Network traffic identification in packet sampling environment

With the rapid growth of network bandwidth,traffic identification is currently an important challenge for network management and security.In recent years,packet sampling has been widely used in most network management systems.In this paper,in order to improve the accuracy of network traffic identification,sampled NetFlow data is applied to traffic identification,and the impact of packet sampling on the accuracy of the identification method is studied.This study includes feature selection,a metric correlation analysis for the application behavior,and a traffic identification algorithm.Theoretical analysis and experimental results show that the significance of behavior characteristics becomes lower in the packet sampling environment.Meanwhile,in this paper,the correlation analysis results in different trends according to different features.However,as long as the flow number meets the statistical requirement,the feature selection and the correlation degree will be independent of the sampling ratio.While in a high sampling ratio,where the effective information would be less,the identification accuracy is much lower than the unsampled packets.Finally,in order to improve the accuracy of the identification,we propose a Deep Belief Networks Application Identification(DBNAI)method,which can achieve better classification performance than other state-of-the-art methods.

Artificial Neural Network Method Based on Expert Knowledge and Its Application to Quantitative Identification of Potential Seismic Sources

In this paper,an approach is developed to optimize the quality of the training samples in the conventional Artificial Neural Network(ANN)by incorporating expert knowledge in the means of constructing expert-rule samples from rules in an expert system,and through training by using these samples,an ANN based on expert-knowledge is further developed.The method is introduced into the field of quantitative identification of potential seismic sources on the basis of the rules in an expert system.Then it is applied to the quantitative identification of the potential seismic sources in Beijing and its adjacent area.The result indicates that the expert rule based on ANN method can well incorporate and represent the expert knowledge in the rules in an expert system,and the quality of the samples and the efficiency of training and the accuracy of the result are optimized.

Analysis of Malware Application Based on Massive Network Traffic

Security and privacy issues are magnified by velocity, volume, and variety of big data. User's privacy is an even more sensitive topic attracting most people's attention. While XcodeGhost, a malware of i OS emerging in late 2015, leads to the privacy-leakage of a large number of users, only a few studies have examined XcodeGhost based on its source code. In this paper we describe observations by monitoring the network activities for more than 2.59 million i Phone users in a provincial area across 232 days. Our analysis reveals a number of interesting points. For example, we propose a decay model for the prevalence rate of Xcode Ghost and we find that the ratio of the infected devices is more than 60%; that a lot of popular applications, such as Wechat, railway 12306, didi taxi, Youku video are also infected; and that the duration as well as the traffic volume of most Xcode Ghost-related HTTP-requests is similar with usual HTTP-request which makes it difficult to be found. Besides, we propose a heuristic model based on fingerprint and its web-knowledge to identify the infected applications. The identifying result shows the efficiency of this model.

A SEQUENTIAL TESTING PROGRAM FOR PREDICTING AND IDENTIFICATING CARCINOGENS AND ITS APPLICATION

In this paper our studies about the sequential testing program for predicting and identificating carcinogens, sequential discriminant method and cost- effectiveness analysis are summarized. The analysis of our database of carcinogeniclty and genotoxicity of chemicals demonstrates the uncertainty . of short- term tests ( STTs ) to predict carcinogens and the results of most routine STTs are statistically dependent. We recommend the sequential testing program combining STTs and carclnogenicity assay, the optimal STT batteries, the rules of the sequential discrimination and the preferal choices of STTs tor specific chemical class. For illustrative pmposes the carclnogenicity prediction of several sample chamicals is presented. The results of cost-effectiveness analysis suggest that this program has vast social-economic effectiveness.

Application type identification of Internet flows based on medium mathematics

Internet application identification is needed by network management in many aspects,such as quality of service （QoS） management,intrusion detection,traffic engineering,accounting,and so on. This article makes an in-depth study of precise identification of Internet applications by using flow characteristics instead of well-known port or application signature match. A novel approach that identifies the application type of an Internet protocol （IP） flow by finding what flow the flow looks the most like based on medium mathematics system （MMS） is proposed. The approach differs from previous ones mainly in two aspects：it has inherent scalability due to its use of the measure of n-dimensional medium truth degree; not only features of a flow,but also the association between the flow and the other flows of the same host as well as the relation among all flows of a host are employed to recognize a flow＇s application type. For the present,some popular applications are concentrated on,and up to six application types can be identified with better accuracy. The results of experiments conducted on Internet show that the proposed methodology is effective and deserves attention.

Accelerating Application Identification with Two-Stage Matching and Pre-Classification

Modern datacenter and enterprise networks require application identification to enable granular traffic control that eJther Jmproves data transfer rates or ensures network security. Providing application visi- bility as a core network function is challenging due to its performance requirements, including high through- put, low memory usage, and high identification accuracy. This paper presents a payload-based application identification method using a signature matching engine utilizing characteristics of the application identifica- tion. The solution uses two-stage matching and pre-classification to simultaneously improve the throughput and reduce the memory. Compared to a state-of-the-art common regular expression engine, this matching engine achieves 38% memory use reduction and triples the throughput. In addition, the solution is orthogonal to most existing optimization techniques for regular expression matching, which means it can be leveraged to further increase the performance of other matching algorithms.

INNOVATIVE BIOLOGICAL AND CHEMICAL STUDIES OF HERBAL MEDICINES APPLICATION OF MASSLYNX AND UNIFI PLATFORM SOLUTION TO ACCELERATE THE IDENTIFICATION OF INGREDIENTS AND THEIR METABOLITES OF TCM

Traditional Chinese Medicine(TCM)has been used in prevention and treatment of disease in clinical practice for thousands of years,with an indispensable role of multiple ingredients.Thus,a rapid and effective chemical ingredients analysis was of necessary to be established for the evaluation of the holistic quality of TCM.As could afford the data with high resolution and high sensitivity,