Search

Ideally, in a real cyberattack, the early detection of probable hacker intent can lead to improved mitigation or prevention of exploitation. With the knowledge of basic principles of communication protocols, the reconnaissance/scanning phase intentions of a hacker can be inferred by detecting specific patterns of behavior associated with hacker tools and commands. Analyzing the reconnaissance behavior of the TCP Syn Scan between Nmap and the host, we built machine learning models incorporating the use of a filtering method we developed for labeling a dataset for detection of this behavior. We conclude that feature selection and detailed targeted labeling, based on behavior patterns, yield a high accuracy and F1 Score using Random Forest and Logistics Regression classifiers. [ABSTRACT FROM AUTHOR]

The accurate and timely detection of cyber threats is critical to keeping our online economy and data safe. A key technique in early detection is the classification of unusual patterns of network behaviour, often hidden as low-frequency events within complex time-series packet flows. One of the ways in which such anomalies can be detected is to analyse the information entropy of the payload within individual packets, since changes in entropy can often indicate suspicious activity—such as whether session encryption has been compromised, or whether a plaintext channel has been co-opted as a covert channel. To decide whether activity is anomalous, we need to compare real-time entropy values with baseline values, and while the analysis of entropy in packet data is not particularly new, to the best of our knowledge, there are no published baselines for payload entropy across commonly used network services. We offer two contributions: (1) we analyse several large packet datasets to establish baseline payload information entropy values for standard network services, and (2) we present an efficient method for engineering entropy metrics from packet flows from real-time and offline packet data. Such entropy metrics can be included within feature subsets, thus making the feature set richer for subsequent analysis and machine learning applications. [ABSTRACT FROM AUTHOR]

Ideally, in a real cyberattack, the early detection of probable hacker intent can lead to improved mitigation or prevention of exploitation. With the knowledge of basic principles of communication protocols, the reconnaissance/scanning phase intentions of a hacker can be inferred by detecting specific patterns of behavior associated with hacker tools and commands. Analyzing the reconnaissance behavior of the TCP Syn Scan between Nmap and the host, we built machine learning models incorporating the use of a filtering method we developed for labeling a dataset for detection of this behavior. We conclude that feature selection and detailed targeted labeling, based on behavior patterns, yield a high accuracy and F1 Score using Random Forest and Logistics Regression classifiers.

Deep packet inspection is a network security solution that identifies and flags anomalous network traffic patterns in a local network environment. Traditional signature-based techniques for intrusion detection are limited in identifying different attacks or completely new kinds, which makes them unsuitable in some situations. In addition, most previous methods for anomaly detection have low detection rate and high false alarm. In this study, a deep packet inspection model based on support vector machine (SVM) for anomaly detection in local area networks was proposed. The proposed method combined the SelectKBest method and SVM for the categorization of anomaly in a local network environment. Results showed that the proposed method outperformed other related machine learning methods with accuracy, precision, recall, and F1-score of 94.81%, 94.03%, 94.13%, and 94.0799%, respectively. The accuracy result shows that most network traffic can be correctly identified by the SVM using the SelectKBest approach, with minimal false positives or negatives.

Deep Packet Inspection (DPI) methods are extensively used in traffic classification. These methods extract unique application content either at byte or bit level granularity and represent them as signatures. DPI involves string or regular expression matching, which is computationally expensive, and evaluating signatures at bit-level granularity makes it even more inefficient. With the ever-increasing bandwidth and the high-speed internet traffic, the software implementations of DPI have become a performance bottleneck. In this paper, we propose HClass, a DPI-based network traffic classifier completely implemented in software to speed up signature matching. Our contributions with HClass are three-fold. First, we propose a hybrid signature matching technique with a combination of bit and byte-level signatures. Second, we propose methods to perform bit-level signature matching with byte/word level operations to cope with software implementations and be compatible with general-purpose CPU operations. Third, it uses a two-phase signature matching where first-phase signatures are short and quickly identify the potential application(s), and the second-phase signatures verify the potential application(s) to reduce false positives. We perform experiments with HClass on three datasets and report classification performance and execution time improvement of HClass with our implementations in C language. [ABSTRACT FROM AUTHOR]

In network traffic classification, it is important to understand the correlation between network traffic and its causal application, protocol, or service group, for example, in facilitating lawful interception, ensuring the quality of service, preventing application choke points, and facilitating malicious behavior identification. In this paper, we review existing network classification techniques, such as port-based identification and those based on deep packet inspection, statistical features in conjunction with machine learning, and deep learning algorithms. We also explain the implementations, advantages, and limitations associated with these techniques. Our review also extends to publicly available datasets used in the literature. Finally, we discuss existing and emerging challenges, as well as future research directions.

