GPT Method Based Traffic Anomaly Detection for Space-ground Integrated Network

Network Traffic Anomalies, Natural Language Processing, and Random Matrix Theory

The article examines the problem of detecting anomalies in the network traffic of information systems of organizations. Detection of anomalies in network traffic will allow to determine the hidden malicious activity of the data obtained on the basis of protocols that collect statistical data of the network traffic of the information system. This, in turn, will allow you to reduce the load and configure the attributes that will be used to monitor and analyze network traffic. The authors proposed the network traffic anomaly detection architecture, which is divided into functional levels. Protocols were analyzed to collect statistics, namely the Net Flow/IPFIX protocol, which provides comprehensive information based on packet headers. To process and analyze the received data, the authors developed a model for detecting anomalies in the traffic of the information system. The anomaly detection model uses statistical data for their further processing, as well as the possibility of storing data in a repository. All received data is filtered to detect malicious processes, transferred and stored in the repository of the attack database with the possibility of creating warnings and identifying the attack. For the specified model, the use of Machine Learning based on methods of predicting categorical fields is proposed. The work used a dataset with firewall data, which contains information on the number and size of transmitted and received packets of packets, data on the use of malicious software. Using the method, an experimental study of the data was conducted to predict the presence of malicious software in them. The method of forecasting categorical fields using Logistic Regression, SVM, Random Forest Classifier and other classification algorithms was investigated. Based on the obtained data, a confusion matrix was built, which allows to estimate the error of the algorithms.

Ego-centric Traffic Anomaly Detection (TAD) aims to identify abnormal events in videos captured by dashboardmounted cameras in vehicles. Compared to anomaly detection in roadside surveillance videos, ego-centric TAD poses greater challenges due to the dynamic backgrounds caused by vehicle motion. Previous frame-level methods are often vulnerable to interference from these dynamic backgrounds and struggle to detect small objects located at a distance or off-center. To address these challenges, we propose an object-prompt enhanced method that integrates detected traffic objects into a framelevel TAD framework. Our approach introduces an objectprompt scheme comprising an object prompt encoder, along with two cross-attention-based aggregation modules: an instancewise aggregation module for fusing information between object instances and the scene, and a relation-wise aggregation module for capturing relationships inter-objects. Additionally, we design an instance-level loss to supervise anomaly detection at the object level. Our method effectively mitigates interference from dynamic backgrounds, improves the detection of distant or offcenter anomalies, and enables precise spatial localization of anomalies. Experimental results on the DoTA and DADA-2000 datasets demonstrate that our method achieves state-of-the-art performance.

With the continuous development of information technology and the continuous progress of traffic bandwidth, the types and methods of network attacks have become more complex, posing a great threat to the large-scale campus network environment. To solve this problem, a network traffic anomaly detection model based on subspace information entropy flow matrix and a subspace anomaly weight clustering network traffic anomaly detection model combined with density anomaly weight and clustering ideas are proposed. Under the two test sets of public dataset and collected campus network data information of a university, the detection performance of the proposed anomaly detection method is compared with other anomaly detection algorithm models. The results show that the proposed detection model is superior to other models in speed and accuracy under the open dataset. And the two traffic anomaly detection models proposed in the study can well complete the task of network traffic anomaly detection under the large-scale campus network environment.

As reported by the United Nations in 2021, road accidents cause 1.3 million deaths and 50 million injuries worldwide each year. Detecting traffic anomalies timely and taking immediate emergency response and rescue measures are essential to reduce casualties, economic losses, and traffic congestion. This paper proposed a three-stage method for video-based traffic anomaly detection. In the first stage, the ViVit network is employed as a feature extractor to capture the spatiotemporal features from the input video. In the second stage, the class and patch tokens are fed separately to the segment-level and video-level traffic anomaly detectors. In the third stage, we finished the construction of the entire composite traffic anomaly detection framework by fusing outputs of two traffic anomaly detectors above with different granularity. Experimental evaluation demonstrates that the proposed method outperforms the SOTA method with 2.07% AUC on the TAD testing overall set and 1.43% AUC on the TAD testing anomaly subset. This work provides a new reference for traffic anomaly detection research.

