Search

With the increasing popularity of mobile-app services, malicious software is increasing as well. Accordingly, the interest of the scientific community in Machine and Deep Learning solutions for detecting and classifying malware traffic is growing. In this work, we provide a fair assessment of the performance of a number of data-driven strategies to detect and classify Android malware traffic. Three models are taken into account (Decision Tree, Random Forest, and 1-D Convolutional Neural Network) considering both flat (i.e. non-hierarchical) and hierarchical approaches. The experimental analysis performed using a state-of-art dataset (CIC-AAGM2017) reports that Random Forest exhibits the best performance in a flat setup, while moving to a hierarchical approach could cause significant variation in precision and recall. Such results push for further investigating advanced hierarchical setups and learning schemes.

he Internet of Things (IoT) is experiencing a strong growth in both industrial and consumer scenarios. At the same time, the devices taking part in delivering IoT services—usually characterized by limited hardware and software resources—are more and more targeted by cyberattacks. This calls for designing and evaluating new approaches for protecting IoT systems, which are challenged by the limited computational capabilities of devices and by the scarce availability of reliable datasets. In line with this need, in this paper we compare three state-of-the-art machine-learning models used for Anomaly Detection based on autoencoders, i.e. shallow Autoencoder, Deep Autoencoder (DAE), and Ensemble of Autoencoders (viz. KitNET). In addition, we evaluate the robustness of such solutions when Data Poisoning Attack (DPA) occurs, to assess the detection performance when the benign traffic used for learning the legitimate behavior of devices is mixed to malicious traffic. The evaluation relies on the public Kitsune Network Attack Dataset. Results reveal that the models do not differ in performance when trained with unpoisoned benign traffic, reaching (at 1% FPR) an F1 score of ≈ 97%. However, when DPA occurs, DAE proves to be the more robust in detection, showing more than 50% of F1 Score with 10% poisoning. Instead, the other models show strong performance drops (down to ≈ 20% F1 Score) by injecting only 0.5% of the malicious traffic.

The generation of synthetic network traffic is necessary to several fundamental networking activities, ranging from device testing to path monitoring, with implications on security and management. While literature focused on high-rate traffic generation, for many use cases accurate traffic generation is of importance instead. These scenarios have expanded with Network Function Virtualization, Software Defined Networking, and Cloud applications, which introduce further causes for alterations of generated traffic. Such causes are described and experimentally evaluated in this work, where the generation accuracy of D-ITG, an open-source software generator, is investigated in a virtualized environment. A definition of accuracy in terms of Mean Absolute Percentage Error of the sequences of Payload Lengths (PLs) and Inter-Departure Times (IDTs) is exploited to this end. The tool is found accurate for all PLs and for IDTs greater than one millisecond, and after the correction of a systematic error, also from 100 us.

The lockdowns and lifestyle changes during the COVID-19 pandemic have caused a measurable impact on Internet traffic in terms of volumes and application mix, with a sudden increase of usage of communication and collaboration apps. In this work, we focus on five such apps, whose traffic we collect, reliably label at fine granularity (per-activity), and analyze from the viewpoint of traffic classification. To this aim, we employ state-of-art deep learning approaches to assess to which degree the apps, their different use cases (activities), and the pairs app-activity can be told apart from each other. We investigate the early behavior of the biflows composing the traffic and the effect of tuning the dimension of the input, via a sensitivity analysis. The experimental analysis highlights the figures of the different architectures, in terms of both traffic-classification performance and complexity w.r.t. different classification tasks, and the related trade-off. The outcome of this analysis is informative for a number of network management tasks, including monitoring, planning, resource provisioning, and (security) policy enforcement.