With the rapid proliferation of Internet of Things (IoT) devices, the security and integrity of network traffic have emerged as critical challenges. The exponential growth of IoT devices has introduced complex security vulnerabilities that demand innovative solutions. Analyzing IoT network traffic and detecting attacks in real-time present formidable challenges. Traditional security measures often fall short in addressing the adaptable and dynamic nature of these threats. The below paper presents a new Deep Packet Inspection technique using a combination of Recurrent Neural Networks, LSTM, and GRU. Using DPI, the facility can be made available to extract and analyze parameters like protocol, source, destination addresses, port numbers, payload, timestamp, packet length, sequence number, flags, quality of service markings, content type, content length, user agent, referrer metric parameter sets. The accuracy and intensity of the detection results for the attacks imposed in the network traffic data are enhanced with LSTM and GRU architectures. Formidable robustness in detecting the imposed attacks was determined to improve security in the IoT forensic layer while analyzing the network traffic. Usability can be applied in real-time monitoring systems, intrusion detection and prevention systems, and forensic investigation. For example, it ensures protection for sensitive data. It would allow connected devices and services to run without disturbance through the targeted detection of specific attacks like DoS attacks, malware exploitation, and unauthorized access attempts. To conclude, the outline of this paper falls within the scope of some of the matters that must be dealt with promptly related to the security of IoT networks through a remarkable innovative solution, that is, the usage of DPI and RNNs based- LSTM and GRU network architectures. The obtained results related to the following factors show not just good precision and good accuracy but also good recall, which showed high confidence in detection. [ABSTRACT FROM AUTHOR]

The accurate and timely detection of cyber threats is critical to keeping our online economy and data safe. A key technique in early detection is the classification of unusual patterns of network behaviour, often hidden as low-frequency events within complex time-series packet flows. One of the ways in which such anomalies can be detected is to analyse the information entropy of the payload within individual packets, since changes in entropy can often indicate suspicious activity—such as whether session encryption has been compromised, or whether a plaintext channel has been co-opted as a covert channel. To decide whether activity is anomalous, we need to compare real-time entropy values with baseline values, and while the analysis of entropy in packet data is not particularly new, to the best of our knowledge, there are no published baselines for payload entropy across commonly used network services. We offer two contributions: (1) we analyse several large packet datasets to establish baseline payload information entropy values for standard network services, and (2) we present an efficient method for engineering entropy metrics from packet flows from real-time and offline packet data. Such entropy metrics can be included within feature subsets, thus making the feature set richer for subsequent analysis and machine learning applications.

Derin Paket İnceleme (Deep Packet Inspection-DPI), hem paket başlığı hem de paket yükü üzerinde ayrıntılı analizler gerçekleştirerek ağ trafiğinin tam görünürlüğünü sağlayan teknolojidir. DPI ile iyi bilinen kötü amaçlı yazılım imzaları ve saldırı sırası, saldırganın izlediği yol ve kullandığı tekniklerin birleşimi olarak tanımlanan saldırı deseninin tespiti yapılabilmektedir. Bu doğrultuda, ağ güvenliği veya devlet gözetimi gibi uygulamalarda kullanılabilmesi yönüyle DPI, kritik bir öneme sahiptir. Bu çalışmada, tek seferde taranan bayt sayısını artırarak DPI sürecini hızlandırmayı amaçlayan blok tabanlı bir örüntü eşleştirme algoritması önerilmiştir. Farklı sayıda örüntü içeren veri kümeleri kullanılarak Aho-Corasick (AC), Rabin-Karp (RK), Wu-Manber (WM) ve bu çalışmada önerilen algoritma üzerinde örüntü eşleştirme testleri gerçekleştirilmiş ve bu algoritmaların performansları karşılaştırılmıştır. AC, WU ve RK algoritmalarına kıyasla bu çalışmada önerilen algoritma, daha yüksek bir performans göstermiştir.

