Steganalysis of Network Packet Length Based Data Hiding

Packet sampling measurement is a key technique in high-speed network traffic monitoring and management. In this paper, packet sampling techniques are introduced and analyzed after the presentation of related background researches. Then time-trigger and event-trigger Poisson sampling techniques are evaluated separately on several aspects such as packet length distribution, average packet length and the comparison between sampled volume and the whole traffic volume. The experiment results support that event-trigger Poisson sampling technique shows better performance than time-trigger Poisson sampling technique. At last, a heuristic explanation is briefly discussed and the prospect of packet sampling is depicted.

The identification of network applications through observation of associated packet traffic flows is vital to the areas of network management and surveillance. Currently popular methods such as port number and payload-based identification exhibit a number of shortfalls. An alternative is to use machine learning (ML) techniques and identify network applications based on per-flow statistics, derived from payload-independent features such as packet length and inter-arrival time distributions. The performance impact of feature set reduction, using Consistency-based and Correlation-based feature selection, is demonstrated on Naïve Bayes, C4.5, Bayesian Network and Naïve Bayes Tree algorithms. We then show that it is useful to differentiate algorithms based on computational performance rather than classification accuracy alone, as although classification accuracy between the algorithms is similar, computational performance can differ significantly.

In multiple input multiple output-orthogonal frequency division multiplexing (MIMO-OFDM) systems, several detection schemes have been developed for high error performance and low complexity. In several detection schemes, maximum likelihood (ML) and QRD-M have optimal error performance. However, these detection schemes have very high complexity. Thus, this paper proposes reduced complexity of QRD-M detection scheme in MIMO-OFDM systems. The proposed detection scheme has two stages, i.e. partial zero-forcing (ZF) and conventional QRD-M. The proposed detection scheme has higher error performance and lower complexity than the decision feedback equalizer (DFE).

As the demand for high-throughput communications in wireless LANs increases, the need for expanding channel bandwidth also increases. However, the use of wider band channels results in the decrease of the number of channels available. Therefore, if multiple access points (APs) are in proximity and the cells overlap, it is difficult for each AP to use an orthogonal channel, and competitions thus increase between the APs using the same channel. To cope with this problem, this paper proposes coordinating APs to increase throughputs at Nash equilibria. A centralized controller coordinates the APs, which jointly select multibandwidth channels. To clarify the effect of coordinating APs, we assume a simple scenario where the cells of three APs overlap, and each AP can select multibandwidth channels. In this scenario, we consider two packet length assumptions. In the first case, the data bit amount of each packet is assumed to be the same. Thus, the packet length changes depending on a data rate. The other case assumes that the packet length is the same regardless of the data rate. Through game-theoretic analysis, it can be clarified that the coordinated APs are able to select channels more effectively than if each AP independently selects channels and that the total throughput of the coordinated APs at Nash equilibria is improved by at most 80 % in two packet length assumptions.

In ad hoc networks, selfish nodes deviating from the standard MAC (Medium Access Control) protocol can significantly degrade normal nodes’ performance and are usually difficult to detect. In this paper, we propose detection and defense schemes to identify and defend against MAC-layer selfish misbehavior, respectively, in IEEE 802.11 multi-hop ad hoc networks. Specifically, the non-deterministic nature of the IEEE 802.11 MAC protocol imposes great challenges to distinguishing selfish nodes from well-behaved nodes. Most traditional selfish misbehavior detection approaches are for wireless local area networks (WLANs) only. They either rely on a large amount of historical data to perform statistical detection, or employ throughput or delay models that are only valid in WLANs for detection. In contrast, we propose a realtime selfish misbehavior detection scheme for multi-hop ad hoc networks. It requires only several samples, and hence is more efficient and can adapt to channel dynamics more quickly. Then, based on the proposed detection scheme, we design three selfish misbehavior defense schemes against three typical kinds of smart selfish nodes. We find that the smart selfish nodes cannot degrade normal nodes’ performance much without getting detected. Extensive simulation results are finally presented to validate the proposed detection and defense schemes.

Optical Packet Switching (OPS) has emerged as a promising candidate for the future all-optical core network. A crucial issue in such networks is how the packet length distribution (PLD) influences the performance under different traffic scenarios. In this paper we investigate how a deterministic, empirical and exponential PLD influences the Packet Loss Rate (PLR) in an optical packet switch in the case of a Poisson arrival process and a bursty Hyperexponential arrival process. We consider optical packet switches with and without Fibre Delay Line (FDL) contention buffers. Our results show that in the case of OPS without FDL buffering and with a Hyperexponential arrival process, the empirical PLD yields the lowest PLR. However, in the case of OPS with FDL buffering, the deterministic PLD yields the lowest PLR.

