Load Transformations and their Usage for Traffic Prediction and Understanding in Networks with Security Requirements

Team Leader

Prof. Dr. Georg Carle

Scientists

Gerhard Münz
Lothar Braun

Partners

Telecommunications And Computer Networks, University of Hamburg

Funding

Deutsche Forschungsgemeinschaft (German Research Foundation)

Project Time

01.11.2007 - 31.10.2010

Project Description

Realistic modeling and prediction of traffic in complex networking environments, as well as network monitoring and traffic analysis for traffic characterization and network security are two research areas with many unsolved problems. The LUPUS research project is to find novel modeling and analysis solutions by combining know-how and expertise of both areas. Work on new traffic models concentrates on the load transformation approach which allows translating arrival sequences at the application layer into arrival sequences at the network layer. With respect to traffic analysis, one research goal is to find ways to invert the load transformation in order to infer application layer loads from monitored traffic. Further traffic analysis methods to be considered are network data mining and payload-based traffic identification. Traffic analysis relies on monitoring data collected with help of adaptive passive and active network monitoring techniques. The scientific outcome of the project is to enable improved security management and performance monitoring in communication networks.

Research Topics

Traffic Measurement
The open-source monitoring toolkit VERMONT provides the basis for packet and flow-based traffic measurements in LUPUS. VERMONT deploys the IPFIX protocol to transport traffic measurement data from an observation point to a remote collector.
Within the LUPS project, VERMONT has been extended to protect the IPFIX data transfer using DTLS for UDP and SCTP. We discuss issues and recommendations regarding the implementation of DTLS for IPFIX in an Internet draft. Further research activities deal with scalable connection-based packet sampling which can be used in combination with signature detection and deep packet inspection, as well as traffic monitoring in 10GE network.

Traffic Classification
We are working on statistical traffic classification methods which do not rely on the inspection of packet payload. One of our classification approaches is based on visible Markov models which, in contrast to hidden Markov models (HMMs), are easier to estimate. Moreover, we are studying whether the transformation of packet traces into request sequences on higher protocol layers allows improving the classification results.