithm or its identification when encrypted traffic is analyzed for traffic engineering purposes. Hence, this work is the first to propose a novel PQClass pipeline for classifying encrypted Internet traffic of recently NIST-approved PQC algorithms. Hence, it establishes solid grounds for enabling engineers to optimize their networks and, in parallel, for cybersecurity practitioners to familiarise themselves with PQC algorithmic properties for enhancing or devising security architectures in diverse setups. Our pipeline demonstrates impressive performance on real-world data, achieving 86% accuracy in detecting the presence of a PQC algorithm and 91% and 98% accuracy in identifying the browser and OS, respectively, based on PQC-based traffic.

The increasing sophistication and frequency of cyberattacks have made Network Intrusion Detection Systems (NIDS) a critical component of modern cybersecurity. This work presents D-MAGIC, a novel real-time NIDS that leverages zero-shot learning and graph-based dynamic clustering to detect known and unknown threats. Unlike traditional systems that rely on labeled datasets and predefined attack signatures, D-MAGIC operates unsupervised, identifying anomalies by detecting deviations from normal network behavior. By embedding the relationships between network flows into a graph structure and dynamically clustering similar patterns, D-MAGIC can detect coordinated attacks and emerging threats with minimal delay. Experimental results on the CIC-IDS-2017 and CSE-CIC-IDS-2018 datasets demonstrate that D-MAGIC achieves an improvement of up to 12 % based on the standard F1 score compared to state-of-the-art methods, while significantly reducing false positives and ensuring rapid, real-time detection with minimal detection latency.

The increasing popularity of online services has made Internet Traffic Classification a critical field of study. However, the rapid development of internet protocols and encryption limits usable data availability. This paper addresses the challenges of classifying encrypted Internet Traffic, focusing on the scarcity of open-source datasets and limitations of existing ones. We propose two Data Augmentation (DA) techniques to synthetically generate data based on real samples: Average augmentation and MTU augmentation. Both augmentations are aimed to improve the performance of the classifier, each from a different perspective: The Average augmentation aims to increase dataset size by generating new synthetic samples, while the$M T U$augmentation enhances classifier robustness to varying Maximum Transmission Units (MTUs). Our experiments, conducted on two well-known academic datasets and a commercial dataset, demonstrate the effectiveness of these approaches in improving model performance and mitigating constraints associated with limited and homogeneous datasets. Our findings underscore the potential of data augmentation in addressing the challenges of modern Internet Traffic classification. Specifically, we show that our augmentation techniques significantly enhance encrypted traffic classification models. This improvement can positively impact user Quality of Experience (QoE) by more accurately classifying traffic as video streaming (e.g., YouTube) or chat (e.g., Google Chat). Additionally, it can enhance Quality of Service (QoS) for file downloading activities (e.g., Google Docs).

In recent years, privacy and security concerns have led to the wide adoption of encrypted protocols, making encrypted traffic a major portion of overall communications online. The transition into more secure protocols poses significant challenges for internet service providers to utilize traditional traffic classification techniques in order to guarantee the Quality of Service (QoS), Quality of Experience (QoE), and cyber-security of their customers. In this work, we introduce two methods, namely STFT-TC and DWT-TC, leveraging compact time-series representation coupled with well-known techniques from the field of Digital Signal Processing (DSP): the short-time Fourier transform (STFT) and the discrete wavelet transform (DWT). The STFT-TC method extracts a suite of statistical and spectral features from the magnitude spectrogram, offering a fresh perspective on interpreting and classifying encrypted traffic. The DWT-TC method extracts statistical features from the wavelet coefficients and incorporates unique characteristics that describe the signal's shape and energy distribution. Evaluating our methods on two public QUIC datasets demonstrated improvements in accuracy of up to 5.7%. Similarly, the F1-scores also showed enhancements, with increments of up to 5.9% for the same datasets.

Artificial intelligence has made significant progress in the last decade, leading to a rise in the popularity of model sharing. The model zoo ecosystem, a repository of pre-trained AI models, has advanced the AI open-source community and opened new avenues for cyber risks. Malicious attackers can exploit shared models to launch cyber-attacks. This work focuses on the steganalysis of injected malicious Least Significant Bit (LSB) steganography into AI models, and it is the first work focusing on AI model attacks. In response to this threat, this paper presents a steganalysis method specifically tailored to detect and mitigate malicious LSB steganography attacks based on supervised and unsupervised AI detection steganalysis methods. Our proposed technique aims to preserve the integrity of shared models, protect user trust, and maintain the momentum of open collaboration within the AI community. In this work, we propose 3 steganalysis methods and open source our code. We found that the success of the steganalysis depends on the LSB attack location. If the attacker decides to exploit the least significant bits in the LSB, the ability to detect the attacks is low. However, if the attack is in the most significant LSB bits, the attack can be detected with almost perfect accuracy.

Content Disarm and Reconstruction (CDR) is a zero-trust file methodology that proactively extracts threat attack vectors from documents and media files. While there is extensive literature on CDR that emphasizes its importance, a detailed discussion of how the CDR process works, its effectiveness and drawbacks is lacking. Therefore, this paper presents DeepCDR, the first CDR system in which the validation, the prevention rate, and the received visual quality effect of disarming and reconstruction are presented and measured. The effectiveness of the novel DeepCDR against a well-known dataset shows that it disarmed not only the malicious components, but the reconstructed file is also usable and functional. Since CDRs rely on understanding the file format, any CDR solution should handle each supported file type separately due to the vast difference in each format. Hence, this paper focuses on the Rich Text Format file type that is commonly exploited by attackers.

