António Nogueira Nogueira - Academia.edu (original) (raw)

Papers by António Nogueira Nogueira

2002 IEEE International Conference on Communications. Conference Proceedings. ICC 2002 (Cat. No.02CH37333)

Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.... more Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.e., correlations over a wide range of time scales. However, as already shown by several authors for the case of a single queue, the second-order behavior at time scales beyond the so-called correlation horizon or critical time scale does not significantly affect network performance. In this work, we extend previous studies to the case of a network with two queuing stages, using discrete event simulation. Results show that the introduction of the second stage provokes a decrease in the correlation horizon of the input traffic, meaning that the range of time scales that need to be considered for accurate network performance evaluation is lower than predicted by a single stage model. We also resorted to simulation to evaluate the single queue model. In this case, the estimated correlation horizon values are compared with those predicted by a formula derived by Grossglauser and Bolot, which presumes the approximation of the input data by a traffic model that enables to control the autocorrelation function independently of first-order statistics. Results indicate that although the correlation horizon increases linearly with the buffer size in both methods, the simulation ones predict a lower increase rate.

Lecture Notes in Computer Science, 2004

Proceedings of SPIE - The International Society for Optical Engineering, 2001

Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.... more Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.e., correlations over a wide range of time scales. However, as already shown by several authors for the case of a single queue, the second-order behavior at time scales beyond the so-called correlation horizon or critical time scale does not significantly affect network performance. In this work, we extend previous studies to the case of a network with two queuing stages, using discrete event simulation. Results show that the second stage provokes a decrease in the correlation horizon, meaning that the range of time scales that need to be considered for accurate network performance evaluation is lower than predicted by a single stage model. We also used simulation to evaluate the single queue model. In this case, the estimated correlation horizon values are compared with those predicted by a formula derived by Grossglauser and Bolot, which presumes the approximation of the input data by a traffic model that enables to control the autocorrelation function independently of first-order statistics. Results indicate that although the correlation horizon increases linearly with the buffer size in both methods, the simulation ones predict a lower increase rate.

Telecommunication Systems, 2003

Proceedings - Advanced Industrial Conference on Telecommunications/Service Assurance with Partial and Intermittent Resources Conference/E-Learning on Telecommunications Workshop AICT/SAPIR/ELETE 2005, 2005

Traffic engineering and network management can greatly benefit from a reliable classification of ... more Traffic engineering and network management can greatly benefit from a reliable classification of Internet users. This paper evaluates the potential of different artificial Neural Network models for classifying Internet users based on their hourly traffic profile. The training of the neural ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2009

In the last few years, peer-to-peer (P2P) file-sharing applications have become very popular: mor... more In the last few years, peer-to-peer (P2P) file-sharing applications have become very popular: more users are continuously joining such systems and more objects are being made available, seducing even more users to join. Today, the traffic generated by P2P systems ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2011

This tutorial discusses the suitability of Markovian models to describe IP network traffic that e... more This tutorial discusses the suitability of Markovian models to describe IP network traffic that exhibits peculiar scale invariance properties, such as self-similarity and long range dependence. Three Markov Modulated Poisson Processes (MMPP), and their associated parameter fitting procedures, are proposed to describe the packet arrival process by incorporating these peculiar behaviors in their mathematical structure and parameter inference procedures. Since an accurate modeling of certain types of IP traffic requires matching closely not only the packet arrival process but also the packet size distribution, we also discuss a discrete-time batch Markovian arrival process that jointly characterizes the packet arrival process and the packet size distribution. The accuracy of the fitting procedures is evaluated by comparing the long range dependence properties, the probability mass function at each time scale and the queuing behavior corresponding to measured and synthetic traces generated from the inferred models.

Performance and Control of Next-Generation Communications Networks, 2003

2007 IEEE Symposium on Computers and Communications, 2007

ABSTRACT

2009 Next Generation Internet Networks, 2009

In the last few years, several new IP applications and protocols emerged as the capability of the... more In the last few years, several new IP applications and protocols emerged as the capability of the networks to provide new services increased. The rapid increase in the number of users of Peer-to-Peer (P2P) network applications, due to the fact that users are easily able to use network resources over these overlay networks, also lead to a drastic increase in the overall Internet traffic volume. An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. This paper presents a novel framework for identifying IP applications based on the multiscale behavior of the generated traffic: by performing clustering analysis over the multiscale parameters that are inferred from the measured traffic, we are able to efficiently differentiate different IP applications. Besides achieving accurate identification results, this approach also avoids some of the limitations of existing identification techniques, namely their inability do deal with stringent confidentiality requirements.

