Automatic network traffic classification

The thesis addresses a number of critical problems in regard to fully automating the process of network traffic classification and protocol identification. Several effective solutions based on statistical analysis and machine learning techniques are proposed, which significantly reduce the requirements for human interventions in network traffic classification systems.

2Loud?: Community mapping of exposure to traffic noise with mobile phones

Abstract: Despite ample medical evidence of the adverse impacts of traffic noise on health, most policies for traffic noise management are arbitrary or incomplete, resulting in serious social and economic impacts. Surprisingly, there is limited information about citizen’s exposure to traffic noise worldwide. This paper presents the 2Loud? mobile phone application, developed and tested as a methodology to monitor, assess and map the level of exposure to traffic noise of citizens with focus on the night period and indoor locations, since sleep disturbance is one of the major triggers for ill health related to traffic noise. Based on a community participation experiment using the 2Loud? mobile phone application in a region close to freeways in Australia, the results of this research indicates a good level of accuracy for the noise monitoring by mobile phones and also demonstrates significant levels of indoor night exposure to traffic noise in the study area. The proposed methodology, through the data produced and the participatory process involved, can potentially assist in planning and management towards healthier urban environments.

Participatory sensing and education: helping the community mitigate sleep disturbance from traffic noise

Purpose – This paper aims to present a project in Australia, where participants use smartphones to measure the level of traffic noise in their homes. Through the data collected, participants learn if they are subjected to sleep disturbances and, if so, understand how they can manage the issue to protect their health. The project also has a secondary purpose: the local council would like to engage its community through the exercise and be seen as acting on the community’s problems.

Detection and defense of application-layer DDoS attacks in backbone web traffic

Web servers are usually located in a well-organized data center where these servers connect with the outside Internet directly through backbones. Meanwhile, the application-layer distributed denials of service (AL-DDoS) attacks are critical threats to the Internet, particularly to those business web servers. Currently, there are some methods designed to handle the AL-DDoS attacks, but most of them cannot be used in heavy backbones. In this paper, we propose a new method to detect AL-DDoS attacks. Our work distinguishes itself from previous methods by considering AL-DDoS attack detection in heavy backbone traffic. Besides, the detection of AL-DDoS attacks is easily misled by flash crowd traffic. In order to overcome this problem, our proposed method constructs a Real-time Frequency Vector (RFV) and real-timely characterizes the traffic as a set of models. By examining the entropy of AL-DDoS attacks and flash crowds, these models can be used to recognize the real AL-DDoS attacks. We integrate the above detection principles into a modularized defense architecture, which consists of a head-end sensor, a detection module and a traffic filter. With a swift AL-DDoS detection speed, the filter is capable of letting the legitimate requests through but the attack traffic is stopped. In the experiment, we adopt certain episodes of real traffic from Sina and Taobao to evaluate our AL-DDoS detection method and architecture. Compared with previous methods, the results show that our approach is very effective in defending AL-DDoS attacks at backbones. © 2013 Elsevier B.V. All rights reserved.

Internet traffic classification using constrained clustering

Statistics-based Internet traffic classification using machine learning techniques has attracted extensive research interest lately, because of the increasing ineffectiveness of traditional port-based and payload-based approaches. In particular, unsupervised learning, that is, traffic clustering, is very important in real-life applications, where labeled training data are difficult to obtain and new patterns keep emerging. Although previous studies have applied some classic clustering algorithms such as K-Means and EM for the task, the quality of resultant traffic clusters was far from satisfactory. In order to improve the accuracy of traffic clustering, we propose a constrained clustering scheme that makes decisions with consideration of some background information in addition to the observed traffic statistics. Specifically, we make use of equivalence set constraints indicating that particular sets of flows are using the same application layer protocols, which can be efficiently inferred from packet headers according to the background knowledge of TCP/IP networking. We model the observed data and constraints using Gaussian mixture density and adapt an approximate algorithm for the maximum likelihood estimation of model parameters. Moreover, we study the effects of unsupervised feature discretization on traffic clustering by using a fundamental binning method. A number of real-world Internet traffic traces have been used in our evaluation, and the results show that the proposed approach not only improves the quality of traffic clusters in terms of overall accuracy and per-class metrics, but also speeds up the convergence.