The world of malware is shifting towards using encrypted traffic. While encryption improves the privacy of users, it brings challenges in the fields of QoS, QoE, and cybersecurity. Recent state-of-the-art Deep-Learning architectures for encrypted traffic classifications demonstrated superb results in tasks of traffic categorization over encrypted traffic. In this paper, we leverage the feasibility to use such architectures for the tasks of malware detection and classification to gain insights into how well these architectures perform in the domain of malware traffic. Specifically, we present a Deep-Learning model for malware traffic detection and classification (MalDIST), which outperforms both classical ML and DL malware traffic classification models both in terms of detection and classification.

Desktops and laptops can be maliciously exploited to violate privacy. There are two main types of attack scenarios: active and passive. In this paper, we consider the passive scenario where the adversary does not interact actively with the device, but he is able to eavesdrop on the network traffic of the device from the network side. Most of the internet traffic is encrypted and thus passive attacks are challenging. In this paper, we show that an external attacker can identify the operating system, browser and application of HTTP encrypted traffic (HTTPS). To the best of our knowledge, this is the first work that shows this. We provide a large data set of more than 20000 examples for this task. Additionally, we suggest new features for this task.We run a through a set of experiments, which shows that our classification accuracy is 96.06%.

Desktops can be exploited to violate privacy. There are two main types of attack scenarios: active and passive. We consider the passive scenario where the adversary does not interact actively with the device, but is able to eavesdrop on the network traffic of the device from the network side. In the near future, most Internet traffic will be encrypted and thus passive attacks are challenging. Previous research has shown that information can be extracted from encrypted multimedia streams. This includes video title classification of non HTTP adaptive streams. This paper presents algorithms for encrypted HTTP adaptive video streaming title classification. We show that an external attacker can identify the video title from video HTTP adaptive streams sites, such as YouTube. To the best of our knowledge, this is the first work that shows this. We provide a large data set of 15000 YouTube video streams of 2100 popular video titles that was collected under real-world network conditions. We present several machine learning algorithms for the task and run a thorough set of experiments, which shows that our classification accuracy is higher than 95%. We also show that our algorithms are able to classify video titles that are not in the training set as unknown and some of the algorithms are also able to eliminate false prediction of video titles and instead report unknown. Finally, we evaluate our algorithm robustness to delays and packet losses at test time and show that our solution is robust to these changes.

Dynamic Adaptive Streaming over HTTP (DASH) is a new and promising streaming protocol, based on the Media Presentation Description (MPD) specification. With the increasing demand for Internet video streaming, methods for profiting from video services are gaining increased interest. In this paper, we propose a novel algorithm for server side video ad insertion over the DASH standard. The proposed method is compatible with DASH and does not require any modifications at the client side, such as dedicated players, or any modification in the MPD definitions. Furthermore, the algorithm enables the client to always receive the advertisements regardless of his player software. Our novel approach considers the MPD URLs as encrypted URLs for pointer mapping. This will allow for deciding in real time whether a specific URL will point to an ad or to the original video stream segment. Therefore, the solution enables us to consider VOD ad insertion as similar to live ad insertion. In a comparison between the DASH video streaming server with ad insertion, as define in the standard, and our ad insertion solution, the results showed that our solution provide a dynamic ad insertion system while only slightly increasing the CPU load. As far as we know, this is the first DASH server side ad insertion solution for the ISO Base Media File Format (MPEG-4 part 12) container.

The increasing demand for video content and the fast adoption of HTTP Adaptive Streaming (HAS) has led to the need for sophisticated streaming optimization solutions. One of the main drawbacks of HAS is that the user is responsible for deciding which video quality to request without taking into account the server load, the number of users, fairness and more. Therefore, traffic shaping server, which takes these factors into account is needed. In this paper we present a HAS traffic shaping algorithm that in one hand tries to maximize user experience by providing the quality which is the closest to the one that the user requested while in other hand takes into account the server constrains. Simulation results show that the proposed solution effectively serves up to a 28% more users when the network is congested, while the users experienced an average bit-rate decreased up to 12% and the average PSNR decrease was 0.26 dB.

DASH is new ISO/IEC MPEG and 3GPP standard for HTTP multimedia streaming that begins to be widely accepted in the industry. DASH is design to be flexible and support various multimedia formats. DASH unify the proprietary adaptive streaming solutions and suggests differing between them by using different behavioral approaches, each one best suited for the specific streaming application. Each behavior is determined by Adaptation Logic (AL), which decides according to the estimation of the network conditions and buffer state what is the best suitable segment to be requested from the streaming server. This work presents the drawback of current DASH standard and its vulnerability to variable bit rate stream encoding. We have found that the advertised bit rate for each quality layer that was dictated by the Media Presentation Description (MPD) isn't accurate for VBR streaming. Moreover, we suggest an Adaptive Buffer Moving Median (ABMM) buffer sensitive adaptation logic that will support its bandwidth estimation decisions based on the client buffer redundancy. The new method was found to be suitable for mobile network traffic which is characterized with large fluctuations with network bandwidth. Our proposed solution showed more than 20 percent better average PSNR improvement compared to the original VLC plug-in rate adaptation logic.