NASA is planning to upgrade its network infrastructure to support missions for the 21st century. The first step is to increase the data rate provided to science missions to at least the 100 Mbps range. This is under way, using Ka-band 26 GHz, erecting an 18-meter antenna for the Lunar Reconnaissance Orbiter, and the planned upgrade of the Deep Space Network (DSN) 34-meter network to support the James Webb Space Telescope (JWST). The next step is the support of manned missions to the Moon and beyond. Establishing an outpost with several activities such as rovers, colonization, and observatories, is better achieved by using a network configuration rather than the current method of point-to-point. Another challenge associated with the Moon is communication coverage with the Earth. The Moon's South Pole, targeted for human habitat and exploration, is obscured from Earth view for half of the 28-day lunar cycle and requires the use of lunar relay satellites to provide coverage for the times when there is no direct view of the Earth. The future NASA and Constellation network architecture is described in the Space Communications Architecture Working Group (SCAWG) Report[l]. The Space Communications and Navigation (SCAN) Constellation Integration Project (SCIP) is responsible for coordinating Constellation requirements and has assigned the responsibility for implementing these requirements to the existing NASA communication providers: DSN, Space Network (SN), Ground Network (GN) and the NASA Integrated Services Network (NISN). The SCAWG Report provides a future architecture but does not provide implementation details. The architecture calls for a Netcentric system, using hundreds of 12-meter antennas, a ground antenna array, and a relay network around the Moon. The report did not use cost as a variable in determining the feasibility of this approach. As part of the SCIP Mission Concept Review and the second iteration of the Lunar Architecture Team (LAT), the focus is on cost, as well as communication coverage using operational scenarios. This approach maximizes use of existing assets and adds capability in small increments. This paper addresses architecture decisions such as the Radio Frequency (RF) signal and network (Netcentric) decisions that need to be made and the difficulty of implementing them into the existing Space Network and DSN. It discusses the evolution of the lunar system and describes its components: TDRSS, Earth-based ground stations, Lunar Relay, and surface systems.

The space-terrestrial integrated network (STIN) is crucial for achieving ubiquitous connectivity in the 6G era. However, leveraging full potential of STIN is challenging due to the distinct characteristics and objectives of constituent networks. Inspired by symbiotic communication (SC), this paper proposes a service exchange-based symbiotic STIN system that optimizes objectives of different networks by exploiting their complementary features. Specifically, the ground network provides task offloading services to the space network, while the space network reciprocates with communication services. To minimize computation delay in the space network and maximize the energy efficiency (EE) of the ground network, we formulate a multi-objective optimization problem (MOOP) that jointly optimizes task offloading, resource allocation, and beamforming. We first transform the MOOP into a single-objective optimization problem (SOOP) via the ε-constraint method and then develop a successive convex approximation (SCA) algorithm to characterize its fundamental performance, which requires future state information. As obtaining such non-causal information is hard, we design a more practical multi-agent reinforcement learning (MARL) algorithm based on insights from the SCA. Besides, to address the challenges of storing multiple MARL policies for different EE-delay trade-offs, we develop a diffusion model-based behavior cloning (BC) algorithm to obtain a general policy suitable for varying trade-offs. Simulation results show that proposed algorithms outperform benchmarks and confirm that the proposed service exchange realizes a symbiotic STIN.

Detecting anomalies in the Traffic Systems could be very useful for the analysis of traffic rule violation, fault detection and other traffic-related issues. In this paper trajectory-based anomaly detection using spatial temporal analysis, K-means, linear regression, z score and Hierarchical temporal memory clustering algorithm are analyzed. The spatial localization of an object is considered as an event. Traffic anomaly detection rules are formulated in three levels: Point anomaly, Sequential anomaly and Co-occurrence anomaly. This paper analyses the performance of various traffic anomaly detection methodologies in terms of accuracy to reduce false alarm.

