Design and Implementation of Algorithms for Traffic Classification

Traffic analysis is the practice of using inherent characteristics of a network flow such as timings, sizes, and orderings of the packets to derive sensitive information about it. Traffic analysis techniques are used because of the extensive adoption of encryption and content-obfuscation mechanisms, making it impossible to infer any information about the flows by analyzing their content. In this thesis, we use traffic analysis to infer sensitive information for different objectives and different applications. Specifically, we investigate various applications: p2p cryptocurrencies, flow correlation, and messaging applications. Our goal is to tailor specific traffic analysis algorithms that best capture network traffic’s intrinsic characteristics in those applications for each of these applications. Also, the objective of traffic analysis is different for each of these applications. Specifically, in Bitcoin, our goal is to evaluate Bitcoin traffic’s resilience to blocking by powerful entities such as governments and ISPs. Bitcoin and similar cryptocurrencies play an important role in electronic commerce and other trust-based distributed systems because of their significant advantage over traditional currencies, including open access to global e-commerce. Therefore, it is essential to the consumers and the industry to have reliable access to their Bitcoin assets. We also examine stepping stone attacks for flow correlation. A stepping stone is a host that an attacker uses to relay her traffic to hide her identity. We introduce two fingerprinting systems, TagIt and FINN. TagIt embeds a secret fingerprint into the flows by moving the packets to specific time intervals. However, FINN utilizes DNNs to embed the fingerprint by changing the inter-packet delays (IPDs) in the flow. In messaging applications, we analyze the WhatsApp messaging service to determine if traffic leaks any sensitive information such as members’ identity in a particular conversation to the adversaries who watch their encrypted traffic. These messaging applications’ privacy is essential because these services provide an environment to dis- cuss politically sensitive subjects, making them a target to government surveillance and censorship in totalitarian countries. We take two technical approaches to design our traffic analysis techniques. The increasing use of DNN-based classifiers inspires our first direction: we train DNN classifiers to perform some specific traffic analysis task. Our second approach is to inspect and model the shape of traffic in the target application and design a statistical classifier for the expected shape of traffic. DNN- based methods are useful when the network is complex, and the traffic’s underlying noise is not linear. Also, these models do not need a meticulous analysis to extract the features. However, deep learning techniques need a vast amount of training data to work well. Therefore, they are not beneficial when there is insufficient data avail- able to train a generalized model. On the other hand, statistical methods have the advantage that they do not have training overhead

Evaluation of Supervised Machine Learning for Classifying Video Traffic

Operational deployment of machine learning based classifiers in real-world networks has become an important area of research to support automated real-time quality of service decisions by Internet service providers (ISPs) and more generally, network administrators. As the Internet has evolved, multimedia applications, such as voice over Internet protocol (VoIP), gaming, and video streaming, have become commonplace. These traffic types are sensitive to network perturbations, e.g. jitter and delay. Automated quality of service (QoS) capabilities offer a degree of relief by prioritizing network traffic without human intervention; however, they rely on the integration of real-time traffic classification to identify applications. Accordingly, researchers have begun to explore various techniques to incorporate into real-world networks. One method that shows promise is the use of machine learning techniques trained on sub-flows – a small number of consecutive packets selected from different phases of the full application flow. Generally, research on machine learning classifiers was based on statistics derived from full traffic flows, which can limit their effectiveness (recall and precision) if partial data captures are encountered by the classifier. In real-world networks, partial data captures can be caused by unscheduled restarts/reboots of the classifier or data capture capabilities, network interruptions, or application errors. Research on the use of machine learning algorithms trained on sub-flows to classify VoIP and gaming traffic has shown promise, even when partial data captures are encountered. This research extends that work by applying machine learning algorithms trained on multiple sub-flows to classification of video streaming traffic. Results from this research indicate that sub-flow classifiers have much higher and more consistent recall and precision than full flow classifiers when applied to video traffic. Moreover, the application of ensemble methods, specifically Bagging and adaptive boosting (AdaBoost) further improves recall and precision for sub-flow classifiers. Findings indicate sub-flow classifiers based on AdaBoost in combination with the C4.5 algorithm exhibited the best performance with the most consistent results for classification of video streaming traffic

A packet arrival model for Wolfenstein Enemy Territory online server discovery traffic

Clients for online multiplayer first person shooter (FPS) games typically discover game servers through a two-step process. Clients initially query a well-known master server for a list of currently registered game servers, and then sequentially probe each game server in the order they were returned by the master server. The starting and stopping of clients over time creates a 24-hour cycle of 'background noise' (probe traffic) impacting on registered game servers, independent of a given server's actual popularity with players. Based on over 10 million probe packets from two topologically distinct Wolfenstein Enemy Territory servers in 2006, this paper shows that probe arrivals are uncorrelated and exhibit exponentially distributed inter-probe intervals during both busiest and least-busy hours of the 24-hour cycle. A modified Laplace curve is then shown to be a reasonable estimator of lambada for the exponentially distributed probe arrivals during any hour of the day. The ability to easily synthesise probe traffic patterns will augment existing approaches to modeling the IP traffic loads experienced by game servers and network devices attached to game servers

