In this paper, we conduct a measurement study on operational 5G networks deployed across different frequency bands (mmWave and sub-6GHz) and server locations (mobile edge and Internet cloud). Specifically, we assess 5G performance in both uplink and downlink across multiple operators’ networks. We then carry out extensive comparisons of transport-layer protocols using ten different algorithms in full-fledged 5G networks, including an edge computing environment. Finally, we evaluate representative mobile applications over the 5G network with and without edge servers. Our comprehensive measurements provide several insights that affect the experience of 5G users: (i) With a 5G edge server, existing TCP congestion control algorithms can achieve throughput up to 1.8Gbps with only a single flow. (ii) The maximum TCP receive buffer size, which is set by off-the-shelf 5G phones, can limit the throughput performance of 5G networks, which is not observed in 4G LTE-A networks. (iii) Despite significant latency gains in download-centric applications, the 5G edge service provides limited benefits to CPU-intensive tasks or those that use significant uplink bandwidth. To our knowledge, this is the first measurement-driven understanding of 5G edge computing “in the wild,” which can provide an answer to how edge computing would perform in real 5G networks.

As video calls and personal broadcasting become popular, the demand for mobile live streaming over cellular uplink channels is growing fast. However, current live streaming solutions are known to suffer from frequent uplink throughput fluctuations causing unnecessary video stalls and quality drops. As a remedy to this problem, we propose PERCEIVE, a deep learning-based uplink throughput prediction framework. PERCEIVE exploits a 2-stage LSTM (Long Short Term Memory) design and makes throughput predictions for the next 100ms. Our extensive evaluations show that PERCEIVE, trained with LTE network traces from three major operators in the U.S., achieves high accuracy in the uplink throughput prediction with only 7.67% mean absolute error and outperforms existing prediction techniques. We integrate PERCEIVE with WebRTC, a popular video streaming platform from Google, as a rate adaptation module. Our implementation on the Android phone demonstrates that it can improve PSNR by up to 6dB (4x) over the default WebRTC while providing less streaming latency.

Network-based malware classification plays an important role in improving system security than system-based malware classification. The vast majority of malware needs a network activity in order to accomplish its purpose (e.g., downloading malware, connecting to a C&C server, etc.). Many malware classification approaches based on network behavior have thus been proposed. Nevertheless, they merely rely on either a request URL or payload for signature matching. To classify the network activity of malware, the patterns of network behavior must be understood and the changes in behavior observed. Therefore, the sequence of flows and their correlation caused by the malware should be analysed. In this paper, we present a novel malware classification method based on clustering of flow features and sequence alignment algorithms for computing sequence similarity, which represents network behavior of malware. We focus on analysing the sequence similarity between the sequence patterns of malware traffic flow generated by executing malware on the dynamic analysing system. We also performed an evaluation by using malware traffic collected from a real environment. On the basis of our experimental results, we identified the most appropriate method for classifying malware by similarity of network activity.