Nowadays, almost all network traffic is encrypted. Attackers hide themselves using this traffic and attack over encrypted channels. Inspections performed only on packet headers and metadata are insufficient for detecting cyberattacks over encrypted channels. Therefore, it is important to analyze packet contents in applications that require control over payloads, such as content filtering, intrusion detection systems (IDSs), data loss prevention systems (DLPs), and fraud detection. This technology, known as deep packet inspection (DPI), provides full control over the communication between two end stations by keenly analyzing the network traffic. This study proposes a multi-pattern-matching algorithm that reduces the memory space and time required in the DPI pattern matching compared to traditional automaton-based algorithms with its ability to process more than one packet payload character at once. The pattern-matching process in the DPI system created to evaluate the performance of the proposed algorithm (PA) is conducted on the graphics processing unit (GPU), which accelerates the processing of network packets with its parallel computing capability. This study compares the PA with the Aho-Corasick (AC) and Wu–Manber (WM) algorithms, which are widely used in the pattern-matching process, considering the memory space required and throughput obtained. Algorithm tables created with a dataset containing 500 patterns use 425 and 688 times less memory space than those of the AC and WM algorithms, respectively. In the pattern-matching process using these tables, the PA is 3.5 and 1.5 times more efficient than the AC and WM algorithms, respectively. [ABSTRACT FROM AUTHOR]

Copyright of Duzce University Journal of Science & Technology is the property of Duzce University Journal of Science & Technology and its content may not be copied or emailed to multiple sites or posted to a listserv without the copyright holder's express written permission. However, users may print, download, or email articles for individual use. This abstract may be abridged. No warranty is given about the accuracy of the copy. Users should refer to the original published version of the material for the full abstract. (Copyright applies to all Abstracts.)

Deep Packet Inspection (DPI) provides full visibility into network traffic by performing detailed analysis on both packet header and packet payload. Accordingly, DPI has critical importance as it can be used in applications i.e network security or government surveillance. In this paper, we provide an extensive survey on DPI. Different from the previous studies, we try to efficiently integrate DPI techniques into network analysis mechanisms by identifying performance-limiting parameters in the analysis of modern network traffic. Analysis of the network traffic model with complex behaviors is carried out with powerful hybrid systems by combining more than one technique. Therefore, DPI methods are studied together with other techniques used in the analysis of network traffic. Security applications of DPI on Internet of Things (IoT) and Software-Defined Networking (SDN) architectures are discussed and Intrusion Detection Systems (IDS) mechanisms, in which the DPI is applied as a component of the hybrid system, are examined. In addition, methods that perform inspection of encrypted network traffic are emphasized and these methods are evaluated from the point of security, performance and functionality. Future research issues are also discussed taking into account the implementation challenges for all DPI processes. [ABSTRACT FROM AUTHOR]

This article proposes the creation of the deep packet inspection (DPI) dataset to study subscribers' behavior on the network, applying ensemble learning to this dataset, and comparing it with the UGRansome dataset. The subscriber can be thought of as a person or a group of users using a network service or connectivity. The DPI features represent the subscriber network usage, and the ensemble learning approach is implemented on the DPI dataset to predict the subscriber's service category on the network. The classification and prediction problem addressed on the DPI dataset reached a precision of 100%. The paper predicts that the web and streaming categories with Netflix, Facebook, and YouTube services will be the most utilized in the next few years. This study will lead to a better understanding of the idiosyncratic behavior of active subscribers on the network, exposing novel network anomalies and facilitating the development of novel DPI systems. [ABSTRACT FROM AUTHOR]

Network traffic processing is an automated method for arranging and optimizing network traffic, based on the parameters. The traffic data is gathered to begin the study of the component of network traffic. Subsequently, the clustering and grouping process is carried out to evaluate network traffic. Continuous evaluation of the patterns of network traffic remained a daunting challenge during traffic classification. However, existing approaches have not been able to reduce time consumption and improve clustering accuracy for network traffic analysis. In order to resolve these problems, a Density-based Mean Shift Clustering and Deep Packet Inspection Classification (DMSC-DPIC) methodology is implemented to perform an efficient network traffic analysis. In addition, the classification model DPI has been developed to identify network Traffic by payloading data points with minimum time as real as well as non-real-time traffic. In the DPI classification model, data points are grouped into various groups by analyzing associated points throughout the session. The experimental assessment of the proposed methodology DMSC-DPIC is carried out with the CAIDA anonymized Internet Traces Dataset and achieves improved efficiency compared with state-of-the-art work in terms of clustering precision, classification time and communications overhead. [ABSTRACT FROM AUTHOR]