The widespread use of powerful mobile devices has deeply affected the mix of traffic traversing both the Internet and enterprise networks (with bring-your-own-device policies). Traffic encryption has become extremely common, and the quick proliferation of mobile apps and their simple distribution and update have created a specifically challenging scenario for traffic classification and its uses, especially network-security related ones. The recent rise of Deep Learning (DL) has responded to this challenge, by providing a solution to the time-consuming and human-limited handcrafted feature design, and better clas-sification performance. The counterpart of the advantages is the lack of interpretability of these black-box approaches, limiting or preventing their adoption in contexts where the reliability of results, or interpretability of polices is necessary. To cope with these limitations, eXplainable Artificial Intelligence (XAI) techniques have seen recent intensive research. Along these lines, our work applies XAI-based techniques (namely, Deep SHAP) to interpret the behavior of a state-of-the-art multimodal DL traffic classifier. As opposed to common results seen in XAI, we aim at a global interpretation, rather than sample-based ones. The results quantify the importance of each modality (payload- or header-based), and of specific subsets of inputs (e.g., TLS SNI and TCP Window Size) in determining the classification outcome, down to per-class (viz. application) level. The analysis is based on a publicly-released recent dataset focused on mobile app traffic.

In the present contribution we propose the results of an integrated measurement campaign including ground penetrating radar and passive seismic data achieved in the church of Santa Maria delle Grazie at Campi Salentina, a town close to Lecce, in southern Italy. The passive seismic results corroborate the interpretation of the main (quite numerous at it will be shown) anomalies identified thanks to the GPR investigation., peer-reviewed

Internet of Things (IoT) fosters unprecedented network heterogeneity and dynamicity, thus increasing the variety and the amount of related vulnerabilities. Hence, traditional security approaches fall short, also in terms of resulting scalability and privacy. In this paper we propose H2ID, a two-stage hierarchical Network Intrusion Detection approach. H2ID performs (i) anomaly detection via a novel lightweight solution based on a MultiModal Deep AutoEncoder (M2-DAE), and (ii) attack classification, using soft-output classifiers. We validate our proposal using the recently-released Bot-IoT dataset, inferring among four relevant categories of attack (DDoS, DoS, Scan, and Theft) and unknown attacks. Results show gains of the proposed M2-DAE in the case of simple anomaly detection (up to -40% false-positive rate when compared with several baselines at same true positive rate) and for H2ID as a whole when compared to the best-performing misuse detector approach (up to ≈ +5% F1 score). Besides the performance advantages, our system is suitable for distributed and privacy-preserving deployments while limiting re-training necessities, in line with the high efficiency as well as the flexibility required in IoT scenarios.

Improved human integration, machine connectivity and decentralized collaborative control systems play an important role in making production systems more flexible. Cyber-Physical Systems for machine control, mobile HMI or SCADA systems are increasingly connected via Internet-based technologies and must also be protected by this open communication technology. Based on a STRIDE analysis, the paper presents proposals on how to secure data exchange between CPS as well as between CPS and mobile HMI using IoT communication, whereby the practicability plays an important role. First results show that the concepts are feasible and are currently undergoing prototypical testing. Future work will focus on the detailed evaluation with respect to communication performance and the determination of the code overhead of the presented solutions.

A coherent formation of $N$ identical SAR satellites is considered in this paper. These sensors transmit at the same time, code, and frequency with no synchronization whichever, but for the timing of the arrivals, creating a Multiple Input Multiple Output (MIMO) configuration. The contemporaneous transmission of N signals is expected to result in a reciprocal interference that leads to an illumination pattern that changes in space and time. In spite of this, the increased number of phase centres (w.r.t. single satellite and SIMO cases) can be used to mitigate the interference and to raise the SNR of the equivalent system. The principles of a recombination algorithm are summarized. In order to evaluate the effectiveness of the MIMO reconstruction and to fully characterize the IRF of a MIMO system from a quantitative point of view, new performance figures of merit are defined.

With the growing adoption of cloud infrastructures to deliver a variety of IT services, monitoring cloud network performance has become crucial. However, cloud providers only disclose qualitative info about network performance, at most. This hinders efficient cloud adoption, resulting in no performance guarantees, uncertainties about the behavior of hosted services, and sub-optimal deployment choices. In this work, we focus on cloud-to-user latency, i.e. the latency of network paths interconnecting datacenters to worldwide-spread cloud users accessing their services. In detail, we performed a 14-day measurement campaign from 25 vantage points deployed via Planetlab infrastructure (emulating spatially- spread users) and considering services running in distinct locations on the infrastructures of the two most popular public-cloud providers, namely Amazon Web Services and Microsoft Azure. Our experimentation allows to provide an in-depth performance characterization (based on multiple probing methods and fine-grained sampling rate) of such networks as perceived by users spread worldwide. Results show the presence of both spatial and temporal latency trends. Finally, by evaluating the advantages of multi- cloud deployments, our results also provide useful guidelines to cloud customers.