2012 IEEE International Conference on Communications (ICC), 2012

ABSTRACT Botnets became the preferred platform for launching attacks and committing fraud on ente... more ABSTRACT Botnets became the preferred platform for launching attacks and committing fraud on enterprise networks and the Internet itself. Characterizing existing Botnets will help to coordinate and develop new technologies to face this serious security threat. Several approaches can be taken to study this phenomenon: analyze its source code, which can be a hard task mainly due to license restrictions; study the control mechanism, particularly the activity of its Command and Control server(s); study its behavior, by measuring real traffic and collecting relevant statistics. In this work, we have installed some of the most popular spam Botnets, capturing the originated traffic and characterizing it in order to identify the main trends/patterns of their activity. From the intensive statistics that were collected, it was possible to conclude that there are distinct features between different Botnets that can be explored to build efficient detection methodologies.

Telecommunication Systems, 2013

ABSTRACT

Telecommunication Systems, 2010

An accurate mapping of Internet traffic to applications can be important for a broad range of net... more An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use nondefault or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. In this paper we will demonstrate that multiscale traffic analysis based on multi-order wavelet spectrum can be used as a discriminator of Internet applications traffic profiles. By performing clustering analysis over the multiscale wavelet spectrum coefficients that are inferred from the measured traffic, the proposed methodology is able to efficiently differentiate different IP applications without using any payload information. This characteristic will allow the differentiation of traffic flows in unencrypted and encrypted scenarios. In order to compare the differentiating potential of different traffic application data, upload, download and joint upload and download flow statistics are considered to evaluate the identification approach for each selected protocol. Moreover, we also evaluate which timescales and spectrum orders are more relevant for the traffic differentiation. From the analysis of the obtained results we can conclude that the proposed methodology is able to achieve good identification results using a

Procedia Computer Science, 2011

Journal of Networks, 2009

The number and variety of IP applications have hugely increased in the last few years. Among them... more The number and variety of IP applications have hugely increased in the last few years. Among them, peer-to-peer (P2P) file-sharing applications have become very popular: more users are continuously joining such systems and more objects are being made available, seducing even more users to join. An accurate mapping of traffic to applications is important for a wide range of network management tasks. Besides, traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. This paper proposes a framework to identify Internet applications that can be mainly used in situations where existing identification frameworks are not efficient or can not be used at all. The core block of the identification tool is based on neural networks and is able to identify different flow patterns generated by various Internet applications. Neural network based identification relies on a previous identification of the different IP applications that can be obtained offline using any reliable method. In this way, the paper also presents a module to process IP traffic flows and identify the underlying applications using payload analysis techniques. The identification results obtained from this tool are used in the training phase of the neural network identification framework. The accuracy of the identification framework was evaluated by performing a set of intensive tests and the results obtained show that, when conveniently trained, neural networks constitute a valuable tool to identify Internet applications while being, at the same time, immune to the most important disadvantages presented by other identification methods.

Computer Communications, 2010

Traffic engineering of IP networks requires the characterization and modeling of network traffic ... more Traffic engineering of IP networks requires the characterization and modeling of network traffic on multiple time scales due to the existence of several statistical properties that are invariant across a range of time scales, such as self-similarity, LRD and multifractality. ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2008

Abstract. There are several network management and measurement tasks, including for example traff... more Abstract. There are several network management and measurement tasks, including for example traffic engineering, service differentiation, performance or failure monitoring or security, that can greatly benefit with the ability to perform an accurate mapping of network traffic to IP ...

2002 IEEE International Conference on Communications. Conference Proceedings. ICC 2002 (Cat. No.02CH37333)

Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.... more Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.e., correlations over a wide range of time scales. However, as already shown by several authors for the case of a single queue, the second-order behavior at time scales beyond the so-called correlation horizon or critical time scale does not significantly affect network performance. In this work, we extend previous studies to the case of a network with two queuing stages, using discrete event simulation. Results show that the introduction of the second stage provokes a decrease in the correlation horizon of the input traffic, meaning that the range of time scales that need to be considered for accurate network performance evaluation is lower than predicted by a single stage model. We also resorted to simulation to evaluate the single queue model. In this case, the estimated correlation horizon values are compared with those predicted by a formula derived by Grossglauser and Bolot, which presumes the approximation of the input data by a traffic model that enables to control the autocorrelation function independently of first-order statistics. Results indicate that although the correlation horizon increases linearly with the buffer size in both methods, the simulation ones predict a lower increase rate.

Lecture Notes in Computer Science, 2004

Proceedings of SPIE - The International Society for Optical Engineering, 2001

Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.... more Network traffic processes can exhibit properties of self-similarity and long-range dependence, i.e., correlations over a wide range of time scales. However, as already shown by several authors for the case of a single queue, the second-order behavior at time scales beyond the so-called correlation horizon or critical time scale does not significantly affect network performance. In this work, we extend previous studies to the case of a network with two queuing stages, using discrete event simulation. Results show that the second stage provokes a decrease in the correlation horizon, meaning that the range of time scales that need to be considered for accurate network performance evaluation is lower than predicted by a single stage model. We also used simulation to evaluate the single queue model. In this case, the estimated correlation horizon values are compared with those predicted by a formula derived by Grossglauser and Bolot, which presumes the approximation of the input data by a traffic model that enables to control the autocorrelation function independently of first-order statistics. Results indicate that although the correlation horizon increases linearly with the buffer size in both methods, the simulation ones predict a lower increase rate.