Network operators are now facing bandwidth outages as well as a growing pressure to ensure good Quality of Service (QoS). An important practical issue for network service providers is to pay close attention to the load changes of network traffic, in particular, the stationary increase of load from a normal demand. Many network monitoring applications and performance analysis tools are based on the study of an aggregate measure of network traffic, e.g. number of packets in transit (NPT), which is a long-term univariate time series. To classify this type of network traffic data and detect any increase of network source load, we propose a dynamic principal component analysis (PCA) method, first to extract data features and then to detect a stationary load increase of network traffic. The proposed detection schemes are based on either the major or the minor principal components of network traffic data. To demonstrate the applications of the proposed feature extraction method and the detection schemes, we applied them to network traffic data simulated from the packet switching network (PSN) model. Additionally, we propose a combined detection scheme that uses both the major and the minor principal components. The proposed detection schemes, based on dynamic PCA, show enhanced performance in detecting an increase of network load for the simulated network traffic data. These results offer a new feature extraction method based on dynamic PCA that creates additional feature variables for event detection in a univariate time series.

The desire to conceptualize network traffic in a prevailing communication network is a facet for many types of network research studies. In this research, real traffic traces collected over trans-Pacific backbone links (the MAWI repository, providing publicly available anonymized traces) are analyzed to study the underlying traffic patterns. All data analysis and visualization is carried out using Matlab (Matlab is a trademark of The Mathworks, Inc.). At packet level, we first measure parameters such as distribution of packet lengths, distribution of protocol types, and then fit following analytical models. Next, the concept of flow is introduced and flow based analysis is studied. We consider flow related parameters such as top ports seen, duration of the flow, distribution of flow lengths, and number of flows with different timeout values and provide analytical models to fit the flow lengths. Further, we study the amount of data flowing between source-destination pairs. Finally, we focus on TCP-specific aspects of captured traces such as retransmissions and packet round-trip times. From the results obtained, we infer the Zipf-type nature of distribution for number of flows, heavy-tailness of flow sizes and the contribution of well-known ports at packet and flow level. Our study helps a network analyst to farther the knowledge and helps optimize the network resources, while performing efficient traffic engineering.

For turbo-coded differential phase-shift-keying (DPSK) systems under correlated flat-fading channels, a serial iterative structure of soft-input-soft-output (SISO) forward/backward MAP (FB-MAP) detection and SISO decoder is proposed to reduce the computational complexity of MAP detection without performance degradation. The simulation results show that the FB-MAP detection scheme offers the same or better bit error rate (BER) performance with lower computational complexity when compared with the <i xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">a posteriori</i> probability (APP) demodulator, the SISO MAP detection, and the SISO multiple-symbol differential sphere decoder (MSDSD) scheme. Although the computational complexity is higher than the iterative filtered multiple differential detection (IF-MDD) scheme, the proposed detection scheme can have better BER performance.

An optimal preemption framework is proposed to minimize Age of Information (AoI) in single-link systems with stochastic packet arrivals and known packet lengths. The problem is formulated as a Markov Decision Process (MDP) solved through relative value iteration (RVI), demonstrating that packet-length-dependent threshold policies achieve minimal average AoI. For scenarios with unknown traffic statistics, a Deep Q-Network (DQN) algorithm learns these thresholds adaptively through real-time interactions without prior distribution knowledge. Numerical evaluations under exponential and bounded Pareto packet length distributions reveal 15.5 percent average AoI reduction compared to non-preemptive baselines using the RVI method, while the DQN method achieves 14.4 percent improvement with less than 1.1 percent performance gap from the optimal policy. Both methods exhibit threshold-driven decision structures that balance immediate AoI reduction against long-term scheduling efficiency. Comparative analysis reveals the framework’s robustness across stationary and dynamic environments, with the DQN maintaining near-optimal performance through dimension-reduced state representation. These results establish a unified solution for AoI minimization that transitions seamlessly between model-aware and model-agnostic configurations, addressing critical challenges in real-time Internet of Things (IoT) networks and status update systems requiring freshness guarantees.