Traffic traces captured from backbone links have been widely used in traffic analysis for many years. By far the most popular use of such traces is replay where conditions and states of the original traffic trace are recreated almost identically in simulation or emulation environments. When the end target of such research is detection of traffic anomalies, it is crucial that some anomalies are found in the trace in the first place. Traces with many real-life anomalies are rare, however. This paper pioneers a new area of research where traffic traces are engineered to contain traffic anomalies as per user request. The method itself is non-intrusive by retaining the IP address space found in the original trace. Engineering of several popular anomalies are shown in the paper while the method is flexible enough to accommodate any level of traffic trace engineering in the future.KeywordsTrafficAnalysisTraceReplaySimulationEmulationAnomaly

Spatiotemporal relationships are widely used in urban traffic modelling for obtaining accurate and explainable forecasts. However, the majority of studies are focused on point forecasts and do not pay attention to a time-dependent variability of traffic flows and related volatility of model errors. At the same time, traffic volatility is an important value that can be effectively used for the construction of confidence intervals for traffic forecasts and detection of traffic anomalies. This study proposes an application of the spatiotemporal approach to modelling of traffic volatility and predicting the conditional variance of traffic forecasts. The approach is based on a spatiotemporal specification of the popular generalized autoregressive conditional heteroskedasticity (GARCH) model that is combined with the spatially regularised vector autoregressive model as a multivariate urban traffic predictor. The resulting hybrid model was applied for a large real-world data set and demonstrated its performance for traffic volatility prediction. The proposed approach was compared to existing univariate traffic volatility models and proved its utility for deeper understanding of traffic variance and anomalies.

T h i s paper addresses the impacts of new communication technology on both standards and protocols used on ground networks for distribution and use of data and inforniation collected or generated as part of the space program. The basic thcme is that protocols and network architectures should be different depending on the type and use of the data being transmitted. No universal standard will exist which will satisfy all data networking requirements. Standards should be established within communities of interest at the higher layers and network architectures chosen that support the intended use of the data. Finally, system architectures will need to be established that will take advantage of the advances in communication technology and support the various standards needed witllin a community. Classification of Data Transmission D o e s '-rr B efore considering network architectures, it is important to look at the characteristics of the data intended for transmission. One of the most important characteristics is how the data changes in time with rcspect to content and value. For example, data including product specifications, catalogues, reports, test results, application programs, etc. can exist for long periods of time without significant change. Surely additions can be made, but the basic content is the same. Other data, however, can change rapidly with time. As examples consider data representing the status of any scheduled or contended resource such as airplane seats or telephone trunks. The point of the above discussion is that data content can change with time over a wide range and that systems designed to access the data can and should take advantage of this characteristic. The second characteristic of data variability is that of value. Naturally the time value of the data is a function of the intended use. A weather map needed for forecasting realizes an hourly decline in value as forecasts generally span hours to days. The same map used For instructional or analysis purposes can retain its value For indefinite periods. Likewise, data used to make a decision loscs value after the decision is made but the same data used to justify a decision rctains value as long as justification is needed. Finally, data that is needed for a step in some process that cannot proceed until thc data is obtaincd has a time value related to the cost or value of the process. Realizing the time variability of data in both content and value, it is important to consider two different network objectives for the transmission of data. The first network objective is that of minimizing network delay in the dclivery of a unit of data from a source to a destination. The type of data transmission that has this objective is termed Response Time Critical or RTC data transmission. The reason delay is important is that for this type of data transmission, it. is assumcd that people or processes become non-productive while the data is in transit. Thus by minimizing the network delay, the end user productivity is increased. The second network objective is that of minimizing cost or the time needed to complete a transmission. If network transmission costs are usage sensitive with respect to time, then minimizing the time to complete a transmission is the same as minimizing the cost. Thus maximizing the utilization OF a resource through high efficiency is the network objective for a class of data traffic termed Throughput Critical. For this class of traffic, costs can also be impacted by using resources during low rate periods or alternate means of transmission such as mailing a laser disk with data that is not rapidly changing or decreasing in value with time. Present Networking Approach M o s t data networks in existence today share an architectural trait that they rely on a ftxed network topology. This means that the networks are composed of network processors (that switch and route data packets) and ftxed trunks that carry the transmissions between the processors. Local area networks are an exception as they can share the transmission media among many processors. The major reason for this architecture is that transmission costs were the predominate cost of the network and because of analog technology, the only method to obtain reasonable bandwidth was with dedicated circuits. Once the step was taken to obtain the dcdicated bandwidth, then the issue of how to get reasonable utilization had to be addressed if any type of cost control was desired. The packet netCopyright@1987 by the American I n s t i t u t e of Aeronautics and Astronautics. ~ n c . A l l r ights

