• Proceedings of the Korean Institute of Information and Commucation Sciences Conference
• /
• 2017.05a
• /
• pp.637-638
• /
• 2017

The MQTT broker has problems such as packet loss and delay due to degraded network performance according to traffic. However, the MQTT broker does not support a separate interface for traffic measurement, so it can not cope with network degradation. In this paper, we propose a system for traffic measurement of MQTT broker. The proposed system uses the jnetpcap library to measure all traffic to and from the MQTT broker.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.5 no.2
• /
• pp.313-329
• /
• 2011

To provide a seamless network to customers, Internet service providers must promptly detect and control abnormal traffic. One approach is to shorten the traffic information measurement cycle. However, performance degradation is inevitable if traffic measurement servers merely shorten the cycle and measure all traffic. This paper presents a software architecture that can measure traffic more frequently without degrading performance by estimating the level of abnormal traffic. The algorithm in the architecture estimates the values of the interface group objects in MIB by using the IP group objects thereby reducing the number of measurements and the size of measured data. We evaluated this architecture on part of Internet service provider's IP network. When the traffic was measured 5 times more than before, the CPU usage and TPS of the proposed scheme was 7% and 41% less than that of the original scheme while the false positive rate and false negative rate were 3.2% and 2.7% respectively.

• Korean Journal of Artificial Intelligence
• /
• v.11 no.2
• /
• pp.19-27
• /
• 2023

In recent times, an exponential increase in Internet traffic has been observed as a result of advancing development of the Internet of Things, mobile networks with sensors, and communication functions within various devices. Further, the COVID-19 pandemic has inevitably led to an explosion of social network traffic. Within this context, considerable attention has been drawn to research on network traffic analysis based on machine learning. In this paper, we design and develop a new machine learning framework for network traffic analysis whereby normal and abnormal traffic is distinguished from one another. To achieve this, we combine together well-known machine learning algorithms and network traffic analysis techniques. Using one of the most widely used datasets KDD CUP'99 in the Weka and Apache Spark environments, we compare and investigate results obtained from time series type analysis of various aspects including malicious codes, feature extraction, data formalization, network traffic measurement tool implementation. Experimental analysis showed that while both the logistic regression and the support vector machine algorithm were excellent for performance evaluation, among these, the logistic regression algorithm performs better. The quantitative analysis results of our proposed machine learning framework show that this approach is reliable and practical, and the performance of the proposed system and another paper is compared and analyzed. In addition, we determined that the framework developed in the Apache Spark environment exhibits a much faster processing speed in the Spark environment than in Weka as there are more datasets used to create and classify machine learning models.

• Journal of KIISE:Information Networking
• /
• v.37 no.1
• /
• pp.27-34
• /
• 2010

In this paper, we examine a long-range dependence in an active measurement of a network traffic which has been a well known characteristic from analyses of a passive network traffic measurement. To this end, we utilize RTT(Round Trip Time), which is a typical active measurement measured by PingER project, and perform a relevant analysis to a time series of both RTT and its volatilities. The RTT time series exhibits a long-range dependence or a 1/f noise. The volatilities, defined as a higher-order variation, follow a log-normal distribution. Furthermore, volatilities show a long-range dependence in relatively short time intervals, and a long-range dependence and/or 1/f noise in long time intervals. From this study, we find that the long-range dependence is a characteristic of not only a passive traffic measurement but also an active measurement of network traffic such as RTT. From these findings, we can infer that the long-range dependence is a characteristic of network traffic independent of a type of measurements. In particular, an active measurement exhibits a 1/f noise which cannot be usually found in a passive measurement.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.28 no.11B
• /
• pp.1038-1049
• /
• 2003

Exactly measuring traffic load is the basis for efficient traffic engineering. However, precise traffic measurement involves inspecting every packet traversing a lint resulting in significant overhead on routers with high-speed links. Sampling techniques are proposed as an alternative way to reduce the measurement overhead. But, since sampling inevitably accompany with error, there should be a way to control, or at least limit, the error for traffic engineering applications to work correctly. In this paper, we address the problem of bounding sampling error within a pre-specified tolerance level. We derive a relationship between the number of samples, the accuracy of estimation and the squared coefficient of variation of packet size distribution. Based on this relationship, we propose an adaptive random sampling technique that determines the minimum sampling probability adaptively according to traffic dynamics. Using real network traffic traces, we show that the proposed adaptive random sampling technique indeed produces the desired accuracy, while also yielding significant reduction in the amount of traffic samples.