The number of physical devices connected to the Internet such as vehicles, household appliances and other &amp;quot;things&amp;quot; has been steadily increasing in recent years, thus forming the basis for the Internet of Things (IoT). IoT ecosystem extends beyond country borders and application domains, combining thousands of versatile devices that differ in terms of their structures, capabilities, and available resources. It is therefore not surprising that the landscape of wireless communication technologies and the degree of IoT devices available today is excessively broad and diverse. Interference between networks leads to frame collisions and consequent packet loss. Frame collisions occur when two or more packets overlap in time and frequency and use the same Long Range (LoRa) parameters, i.e. the same Spreading Factor (SF), Bandwidth (BW) and Carrier Frequency (CF). When most devices use the same configuration, collision probability is higher. The probability of frame collisions is also affected by traffic characteristics, particularly the periodicity of the transmission and the payload size. Larger payload sizes and more frequent transmissions accumulate with higher Time on Air (ToA) and channel occupancy [1]. Transmission powers and the location of the gateways also influences this situation. The aim of this experimental work is to verify the effects of collisions and interference in Long Range Wide Area Network (LoRaWAN), regarding the periodicity of transmissions and the payload sizes in a context of an inter-SF interference scenario. And to validate measuring tools like Received Signal Strength Indicator (RSSI), ToA and Packet Delivery Ratio (PDR) in the reliability of a network. We validate our conclusions by analyzing ToA according with RSSI and different data sizes, the RSSI for different SFs and different data sizes and finally the packet loss through the PDR for a better understanding of the reliability of packet transmission in our link. In the end we conclude that in an environment with inter-SF interference, the choice of SFs and packet lengths impacts ToA. When dealing with multiple devices near gateways, different SFs and varying packet lengths can lead to increased latency and longer ToA. Consequently, the risk of packet loss becomes more significant, especially if the signal-to-interference ratio (SIR) is low. This limitation will therefore affect scalability, particularly in Non-Line-Of-Sight (NLOS) scenarios.

Due to the dynamics and mobility of mobile ad hoc networks (MANETs), intrusion detection techniques in MANETs must be adaptive. In this work, we propose detection schemes that are suitable to detect in-band wormhole attacks. The first detection scheme uses the Sequential Probability Ratio Test (SPRT). The SPRT has been proven to be an optimal detection test when the probability distributions of both normal and abnormal behaviors are given. Furthermore, we introduce non-parametric methods, which require no training and are more adaptive to mobile scenarios. The proposed detection schemes are implemented and evaluated using a 48-node testbed and a mobile ad-hoc network emulator at the Army Research Lab. The performance and detection accuracy of various schemes are compared, especially in the presence of congestion. We provide tradeoffs analyses among detection latency and probabilities of false alarms and missed detection.

Our objective is to analyze and minimize the amount of energy needed to transmit packets in a multihop wireless network, such as a sensor network or an ad hoc network. The total energy consumed to transmit a packet from a source to a destination is a function of the number of hops along the path and the energy needed to successfully transmit a packet in one hop. Given a path, the number of hops needed depends on the transmission range. The energy consumed for a successful transmission in a hop depends on not only the transmission range but also the medium access strategy. In this paper, we generalize the analysis of the energy consumption on packet transmission in multihop wireless networks. The analysis is applicable to a range of multiaccess schemes from TDM to random access schemes. The results show that typically, there is a transmission range that results in the minimum energy. However, a smaller transmission range does not always lead to less energy consumed by packet transmission. The optimum energy consumption is the result of balancing several factors, including: 1) the ratio of an overhead packet length to a data packet length, where overhead packets refer to the control packets used to reserve the media or the data packets involved in collisions; 2) the number of transmissions of the overhead packets; 3) the number of hops along a path; and 4) the transmission range.

Anomaly detection is important for the correct functioning of wireless sensor networks. Recent studies have shown that node mobility along with spatial correlation of the monitored phenomenon in sensor networks can lead to observation data that have long range dependency, which could significantly increase the difficulty of anomaly detection. In this paper, we develop an anomaly detection scheme based on multi-scale analysis of the long range dependent traffic to address this challenge. In this proposed detection scheme, discrete wavelet transform is used to approximately de-correlate the traffic data and capture data characteristics in different time scales. The remaining dependencies are then captured by a multi-level hidden Markov model in the wavelet domain. To estimate the model parameters, we propose an online discounting Expectation Maximization (EM) algorithm, which also tracks variations of the estimated models over time. Network anomalies are detected as abrupt changes in the tracked model variation scores. We evaluate our detection scheme numerically using typical long range dependent time series.

We consider Byzantine attack detection for Gaussian two-way relay network which carries large volumes of data. Two source nodes communicate with each other with the help of an amplify-and-forward relay which may perform Byzantine attacks by forwarding altered symbols to the sources. For simple investigating the detectability of attacks conducted in Gaussian channels, we focus on the multi-access (MA) channel of the network, while assuming the broadcasting (BC) channel is noiseless. Upon such model, we propose a attack detection scheme implemented in the sources upon physical-layer observations. Specifically, we consider a open wireless propagation environment that allows the symbols, forwarded by the relay, to go through a continuous channel and arrive to the sources. With the observations of the source, we develop a detection scheme for the source by comparing the joint empirical distribution of its received and transmitted signals with the known channel statistics. The main contribution of this paper is to prove that for the Gaussian MA channel, using large volumes of data, the proposed detection scheme can detect arbitrary independent identically distributed (i.i.d.) attacks that allows the stochastic distributions of altered symbols to follow arbitrary distributions. No pre-shared secret or secret transmission is needed for the detection.