Clasificación de tráfico de Internet mediante análisis de datos

Poder clasificar de manera precisa la aplicación o programa del que provienen los flujos que conforman el tráfico de uso de Internet dentro de una red permite tanto a empresas como a organismos una útil herramienta de gestión de los recursos de sus redes, así como la posibilidad de establecer políticas de prohibición o priorización de tráfico específico. La proliferación de nuevas aplicaciones y de nuevas técnicas han dificultado el uso de valores conocidos (well-known) en puertos de aplicaciones proporcionados por la IANA (Internet Assigned Numbers Authority) para la detección de dichas aplicaciones. Las redes P2P (Peer to Peer), el uso de puertos no conocidos o aleatorios, y el enmascaramiento de tráfico de muchas aplicaciones en tráfico HTTP y HTTPS con el fin de atravesar firewalls y NATs (Network Address Translation), entre otros, crea la necesidad de nuevos métodos de detección de tráfico. El objetivo de este estudio es desarrollar una serie de prácticas que permitan realizar dicha tarea a través de técnicas que están más allá de la observación de puertos y otros valores conocidos. Existen una serie de metodologías como Deep Packet Inspection (DPI) que se basa en la búsqueda de firmas, signatures, en base a patrones creados por el contenido de los paquetes, incluido el payload, que caracterizan cada aplicación. Otras basadas en el aprendizaje automático de parámetros de los flujos, Machine Learning, que permite determinar mediante análisis estadísticos a qué aplicación pueden pertenecer dichos flujos y, por último, técnicas de carácter más heurístico basadas en la intuición o el conocimiento propio sobre tráfico de red. En concreto, se propone el uso de alguna de las técnicas anteriormente comentadas en conjunto con técnicas de minería de datos como son el Análisis de Componentes Principales (PCA por sus siglas en inglés) y Clustering de estadísticos extraídos de los flujos procedentes de ficheros de tráfico de red. Esto implicará la configuración de diversos parámetros que precisarán de un proceso iterativo de prueba y error que permita dar con una clasificación del tráfico fiable. El resultado ideal sería aquel en el que se pudiera identificar cada aplicación presente en el tráfico en un clúster distinto, o en clusters que agrupen grupos de aplicaciones de similar naturaleza. Para ello, se crearán capturas de tráfico dentro de un entorno controlado e identificando cada tráfico con su aplicación correspondiente, a continuación se extraerán los flujos de dichas capturas. Tras esto, parámetros determinados de los paquetes pertenecientes a dichos flujos serán obtenidos, como por ejemplo la fecha y hora de llagada o la longitud en octetos del paquete IP. Estos parámetros serán cargados en una base de datos MySQL y serán usados para obtener estadísticos que ayuden, en un siguiente paso, a realizar una clasificación de los flujos mediante minería de datos. Concretamente, se usarán las técnicas de PCA y clustering haciendo uso del software RapidMiner. Por último, los resultados obtenidos serán plasmados en una matriz de confusión que nos permitirá que sean valorados correctamente. ABSTRACT. Being able to classify the applications that generate the traffic flows in an Internet network allows companies and organisms to implement efficient resource management policies such as prohibition of specific applications or prioritization of certain application traffic, looking for an optimization of the available bandwidth. The proliferation of new applications and new technics in the last years has made it more difficult to use well-known values assigned by the IANA (Internet Assigned Numbers Authority), like UDP and TCP ports, to identify the traffic. Also, P2P networks and data encapsulation over HTTP and HTTPS traffic has increased the necessity to improve these traffic analysis technics. The aim of this project is to develop a number of techniques that make us able to classify the traffic with more than the simple observation of the well-known ports. There are some proposals that have been created to cover this necessity; Deep Packet Inspection (DPI) tries to find signatures in the packets reading the information contained in them, the payload, looking for patterns that can be used to characterize the applications to which that traffic belongs; Machine Learning procedures work with statistical analysis of the flows, trying to generate an automatic process that learns from those statistical parameters and calculate the likelihood of a flow pertaining to a certain application; Heuristic Techniques, finally, are based in the intuition or the knowledge of the researcher himself about the traffic being analyzed that can help him to characterize the traffic. Specifically, the use of some of the techniques previously mentioned in combination with data mining technics such as Principal Component Analysis (PCA) and Clustering (grouping) of the flows extracted from network traffic captures are proposed. An iterative process based in success and failure will be needed to configure these data mining techniques looking for a reliable traffic classification. The perfect result would be the one in which the traffic flows of each application is grouped correctly in each cluster or in clusters that contain group of applications of similar nature. To do this, network traffic captures will be created in a controlled environment in which every capture is classified and known to pertain to a specific application. Then, for each capture, all the flows will be extracted. These flows will be used to extract from them information such as date and arrival time or the IP length of the packets inside them. This information will be then loaded to a MySQL database where all the packets defining a flow will be classified and also, each flow will be assigned to its specific application. All the information obtained from the packets will be used to generate statistical parameters in order to describe each flow in the best possible way. After that, data mining techniques previously mentioned (PCA and Clustering) will be used on these parameters making use of the software RapidMiner. Finally, the results obtained from the data mining will be compared with the real classification of the flows that can be obtained from the database. A Confusion Matrix will be used for the comparison, letting us measure the veracity of the developed classification process.

Introduction to Special issue on Reconfigurable computing and FPGAs

During the last three decades, FPGA technology has quickly evolved to become a major subject of research in computer and electrical engineering as it has been identified as a powerful alternative for creating highly efficient computing systems. FPGA devices offer substantial performance improvements when compared against traditional processing architectures via custom design and reconfiguration capabilities.