• Proceedings of the Korean Institute of Navigation and Port Research Conference
• /
• 1996.09a
• /
• pp.31-36
• /
• 1996

It is important to measure the vehicle flow in controlling the traffic system. This report deals with a traffic flow measurement system using the differential spatial filters. This system can measure the velocity the length and height profile of the vehicle. The detector is located above the traffic lane. This provides the system with the following advantages : one is that each lane can be monitored without an influence of the other lanes the other is that the system construction is simple and can be set easily.

• Journal of the Institute of Convergence Signal Processing
• /
• v.2 no.2
• /
• pp.28-38
• /
• 2001

Traffic information can be broadly categorized into point information and spatial information. Point information can be obtained by chocking only the presence of vehicles at prespecified points(small area), whereas spatial information can be obtained by monitoring large area of traffic scene. To obtain spatial information by image processing, we need to track vehicles in the whole area of traffic scene. Image detector system based on global tracking consists of video input, vehicle detection, vehicle tracking, and traffic information measurement. For video input, conventional approaches used auto iris which is very poor in adaptation for sudden brightness change. Conventional methods for background generation do not yield good results in intersections with heave traffic and most of the early studies measure only point information. In this paper, we propose user-controlled iris method to remedy the deficiency of auto iris and design flame difference-based background generation method which performs far better in complicated intersections. We also propose measurement method for spatial traffic information such as interval volume/lime/velocity, queue length, and turning/forward traffic flow. We obtain measurement accuracy of 95%∼100% when applying above mentioned new methods.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.11B
• /
• pp.750-757
• /
• 2005

This paper reports on the study of P2P traffic behaviors in a high-speed campus network under a simple firewall which drops packets with default port numbers for the well-blown P2P applications. Among several ways of detecting P2P traffic, the easiest method is to filter out packets with the default port number of each P2P application. After deploying the port-based firewall against P2P-traffic, it is expected that the amount of P2P traffic will be decreased. However, during the eight-month measurement period, three new commercial P2P applications have been identified and their traffic usages have reached up to $30/5.6\%$ of the total outbound/inbound traffic volumes at the end of the measurement period. In addition, the most famous P2P application, eDonkey, has adapted and has escaped detection through port hopping. The measurement result shows that the amount of eDonkey traffic is around $6.7/4.0\%$ of the total outbound/inbound traffic volume. From the measurement results, it is observed that the port-based firewall is not effective to limit the usage of P2P applications and that the P2P traffic is steadily growing due to not only the evolution of existing P2P applications such as port hopping but also appearances of new P2P applications.

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.12 no.10
• /
• pp.4678-4702
• /
• 2018

Traffic Matrix estimation has always caught attention from researchers for better network management and future planning. With the advent of high traffic loads due to Cloud Computing platforms and Software Defined Networking based tunable routing and traffic management algorithms on the Internet, it is more necessary as ever to be able to predict current and future traffic volumes on the network. For large networks such origin-destination traffic prediction problem takes the form of a large under- constrained and under-determined system of equations with a dynamic measurement matrix. Previously, the researchers had relied on the assumption that the measurement (routing) matrix is stationary due to which the schemes are not suitable for modern software defined networks. In this work, we present our Compressed Sensing with Dynamic Model Estimation (CS-DME) architecture suitable for modern software defined networks. Our main contributions are: (1) we formulate an approach in which measurement matrix in the compressed sensing scheme can be accurately and dynamically estimated through a reformulation of the problem based on traffic demands. (2) We show that the problem formulation using a dynamic measurement matrix based on instantaneous traffic demands may be used instead of a stationary binary routing matrix which is more suitable to modern Software Defined Networks that are constantly evolving in terms of routing by inspection of its Eigen Spectrum using two real world datasets. (3) We also show that linking this compressed measurement matrix dynamically with the measured parameters can lead to acceptable estimation of Origin Destination (OD) Traffic flows with marginally poor results with other state-of-art schemes relying on fixed measurement matrices. (4) Furthermore, using this compressed reformulated problem, a new strategy for selection of vantage points for most efficient traffic matrix estimation is also presented through a secondary compression technique based on subset of link measurements. Experimental evaluation of proposed technique using real world datasets Abilene and GEANT shows that the technique is practical to be used in modern software defined networks. Further, the performance of the scheme is compared with recent state of the art techniques proposed in research literature.

• KIPS Transactions on Computer and Communication Systems
• /
• v.2 no.10
• /
• pp.421-426
• /
• 2013

As a greater amount of traffic have been generated on the Internet, it becomes more important to know the size of each flow. Many research studies have been conducted on the traffic measurement, and mostly they have focused on how to increase the measurement accuracy with a limited amount of memory. In this paper, we propose an explicit flow labeling technique that can be used to find out the names of the top flows and to increase the counting upper bound of the existing scheme. The labeling technique is applied to CSM (Counter Sharing Method), the most recent traffic measurement algorithm, and the performance is evaluated using the CAIDA dataset.