On addressing the imbalance problem : A correlated KNN approach for network traffic classification

With the arrival of big data era, the Internet traffic is growing exponentially. A wide variety of applications arise on the Internet and traffic classification is introduced to help people manage the massive applications on the Internet for security monitoring and quality of service purposes. A large number of Machine Learning (ML) algorithms are introduced to deal with traffic classification. A significant challenge to the classification performance comes from imbalanced distribution of data in traffic classification system. In this paper, we proposed an Optimised Distance-based Nearest Neighbor (ODNN), which has the capability of improving the classification performance of imbalanced traffic data. We analyzed the proposed ODNN approach and its performance benefit from both theoretical and empirical perspectives. A large number of experiments were implemented on the real-world traffic dataset. The results show that the performance of “small classes” can be improved significantly even only with small number of training data and the performance of “large classes” remains stable.

Internet traffic clustering with side information

Internet traffic classification is a critical and essential functionality for network management and security systems. Due to the limitations of traditional port-based and payload-based classification approaches, the past several years have seen extensive research on utilizing machine learning techniques to classify Internet traffic based on packet and flow level characteristics. For the purpose of learning from unlabeled traffic data, some classic clustering methods have been applied in previous studies but the reported accuracy results are unsatisfactory. In this paper, we propose a semi-supervised approach for accurate Internet traffic clustering, which is motivated by the observation of widely existing partial equivalence relationships among Internet traffic flows. In particular, we formulate the problem using a Gaussian Mixture Model (GMM) with set-based equivalence constraint and propose a constrained Expectation Maximization (EM) algorithm for clustering. Experiments with real-world packet traces show that the proposed approach can significantly improve the quality of resultant traffic clusters. © 2014 Elsevier Inc.

A review on computational intelligence methods for controlling traffic signal timing

Urban traffic as one of the most important challenges in modern city life needs practically effective and efficient solutions. Artificial intelligence methods have gained popularity for optimal traffic light control. In this paper, a review of most important works in the field of controlling traffic signal timing, in particular studies focusing on Q-learning, neural network, and fuzzy logic system are presented. As per existing literature, the intelligent methods show a higher performance compared to traditional controlling methods. However, a study that compares the performance of different learning methods is not published yet. In this paper, the aforementioned computational intelligence methods and a fixed-time method are implemented to set signals times and minimize total delays for an isolated intersection. These methods are developed and compared on a same platform. The intersection is treated as an intelligent agent that learns to propose an appropriate green time for each phase. The appropriate green time for all the intelligent controllers are estimated based on the received traffic information. A comprehensive comparison is made between the performance of Q-learning, neural network, and fuzzy logic system controller for two different scenarios. The three intelligent learning controllers present close performances with multiple replication orders in two scenarios. On average Q-learning has 66%, neural network 71%, and fuzzy logic has 74% higher performance compared to the fixed-time controller.

Congestion pricing and active transport - evidence from five opportunities for natural experiment

Congestion pricing schemes have been implemented in cities worldwide as a means of addressing externalities associated with inefficient price signals in transport systems. Limited evidence exists however on the secondary impacts of these schemes, which may include both environmental and health benefits associated with a resultant reduction in motor vehicle usage. There is increasing recognition that transport behaviours may play a role as opportunistic population level targets to reduce physical inactivity. Yet limited evidence currently exists on the effectiveness of transport interventions, such as congestion pricing schemes, for improving physical activity levels.This study aims to examine the physical activity effects of congestion pricing, with the health benefits of physical activity well established. Congestion pricing schemes implemented internationally were considered as 'natural experiments' and evidence of modal shift from vehicle to active forms of transport or physical activity effect was reviewed. Twelve studies were included from a search of peer-reviewed and 'grey' literature, with overall evidence for a physical activity or modal shift effect considered weak. The quality of the available evidence was also considered to be low.This is not to say that congestion pricing schemes may not have important secondary physical activity related health benefits. Instead, this review highlights the paucity of evidence that has been collected from real-world implementation of congestion pricing schemes. Given the growing recognition of the importance of distal mediators and determinants of health and the need for an 'all-of-government' approach more and better quality evidence of effectiveness of transport interventions for a broad range of outcomes, including health, is required. Significant barriers to the collection of such evidence exist, with strategies for overcoming some of these barriers identified. Only with a better understanding of the full range of potential health impacts can transport policy be fully utilised as a tool for population health.