Nowadays, almost all network traffic is encrypted. Attackers hide themselves using this traffic and attack over encrypted channels. Inspections performed only on packet headers and metadata are insufficient for detecting cyberattacks over encrypted channels. Therefore, it is important to analyze packet contents in applications that require control over payloads, such as content filtering, intrusion detection systems (IDSs), data loss prevention systems (DLPs), and fraud detection. This technology, known as deep packet inspection (DPI), provides full control over the communication between two end stations by keenly analyzing the network traffic. This study proposes a multi-pattern-matching algorithm that reduces the memory space and time required in the DPI pattern matching compared to traditional automaton-based algorithms with its ability to process more than one packet payload character at once. The pattern-matching process in the DPI system created to evaluate the performance of the proposed algorithm (PA) is conducted on the graphics processing unit (GPU), which accelerates the processing of network packets with its parallel computing capability. This study compares the PA with the Aho-Corasick (AC) and Wu–Manber (WM) algorithms, which are widely used in the pattern-matching process, considering the memory space required and throughput obtained. Algorithm tables created with a dataset containing 500 patterns use 425 and 688 times less memory space than those of the AC and WM algorithms, respectively. In the pattern-matching process using these tables, the PA is 3.5 and 1.5 times more efficient than the AC and WM algorithms, respectively.

This work studies Orbot, an anonymous overlay network used to browse the Internet. Its ease of use has attracted all kinds of people, including ordinary Internet users who want to avoid being profiled to bypass censorship, government intelligence agencies that need to do operations on the Internet without being detected and companies who do not want to reveal information to their competitors. This article aims to study, analyze, and mostly identify the Orbot traffic, since much of it is used for illegal purposes. A method of identification of the anonymous network is established by examining the traffic to identify clues. The method used to detect the use of the Orbot application in the network is based on the creation of the rules with Snort IDS from the analysis of the packets in Wireshark analyzer. The encryption aspect of the flow of this anonymous network brings us to a deep packet inspection (DPI). A set of Snort rules were developed as a proof of concept for the proposed Orbot detection approach. Our traffic detection methodology has demonstrated that it can detect Orbot connections in real time. [ABSTRACT FROM AUTHOR]

Abstract The always increasing mobile connectivity affects every aspect of our daily lives, including how and when we keep ourselves informed and consult news media. By studying a DPI (deep packet inspection) dataset, provided by one of the major Chilean telecommunication companies, we investigate how different cohorts of the population of Santiago De Chile consume news media content through their smartphones. We find that some socio-demographic attributes are highly associated to specific news media consumption patterns. In particular, education and age play a significant role in shaping the consumers behaviour even in the digital context, in agreement with a large body of literature on off-line media distribution channels.

This paper investigates and proposes a solution for Protocol Independent Switch Architecture (PISA) to process application layer data, enabling the inspection of application content. PISA is a novel approach in networking where the switch does not run any embedded binary code but rather an interpreted code written in a domain-specific language. The main motivation behind this approach is that telecommunication operators do not want to be locked in by a vendor for any type of networking equipment, develop their own networking code in a hardware environment that is not governed by a single equipment manufacturer. This approach also eases the modeling of equipment in a simulation environment as all of the components of a hardware switch run the same compatible code in a software modeled switch. The novel techniques in this paper exploit the main functions of a programmable switch and combine the streaming data processor to create the desired effect from a telecommunication operator perspective to lower the costs and govern the network in a comprehensive manner. The results indicate that the proposed solution using PISA switches enables application visibility in an outstanding performance. This ability helps the operators to remove a fundamental gap between flexibility and scalability by making the best use of limited compute resources in application identification and the response to them. The experimental study indicates that, without any optimization, the proposed solution increases the performance of application identification systems 5.5 to 47.0 times. This study promises that DPI, NGFW (Next-Generation Firewall), and such application layer systems which have quite high costs per unit traffic volume and could not scale to a Tbps level, can be combined with PISA to overcome the cost and scalability issues. [ABSTRACT FROM AUTHOR]