With the rapid development of information network, network security is becoming more and more important. Intrusion detection is an important component of the network security system. The traditional signature-based matching detection method is difficult to cope with the increasingly complex network environment. On the contrary, anomaly detection which is based on network traffic pattern analysis has obvious advantages in dealing with encryption attacks, zero-day attacks and other new attacks. This paper studies the network traffic anomaly detection, and proposes a traffic anomaly detection model which combines convolution neural network and eXtreme Gradient Boosting algorithm. First, the collected traffic data is preprocessed into appropriate format that meets the input requirements of the model. Then the improved LeNet-5 convolution neural network is used for feature learning, and finally XGBoost algorithm is used to classify the learning features. Experimental results show that the proposed network traffic anomaly detection method based on CNN and XGBoost has a high accuracy, and good experimental results have been achieved in both two- classification and multi-classification.

Traffic anomaly detection using high performance measurement systems offers the possibility of improving the speed of detection and enabling detection of important, short-lived anomalies. In this paper we investigate the problem of detecting anomalies using traffic measurements with fine-grained timestamps. We develop a new detection algorithm (called S3) that utilizes a Bayes Net to efficiently consider multiple input signals and to explicitly define what is considered "anomalous''. The input signals considered by S3 are traffic volumes and correlations between ingress/egress packet and bit rates. These complementary signals enable identification of an expanded range of anomalies. Using a set of high precision traffic measurements collected at our campus border router over a 10 month period and an annotated anomaly log supplied by our network operators, we show that S3 is highly accurate, identifying 86% of the anomalies listed in the log. Compared with well known time series-based and wavelet-based detectors, this represents over a 20% improvement inaccuracy. Investigation of events identified by S3 that did not appear in the operator log indicate many are, in fact, true positives. Deployment of S3 in an operational environment supports this by showing zero false positives during initial tests.

The National Aeronautics and Space Administration has conducted a comprehensive study to identify the most appropriate and efficient modulation, coding, multiple access and link protocol options for future space communication links supported by NASA's Ground Network, space network, deep space network, and earth-based ground terminals and in-situ relay satellites envisioned for Constellation Program mission support at the Moon and Mars. This paper briefly describes the study process and summarizes the multiple access recommendations for future NASA space communications.

Nowadays, industrial control system (ICS) has begun to integrate with the Internet. While the Internet has brought convenience to ICS, it has also brought severe security concerns. Traditional ICS network traffic anomaly detection methods rely on statistical features manually extracted using the experience of network security experts. They are not aimed at the original network data, nor can they capture the potential characteristics of network packets. Therefore, the following improvements were made in this study: (1) A dataset that can be used to evaluate anomaly detection algorithms is produced, which provides raw network data. (2) A request response-based convolutional neural network named RRCNN is proposed, which can be used for anomaly detection of ICS network traffic. Instead of using statistical features manually extracted by security experts, this method uses the byte sequences of the original network packets directly, which can extract potential features of the network packets in greater depth. It regards the request packet and response packet in a session as a Request-Response Pair (RRP). The feature of RRP is extracted using a one-dimensional convolutional neural network, and then the RRP is judged to be normal or abnormal based on the extracted feature. Experimental results demonstrate that this model is better than several other machine learning and neural network models, with F1, accuracy, precision, and recall above 99%.