As the quantity and complexity of network threats grow, Intrusion Detection Systems (IDSs) have become critical for securing networks. Achieving computer network intrusion detection with these IDSs requires high-level information technology and security expertise because malicious traffic has to be rigorously analyzed and the appropriate IDS rules written to effectively detect vulnerabilities that may potentially be exploited. However, incorrect IDS rules may produce numerous false positives, thereby degrading the performance of the IDS, and even worse, paralyzing the network. In this paper, we present a novel approach that exploits the Latent Dirichle Allocation (LDA) algorithm to generate IDS rules. Our proposed method, called LDA-based Automatic Rule Generation (LARGen), automatically performs an analysis of the malicious traffic and extracts the appropriate attack signatures that will be used for IDS rules. LARGen first extracts multiple signature strings embedded in network flows. Then, the flows are classified based on the extracted signature strings, and key content strings for malicious traffic are identified through the LDA inferential topic model. Those key content strings are the core of an IDS rule that can detect malicious traffic. We study the effectiveness of LDA in the context of network attack signature generation via extensive experiments with real network trace data, consisting of both benign and malicious traffic. Experimental results confirm that threat rules generated from LARGen accurately detect every cyber attack with high accuracy.

With the increasing move towards wide band operation in recent Wi-Fi networks, the frequency diversity awareness has become critical for throughput optimization. To exploit frequency diversity in Wi-Fi channels, the access point should measure the channel quality and coordinate the channel contention for all the stations. However, there is a tradeoff between achieving the frequency diversity gain and sustaining protocol efficiency because the channel estimation and coordination consume time and frequency resource that ideally should be used for data transfer. In this paper, we present Diversity-aware Wi-Fi (D-Fi), a novel PHY/MAC protocol, that efficiently exploits frequency diversity. In particular, D-Fi leverages an OFDM-based Bloom filter that synergistically integrates two operations: (i) the channel quality estimation and (ii) the contention based channel allocation. D-Fi also employs a machine learning (ML) method to resolve the false-positive ambiguity caused by the Bloom filter. Furthermore, we develop a decentralized algorithm, called Kε-greedy, based on the Multi-Armed Bandit (MAB) framework, so that it achieves sub-optimal performance by studying the gain for exploring new channel quality information. We implement the prototype of D-Fi on the USRP/GNURadio to validate the feasibility of our work. The experiments and trace-driven simulations show that D-Fi provides up to 3 x throughput improvement compared to the existing solutions.

To exploit frequency diversity in Wi-Fi channels, instantaneous channel quality must be estimated. However, there is a trade-off between acquiring channel quality information and improving protocol efficiency because channel estimation consumes time and frequency resource that ideally should be used for data transfer. In this paper, we present D-Fi (Diversity-aware Wi-Fi), a novel Wi-Fi PHY/MAC protocol, that capitalizes on frequency diversity gains while sustaining protocol efficiency. The D-Fi design allows to estimate channel quality while D-Fi is performing channel contention using an OFDM-based Bloom filter. To resolve the ambiguity caused by the Bloom filter, we adopt two methods: (i) An analysis-based multi channel backoff method enables to explore/exploit frequency diversity while reducing the occurrence of the ambiguity. (ii) Applying machine learning (ML) methods to the D-Fi PHY/MAC protocol corrects the ambiguity taken place already and makes our protocol reliable. We have shown the feasibility of D-Fi by implementing it on the USRP/GNURadio platform. Experiments and trace-driven simulations show that D-Fi successfully achieves frequency diversity gains without losing improved protocol efficiency.

Network coding is a promising technology that increases the system throughput via reducing the number of transmissions for the packets delivered from the source node to the destination node in the saturated traffic scenario. Nevertheless, some packets can suffer from the metric of end-to-end delay. Since it takes the queuing delay in the intermediate node to wait for other packets to be encoded with (XOR). Therefore, in this paper, we analyze the delay according to the packet arrival rate and propose a new network coding scheme, iXOR (Intelligent XOR). It reduces the average delay even unsaturated traffic load through the Holding-χ strategy. Through an analysis and extensive simulations, we show that iXOR is better than the general forwarding scheme (FWD) without XOR and XOR without the holding-χ strategy, χ=0, in aspect of the average delay as well as the delivery ratio.