Network traffic security inspection is vital in today's network. However, due to the increasing user demand, security inspection resources are becoming a bottleneck of the network, therefore bringing down network throughput. In this paper, we proposed an OpenFlow‐based flow management prototype, which can properly allocate limited security resources in order to achieve the objective of making the best use of security resources without compromising network throughput. We introduced a capacity reservation scheme to enforce network security and avoid security devices becoming congested. In order to optimize utilization of security devices, we formulated the resource‐constrained problem as an integer linear programming problem and solved it. Extensive experiments were performed to attest to the effectiveness of our prototype. Finally, we analyzed results of the experiment, including the impact on network performance of two parameters in the optimization formulations. Compared to other works, we have the following strengths: our model was implemented on a general network topology with distributed security devices; we formulated the flow allocation problem into a linear programming problem and performed the optimization in the controller in real time; and no pre‐knowledge about the network, hosts, or traffic was needed. [ABSTRACT FROM AUTHOR]

We consider the problem of approximate reduction of non-deterministic automata that appear in hardware-accelerated network intrusion detection systems (NIDSes). We define an error distance of a reduced automaton from the original one as the probability of packets being incorrectly classified by the reduced automaton (wrt the probabilistic distribution of packets in the network traffic). We use this notion to design an approximate reduction procedure that achieves a great size reduction (much beyond the state-of-the-art language-preserving techniques) with a controlled and small error. We have implemented our approach and evaluated it on use cases from Snort, a popular NIDS. Our results provide experimental evidence that the method can be highly efficient in practice, allowing NIDSes to follow the rapid growth in the speed of networks. [ABSTRACT FROM AUTHOR]

Extracting fields from layer 7 protocols such as HTTP, known as L7 parsing, is the key to many critical network applications. However, existing L7 parsing techniques center around protocol specifications, thereby incurring large human efforts in specifying data format and high computational/memory costs that poorly scale with the explosive number of L7 protocols. To this end, this paper introduces a new framework named content-based L7 parsing, where the content instead of the format becomes the first class citizen. Under this framework, users only need to label what content they are interested in, and the parser learns an extraction model from the users’ labeling behaviors. Since the parser is specification-independent, both the human effort and computational/memory costs can be dramatically reduced. To realize content-based L7 parsing, we propose REPLAY which builds on recurrent neural network (RNN) and addresses a series of technical challenges like large labeling overhead and slow parsing speed. We prototype REPLAY on GPUs, and show it can achieve a precision of 98% and a recall of 97%, with a throughput as high as 12Gbps for diverse extraction tasks. [ABSTRACT FROM AUTHOR]

Network traffic classification finds its applications in a variety of network management tasks such as quality of service, security monitoring, traffic engineering, etc. Deep Packet Inspection is one of the methods to identify applications. With the number of proprietary protocols on the rise and network protocols using bit level information for encoding, recently it has been shown that bit level signatures are effective for identifying applications. In this paper, we propose BitProb which generates probabilistic bit signatures for traffic classification. It uses the probability of a bit at a particular position being either 0 or 1 and generates a space efficient signature represented as a state transition machine. Subsequently, it uses the overall probability of an ${n}$ bit binary string extracted from a network flow to identify which application generated the flow. We experiment with three datasets covering twenty protocols (text, binary and proprietary) and show that BitProb classifies network flows with high accuracy and has a minimum number of misclassifications. [ABSTRACT FROM AUTHOR]

Deep Packet Inspection (DPI) at the core of many monitoring appliances, such as NIDS, NIPS, plays a major role. DPI is beneficial to content providers and censorship to monitor network traffic. However, the surge of network traffic has put tremendous pressure on the performance of DPI. In fact, the sensitive content being monitored is only a minority of network traffic, that is to say, most is undesired. A close look at the network traffic, we found that it contains many undesired high frequency content (UHC) that are not monitored. As everyone knows, the key to improve DPI performance is to skip as many useless characters as possible. Nevertheless, researchers generally study the algorithm of skipping useless characters through sensitive content, ignoring the high-frequency non-sensitive content. To fill this gap, in this literature, we design a model, named Fast AC Model with Skipping (FAMS), to quickly skip UHC while scanning traffic. The model consists of a standard AC automaton, where the input traffic is scanned byte-by-byte, and an additional sub-model, which includes a mapping set and UHC matching model. The mapping set is a bridge between the state node of AC and UHC matching model, while the latter is to select a matching function from hash and fingerprint functions. Our experiments show promising results that we achieve a throughput gain of 1.3-2.6 times the original throughput and 1.1-1.3 times Barr’s double path method. [ABSTRACT FROM AUTHOR]