Do the numbers and locations of road-killed anuran carcasses accurately reflect impacts of vehicular traffic?

Road-killed animals are easy and inexpensive to survey, and may provide information about species distributions, abundances, and mortality rates. As with any sampling method, however, we need to explore methodological biases in such data. First, how does an animal's behavior (e.g., use of the center vs. periphery of the road) influence its vulnerability to vehicular traffic? Second, how rapidly do post-mortem processes (scavenging by other animals, destruction or displacement by subsequent vehicles) change the numbers and locations of roadkills? Our surveys of anurans on a highway in tropical Australia show that different anuran species are distributed in different ways across the width of the road, and that locations of live versus dead animals sometimes differ within a species. Experimental trials show that location on the road affects the probability of being hit by a vehicle, with anurans in the middle of the road begin hit 35% more often than anurans on the edges; thus, center-using species are more likely to be hit than edge-using taxa. The magnitude of post-mortem displacement and destruction by subsequent vehicles depended on anuran species and body size. The mean parallel displacement distance was 122.7 cm, and carcasses of thin-skinned species exhibited greater post-mortem destruction. Scavenging raptors removed 73% of carcasses, most within a few hours of sunrise. Removal rates were biased with respect to size and species. Overall, our studies suggest that investigators should carefully evaluate potential biases before using roadkill counts to estimate underlying animal abundances or mortality rates.

Association between perception of fault for the crash and function, return to work and health status 1 year after road traffic injury: a registry-based cohort study

Objectives To establish the association between the patient's perception of fault for the crash and 12-month outcomes after non-fatal road traffic injury.Setting Two adult major trauma centres, one regional trauma centre and one metropolitan trauma centre in Victoria, Australia.Participants 2605 adult, orthopaedic trauma patients covered by the state's no-fault third party insurer for road traffic injury, injured between September 2010 and February 2014.Outcome measures EQ-5D-3L, return to work and functional recovery (Glasgow Outcome Scale—Extended score of upper good recovery) at 12 months postinjury.Results After adjusting for key confounders, the adjusted relative risk (ARR) of a functional recovery (0.57, 95% CI 0.46 to 0.69) and return to work (0.92, 95% CI 0.86 to 0.99) were lower for the not at fault compared to the at fault group. The ARR of reporting problems on EQ-5D items was 1.20–1.35 times higher in the not at fault group. Conclusions Patients who were not at fault, or denied being at fault despite a police report of fault, experienced poorer outcomes than the at fault group. Attributing fault to others was associated with poorer outcomes. Interventions to improve coping, or to resolve negative feelings from the crash, could facilitate better outcomes in the future.

Aggregation on the fly: Reducing traffic for big data in the cloud

As a leading framework for processing and analyzing big data, MapReduce is leveraged by many enterprises to parallelize their data processing on distributed computing systems. Unfortunately, the all-to-all data forwarding from map tasks to reduce tasks in the traditional MapReduce framework would generate a large amount of network traffic. The fact that the intermediate data generated by map tasks can be combined with significant traffic reduction in many applications motivates us to propose a data aggregation scheme for MapReduce jobs in cloud. Specifically, we design an aggregation architecture under the existing MapReduce framework with the objective of minimizing the data traffic during the shuffle phase, in which aggregators can reside anywhere in the cloud. Some experimental results also show that our proposal outperforms existing work by reducing the network traffic significantly.