Based on the Service Oriented Architecture (SOA), Internet of Things (IoT) systems are usually developed by orchestrating application services and entity services, which are required to be easily adapted to meet varying requirements of sensing or controlling the physical space. To ease updating and modification of entity services, some software-defined network approaches have been applied in building IoT systems. However, in these software-defined IoT systems, entity services are usually developed with the same software architecture as traditional services in Internet, which are not so easy to be adapted. In order to solve the problem, we propose a Physical Model Driven software Architecture (PMDA) for guiding the design of entity services. Furthermore, to reduce the maintenance cost of the entity services when adapting them to different requirements generated from both the social and the physical space, we propose an evolution Mechanism of Entity Services (eMES). The correctness and effectiveness of eMES are verified by a case study and analysis respectively.

Mobile Broadband (MBB) access networks are becoming more and more used worldwide, and the devices adopted to access them are increasing in number and complexity (smartphones, mobile hotspots, vehicular infotainment systems). The highly dynamic nature of such scenarios calls for continuous monitoring and measurement of the network, and possibly cross-layer management of network applications. A recent shift in network management, Software-Defined Networking (SDN), is a promising tool to manage such evolved scenario, characterized by constraints due to HW, virtualization, and data plans. In this paper, we present the fundamental ideas and the first findings that underpin the SOMETIME research project, that aims at implementing active measurements leveraging the features provided by SDN technologies. Several platforms and tools are being presented to investigate separately MBB and SDN: we consider as a reference testbed the MONROE platform, a system offering in-the-field MBB experimenting facilities. We adopt MONROE as an use case to highlight the main issues and challenges raised by the SOMETIME vision, investigating the feasibility of SDN-based active measurements for MBB. In more details, we assess the impact of SDN on performance of active measurements, namely Available Bandwidth (ABw) estimation, an end-to-end network metric characterizing the spare capacity on a path. We also report preliminary results on achievable throughput as a first root-cause analysis for poor performance in estimating ABw in MBB scenarios. The preliminary results confirm the expected difficulties in ABw estimation over MBB but also validate the feasibility of SDN-based approaches and suggest future directions for SDN-based enhancement of ABw estimation.

The spread of handheld devices has led to the unprecedented growth of traffic volumes traversing both local networks and the Internet, appointing mobile traffic classification as a key tool for gathering highly-valuable profiling information, other than traffic engineering and service management. However, the nature of mobile traffic severely challenges state-of-art Machine-Learning (ML) approaches, since the quickly evolving and expanding set of apps generating traffic hinders ML-based approaches, that require domain-expert design. Deep Learning (DL) represents a promising solution to this issue, but results in higher completion times, in turn suggesting the application of the Big-Data (BD) paradigm. In this paper, we investigate for the first time BD-enabled classification of encrypted mobile traffic using DL from a general standpoint, (a) defining general design guidelines, (b) leveraging a public-cloud platform, and (c) resorting to a realistic experimental setup. We found that, while BD represents a transparent accelerator for some tasks, this is not the case for the training phase of DL architectures for traffic classification, requiring a specific BD-informed design. The experimental setup is built upon a three-dimensional investigation path in the BD adoption, namely: (i) completion time, (ii) deployment costs, and (iii) classification performance, highlighting relevant non-trivial trade-offs.

Network traffic analysis, i.e., the umbrella of procedures for distilling information from network traffic, represents the enabler for highly-valuable profiling information, other than being the workhorse for several key network management tasks. While it is currently being revolutionized in its nature by the rising share of traffic generated by mobile and hand-held devices, existing design solutions are mainly evaluated on private traffic traces, and only a few public datasets are available, thus clearly limiting repeatability and further advances on the topic. To this end, this paper introduces and describes MIRAGE, a reproducible architecture for mobile-app traffic capture and ground-truth creation. The outcome of this system is MIRAGE-2019, a human-generated dataset for mobile traffic analysis (with associated ground-truth) having the goal of advancing the state-of-the-art in mobile app traffic analysis. A first statistical characterization of the mobile-app traffic in the dataset is provided in this paper. Still, MIRAGE is expected to be capitalized by the networking community for different tasks related to mobile traffic analysis.