Uncertainty in Structural Interpretation : Lessons to be learnt

Peer reviewed

Do pingers cause stress in fish? An experimental tank study with European sardine, Sardina pilchardus (Walbaum, 1792) (Actinopterygii, Clupeidae), exposed to a 70 kHz dolphin pinger

Date of acceptance: 06/12/2014 Acknowledgments The study was funded by the Portuguese Ministry of Science (Fundac¸a˜o para a Cieˆncia e Tecnologia– FCT) through a PhD Grant of SG (SFRH/BD/47931/2008). We would like to thank the captain of the purse-seiner (Jose´ Manuel Saveedra) and his crew for facilitating the capture and transport of live fish. Moreover, we want to thank Ana Marc¸alo for suggestions on the experimental design, Manuel Garci for technical advice on underwater video recordings and James Turner from the company Future Oceans for providing technical details on the 70 kHz dolphin pingers. We would also like to acknowledge the scientific advice of Dr. Jose´ Iglesias and the technical and logistic support for the preparation of the laboratory and the materials for tank experiments by Enrique Martı´nez Gonza´lez, Ricardo Pazo´and other staff at the aquaculture facilities of the Spanish Institute for Oceanography (IEO) and the Marine Sciences Station of Toralla (ECIMAT) in Vigo. Furthermore, we are grateful to Francisco de la Granda Grandoso for his practical assistance during the fish tank experiments and to Juan Santos Blanco for helping with statistical analysis. Finally, we would like to thank Pilar Riobo´ Agula, Amelia Fernandez Villamarin, Jose´ Franco Soler, Jose´ Luis Mun˜oz, Angela Benedetti, Marcos Antonio Lopez Patin˜o and Marta Conde Sieira for scientific advice and practical support with cortisol analysis and Rosana Rodrı´guez for preparing histological samples for us.

Peri-conceptional changes in maternal exposure to sewage sludge chemicals disturbs fetal thyroid gland development in sheep

Copyright © 2012 Elsevier Ireland Ltd. All rights reserved.

Respiratory microbiota resistance and resilience to pulmonary exacerbation and subsequent antimicrobial intervention

This study was supported by the UK Natural Environment Research Council (NE/H019456/1) to CJvdG, by the Wellcome Trust (WT 098051) to AWW and JP for sequencing costs, and by The Anna Trust (KB2008) to KDB. AWW and The Rowett Institute of Nutrition and Health, University of Aberdeen, receive core funding support from the Scottish Government Rural and Environmental Science and Analysis Service (RESAS). We thank Paul Scott, Richard Rance and the Wellcome Trust Sanger Institute’s sequencing team for generating 16S rRNA gene sequence data.

Non-pharmacological interventions to reduce the risk of diabetes in people with impaired glucose regulation : a systematic review and economic evaluation

Peer reviewed

Do the recent severe droughts in the Amazonia have the same period of length?

5 figures Acknowledgments This work was partially supported by the NNSFC (Grant Nos. 11305062, 11135001), the DFG/FAPESP (Grant No. IRTG 1740/TRP 2011/50151-0), and Government of the Russian Federation (Agreement No. 14.Z50.31.0033 with Institute of Applied Physics RAS). All data for this paper is properly cited and referred to in the reference list.

Evaluation of selected recurrence measures in discriminating pre-ictal and inter-ictal periods from epileptic EEG data

7 pages, 4 figures Acknowledgement We are grateful to M. Riedl and G. Ansmann for fruitful discussions and critical comments on earlier versions of the manuscript. This work was supported by the Volkswagen Foundation (Grant Nos. 88461, 88462, 88463, 85390, 85391 and 85392).

Using resilience to predict the effects of disturbance

Acknowledgements This work was funded by the Office of Naval Research (N00014-13-1-0696). We thank C Asher for her comments on an earlier version of this manuscript.

Case-based reasoning to support decision making for managing drinking water quality events in distribution systems

Peer reviewed

Stability threshold approach for complex dynamical systems

Acknowledgments This paper was developed within the scope of the IRTG 1740/TRP 2011/50151-0, funded by the DFG/FAPESP, and supported by the Government of the Russian Federation (Agreement No. 14.Z50.31.0033 with the Institute of Applied Physics RAS). The first author thanks Dr Roman Ovsyannikov for valuable discussions regarding estimation of the mistake probability.

Genetic and root phenotype diversity in Sri Lankan rice landraces may be related to drought resistance

Acknowledgements Mayuri Munasinghe was supported by a Commonwealth Scholarship (ref no. LKCS-2009-384). The development and use of the SNP chip was funded by a BBSRC grant BB/J003336/1. The authors thank Owen Price (University of Wollongong, Australia) for producing the coloured province map of Sri Lanka, Gareth Norton (Aberdeen) for merging the RDP1 SNP data with the Sri Lankan data and Tony Travis (Aberdeen) for help with PCA.

Limits to sustained energy intake XXIV : impact of suckling behaviour on the body temperatures of lactating female mice

We would like to thank the animal house staff and all members of the Energetics group for their invaluable help at various stages throughout the project. This work was supported by Natural Environment Research Council grant (NERC, NE/C004159/1). YG was supported by a scholarship from the rotary foundation. LV was supported by a Rubicon grant from the Netherlands Scientific Organisation (NWO).

Unified underpinning of human mobility in the real world and cyberspace

Acknowledgments This work is supported by National Science Foundation of China (Grant No. 61573064, 61074116 and 11547188), the Youth Scholars Program of Beijing Normal University (grant No. 2014NT38), and the Fundamental Research Funds for the Central Universities Beijing Nova Programme, China. XYY acknowledges the support from the National Natural Science Foundation of China (Grant No. 61304177) and the Fundamental Research Funds of BJTU (Grant No. 2015RC042).