Draw My Life: An analysis of the quantity and typology of emotional linguistic content in self-identified female and male YouTubers’ life narratives

La presente investigación tiene como objetivo determinar similitudes y diferencias en la cantidad y tipología de expresiones relacionadas con la emoción – referencias tanto implícitas como explícitas a “feelings, moods and all kinds of affective experience” [sentimientos, estados de ánimo y todo tipo de experiencias afectivas] (Mackenzie y Alba-Juez, 2019, p. 15) – de 100 personas autoidentificadas como mujeres (con un corpus de 248.613 palabras en total) y 100 personas autoidentificadas como hombres (con un corpus de 227.979 palabras en total) en sus vídeos autobiográficos dentro del género Draw My Life de YouTube. El proyecto se sustenta en la noción de Lutz (1990, p. 151) de que “any discourse on emotion is also, at least implicitly, a discourse on gender” [cualquier discurso sobre la emoción es también, al menos implícitamente, un discurso sobre género], con frecuentes suposiciones en investigaciones previas sobre las expectativas sociales relacionadas con la “greater emotional expressivity” [mayor expresividad emocional] de las mujeres (Chaplin, 2015, p. 14) y la “restrictive emotionality” [emocionalidad restrictiva] de los hombres (O’Neil, Good, & Holmes, 1995, p. 176). Con el objetivo de obtener datos completos y fiables sobre las expresiones relacionadas con las emociones de los YouTubers femeninos y masculinos, el estudio combina métodos de investigación cuantitativos y cualitativos que se basan en varias herramientas computerizadas, así como en procesos de anotación manual. En particular, se adopta un marco de análisis crítico del discurso basado en corpus, motivado por la suposición de Baker et al. (2008, p. 227) de que las investigaciones de Lingüística de Corpus “offer the researcher a reasonably high degree of objectivity; that is, they enable the researcher to approach the texts (or text surface) (relatively) free from any preconceived or existing notions regarding their linguistic or semantic/pragmatic content” [ofrecen al investigador un grado razonablemente alto de objetividad; es decir, permiten al investigador acercarse a los textos (o la superficie del texto) (relativamente) libre de cualquier noción preconcebida o existente sobre su contenido lingüístico o semántico/ pragmático]. El trabajo se enmarca dentro del dominio de los Estudios de Discurso Asistidos por Corpus, definido por Partington, Duguid y Taylor (2013, p. 10) como “that set of studies into the form and/or function of language which incorporate the use of computerised corpora in their analysis” [ese conjunto de estudios sobre la forma y/o la función del lenguaje que incorporan el uso de corpus informatizados en su análisis”]. Las herramientas informáticas específicas que se utilizan en el análisis de los datos de Draw My Life relacionados con sentimientos/emociones son Lingmotif, LIWC2015 (Linguistic Inquiry and Word Count) y Wmatrix4

İK2018 17th Internationally Participated Business Congress, 26-28 April 2018, Çeşme, İzmir

Çevrimiçi (XLV, 2055 sayfa )26-28 Nisan 2018 tarihlerinde Çeşme’de düzenlenen, 17. Uluslararası Katılımlı işletmecilik Kongresi’nin İzmir Katip Çelebi Üniversitesi, iktisadi ve idari Bilimler Fakültesi, işletme Bölümü ev sahipliğinde gerçekleştirilmesinden dolayı büyük bir mutluluk ve onur duyduk. Türkiye’de işletmecilik alanında uzun süredir başarıyla gerçekleştirilen ‘İşletmecilik Kongresi’ 17. Oturumunda uluslararası bir nitelik kazandırılarak gerçekleştirilmiştir. Bu vesile ile kongrenin 17. Oturumu ‘Uluslararası Katılımlı İşletmecilik Kongresi’ olarak tanımlanmıştır. Kongrenin bu niteliği kazanmasında katkıları olan herkese teşekkür ederiz. Umut ederiz ki bu kıymetli kongrenin ileriki oturumlarının da bu nitelikte gerçekleşmesidir. 17. Uluslararası İşletmecilik Kongresi’ne akademi, iş dünyası, sivil toplum kuruluşları ve bireysel olarak yaklaşık 700 katılımcı ilgi göstermiştir. Kongrede sunulmak üzere 400’den fazla çalışma tarafımıza ulaşmıştır. Bu çalışmalardan kongrede sunumu yapılan 236 tane tebliğ bu kitapta yer almaktadır. Kongrenin düzenlenmesi sırasında her zaman desteklerini hissettiğimiz Danışma Kurulu değerli üyelerine, bildiri tam metin ve özetlerini dikkatle ve özenle değerlendiren Bilim Kurulu üyelerine ve kongre sponsorlarına çok teşekkür ederiz. Prof.Dr. Hayrettin USUL 17. Uluslararası Katılımlı İşletmecilik Kongresi Dönem Başkan