Mobile Broad Band (MBB) networks and Software-Defined Networking (SDN) are expected to strongly characterize the future evolution of global communications envisioned by the Fifth Generation mobile networks (5G). Although SDN has seen adoption and wide experimentation in data-center networks, its benefits and challenges in MBB has not received comparable coverage. In this work we experiment with a state-of-art SDN-based approach for passive monitoring available bandwidth and throughput with an OpenFlow switch in the mobile node. We evaluate the approach on a real-world commercial 4G network (leveraging the MONROE platform), considering two deployments (with an SDN controller local to the mobile node, and a remote one, whose control messages traverse the radio access network) and compare the results of the experiments against analogous deployments in a fully-wired testbed. For both the local and remote deployments, different polling periods, in different traffic conditions, are considered. Results show that, while further research is needed to investigate the variability of the relative error (standard deviation ranges between 1.21 and 8.65% in the worst case), its mean is very low, confirming the feasibility of the proposed estimation approach.

This paper presents a novel decentralized control and communication system targeting diverse set of Material Handling Systems. It is an open platform and based on modular Industrial Device collaboration. The relation of proposed system with Industrial Internet of Things, which have relatively relaxed real time requirements, is also given.

The paper deals with the development of IFA2 project, a new HVDC link between United Kingdom and France, being constructed by ABB. The major constraints (electrical, environmental, planning and landscaping) and the advantageous solution adopted to minimize the size of the AC yard of the converter station in UK are described within this document. The innovative ABB Hybrid module PASS420, together with a Gas Insulated Busbar solution, is being used in order to be compliant with the severe specification of the contract and to achieve an excellent degree of compactness and building encompassed solution.

International audience; This work deals with the retrieval of the dielectric characteristics of unknown objects buried in a lossy soil. The reconstruction performances of two deterministic inverse scattering (IS) techniques are assessed on real ground penetrating radar (GPR) data collected in an archaeological site in Cavallino (LE, Italy). Both approaches exploit a multi-resolution (MR) strategy to keep low the ratio between problem unknowns and non-redundant data. Moreover, they are respectively based on a multi-frequency (MF) and frequency-hopping (FH) approach for enabling the processing of wideband measurements. An illustrative experimental result is shown to verify the effectiveness and the potentialities of the two GPR-IS methodologies for archaeological investigations.

Process mining (PM) is an emerging research discipline that is concerned with obtaining fact-based insights on how business processes are executed within an organization. It combines model-based and data-oriented analysis techniques to discover, monitor and improve executed processes by extracting knowledge from event logs generated and stored in information systems. When process mining techniques are applied to educational data, they are often referred to as Educational Process Mining (EPM), and in different case studies EPM results were promising. This paper presents a systematic review of the current status of research in this important area. We examined the literature on research with associated case studies conducted in the domain during the past eight years (2009-2016). Search terms identified 59 papers, but inclusion and exclusion criteria limited the key studies to 37. The research questions, methodologies and findings of these published papers were analysed carefully. This paper aims to highlight the use of process mining to improve educational processes, and to provide researchers with a comprehensive background for understanding the current work being undertaken in this field.

In this contribution the results of a Ground Penetrating Radar (GPR) prospecting survey in the chapel of Aragon, within the Co-cathedral of St. John in Valletta, Malta, are presented. These results are part of a wider campaign carried out with the final goal of prospecting the subsurface in order to identify voids and/or graves beneath the tomb slabs composing the complex flooring of the entire Co-Cathedral. In particular, in the chapel of Aragon results were compared with historical documents in order to identify possible burial sites. In addition, a 3D digital model of the Chapel has been obtained through the use of photogrammetric techniques with the ultimate goal of integrating the GPR results within the digital model.