The always increasing mobile connectivity affects every aspect of our daily lives, including how and when we keep ourselves informed and consult news media. By studying a DPI (deep packet inspection) dataset, provided by one of the major Chilean telecommunication companies, we investigate how different cohorts of the population of Santiago De Chile consume news media content through their smartphones. We find that some socio-demographic attributes are highly associated to specific news media consumption patterns. In particular, education and age play a significant role in shaping the consumers behaviour even in the digital context, in agreement with a large body of literature on off-line media distribution channels. [ABSTRACT FROM AUTHOR]

Packet analysis is a primary traceback technique in network forensics, which, providing that the packet details captured are sufficiently detailed, can play back even the entire network traffic for a particular point in time. This can be used to find traces of nefarious online behavior, data breaches, unauthorized website access, malware infection, and intrusion attempts, and to reconstruct image files, documents, email attachments, etc. sent over the network. This paper is a comprehensive survey of the utilization of packet analysis, including deep packet inspection, in network forensics, and provides a review of AIpowered packet analysis methods with advanced network traffic classification and pattern identification capabilities. Considering that not all network information can be used in court, the types of digital evidence that might be admissible are detailed. The properties of both hardware appliances and packet analyzer software are reviewed from the perspective of their potential use in network forensics. [ABSTRACT FROM AUTHOR]

Human-centered smart devices profiling with Wi-Fi networks has received much attention from both research and industry, especially those network operators and security agencies who aim to enhance user experience and security of home network as well as free Wi-Fi services. One type of such profiling is the extraction of mobile phone numbers. In traditional cellular networks, such as 3G and 4G, mobile phone number extraction can be achieved from the analysis of the authentication signaling. However, this method cannot be used in the broadband network environment, e.g., Wi-Fi. Operators and security agencies of Wi-Fi networks often apply manual statistics, telephone inquiries or user input for information. Unfortunately, those traditional methods are inefficient in practice. Moreover, authenticity cannot be guaranteed with the traditional methods. In this paper, we propose a smart method for mobile phone number extraction in smart home networks and systems. In particular, the proposed method is based on deep packet inspection of home broadband traffic. To improve the efficiency and accuracy of detection, we further propose a smart automated signature extraction method of mobile phone numbers from home network traffic. Our proposed method can achieve 86.2% accuracy in the real-life human-centered smart home network test.

In order to solve the problem of traffic usage caused by the increasing penetration rate of 4G in recent years,an algorithm that uses mobile DPI detailed bill and billing bill was proposed,and big data platform was adopted.The related processing technology implements the algorithm and shows the effect of the current network operation evaluation.

Deep packet inspection (DPI) represents the major process in network intrusion detection and prevention systems. In DPI each security threat is represented as a signature, and the payload of every incoming data packet is matched against the set of current signatures. Moreover, DPI is also used for other networking applications such as packet classification, quality of service techniques, protocol identification and so on. DPI exhausts extra central processing unit and memory resources, and as a result, several attempts have been proposed to improve this process. In this study, the authors proposed a fast two‐dimensional (2D) filter with low false positive (FP) rate for DPI purposes. It consists of 2D array that employs single hash function and has very low FP rate. Using this filter as an identification tool in a DPI technique will result in more accurate and higher throughput than other systems that employ Bloom (BFs) and quotient filters (QFs). Our experiments show that the proposed solution has time improvement up to 94% over others that employ BFs or QFs and the achieved average throughput is 1.8 Gbps.

Evolution in cellular wireless communication and standardization has brought out technological advancements in physical and medium access (MAC) layer protocol to scale the data rate on the air interface like in Long Term Evolution (LTE) or New Radio (NR) 3GPP standards, by 10X to 100X compared to older technologies. At the same time there is not muchthrust given on the interworking with TCP/IP, resulting in poor user experience, as a similar scale of improvement is not seen at application level, once the technologies are deployed in field. The problem related to delayed TCP acknowledgement (ACKs) acts as bottleneck at application level, which in turn results in low uplink (UL) or downlink (DL) Throughput (TP) at the User Equipment (UE). Solutions available in the literature to address the same increase either the processing complexity or wastage of resources, or both. In this paper, two novel solutions are presented to address prioritization of TCP ACKs by Sequence Number (SN) reservation and SN space management in simultaneous UL/DL traffic scenarios while maintaining low complexity. Through mathematical modelling and simulation in a standard setupfor LTE network, we are able to achieve the effective decrease in downloading time by 5 ~ 25% in comparison to standard schemes. The solution is easy adoptable in NR based 5G network.