Telecommunication Systems, 2003

Proceedings - Advanced Industrial Conference on Telecommunications/Service Assurance with Partial and Intermittent Resources Conference/E-Learning on Telecommunications Workshop AICT/SAPIR/ELETE 2005, 2005

Traffic engineering and network management can greatly benefit from a reliable classification of ... more Traffic engineering and network management can greatly benefit from a reliable classification of Internet users. This paper evaluates the potential of different artificial Neural Network models for classifying Internet users based on their hourly traffic profile. The training of the neural ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2009

In the last few years, peer-to-peer (P2P) file-sharing applications have become very popular: mor... more In the last few years, peer-to-peer (P2P) file-sharing applications have become very popular: more users are continuously joining such systems and more objects are being made available, seducing even more users to join. Today, the traffic generated by P2P systems ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2011

This tutorial discusses the suitability of Markovian models to describe IP network traffic that e... more This tutorial discusses the suitability of Markovian models to describe IP network traffic that exhibits peculiar scale invariance properties, such as self-similarity and long range dependence. Three Markov Modulated Poisson Processes (MMPP), and their associated parameter fitting procedures, are proposed to describe the packet arrival process by incorporating these peculiar behaviors in their mathematical structure and parameter inference procedures. Since an accurate modeling of certain types of IP traffic requires matching closely not only the packet arrival process but also the packet size distribution, we also discuss a discrete-time batch Markovian arrival process that jointly characterizes the packet arrival process and the packet size distribution. The accuracy of the fitting procedures is evaluated by comparing the long range dependence properties, the probability mass function at each time scale and the queuing behavior corresponding to measured and synthetic traces generated from the inferred models.

Performance and Control of Next-Generation Communications Networks, 2003

2007 IEEE Symposium on Computers and Communications, 2007

ABSTRACT

2009 Next Generation Internet Networks, 2009

In the last few years, several new IP applications and protocols emerged as the capability of the... more In the last few years, several new IP applications and protocols emerged as the capability of the networks to provide new services increased. The rapid increase in the number of users of Peer-to-Peer (P2P) network applications, due to the fact that users are easily able to use network resources over these overlay networks, also lead to a drastic increase in the overall Internet traffic volume. An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. This paper presents a novel framework for identifying IP applications based on the multiscale behavior of the generated traffic: by performing clustering analysis over the multiscale parameters that are inferred from the measured traffic, we are able to efficiently differentiate different IP applications. Besides achieving accurate identification results, this approach also avoids some of the limitations of existing identification techniques, namely their inability do deal with stringent confidentiality requirements.

2012 IEEE International Conference on Communications (ICC), 2012

ABSTRACT Botnets became the preferred platform for launching attacks and committing fraud on ente... more ABSTRACT Botnets became the preferred platform for launching attacks and committing fraud on enterprise networks and the Internet itself. Characterizing existing Botnets will help to coordinate and develop new technologies to face this serious security threat. Several approaches can be taken to study this phenomenon: analyze its source code, which can be a hard task mainly due to license restrictions; study the control mechanism, particularly the activity of its Command and Control server(s); study its behavior, by measuring real traffic and collecting relevant statistics. In this work, we have installed some of the most popular spam Botnets, capturing the originated traffic and characterizing it in order to identify the main trends/patterns of their activity. From the intensive statistics that were collected, it was possible to conclude that there are distinct features between different Botnets that can be explored to build efficient detection methodologies.

Telecommunication Systems, 2013

ABSTRACT

Telecommunication Systems, 2010

An accurate mapping of Internet traffic to applications can be important for a broad range of net... more An accurate mapping of Internet traffic to applications can be important for a broad range of network management and measurement tasks, including traffic engineering, service differentiation, performance/failure monitoring and security. Traditional mapping approaches have become increasingly inaccurate because many applications use nondefault or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. In this paper we will demonstrate that multiscale traffic analysis based on multi-order wavelet spectrum can be used as a discriminator of Internet applications traffic profiles. By performing clustering analysis over the multiscale wavelet spectrum coefficients that are inferred from the measured traffic, the proposed methodology is able to efficiently differentiate different IP applications without using any payload information. This characteristic will allow the differentiation of traffic flows in unencrypted and encrypted scenarios. In order to compare the differentiating potential of different traffic application data, upload, download and joint upload and download flow statistics are considered to evaluate the identification approach for each selected protocol. Moreover, we also evaluate which timescales and spectrum orders are more relevant for the traffic differentiation. From the analysis of the obtained results we can conclude that the proposed methodology is able to achieve good identification results using a

Procedia Computer Science, 2011

Journal of Networks, 2009

The number and variety of IP applications have hugely increased in the last few years. Among them... more The number and variety of IP applications have hugely increased in the last few years. Among them, peer-to-peer (P2P) file-sharing applications have become very popular: more users are continuously joining such systems and more objects are being made available, seducing even more users to join. An accurate mapping of traffic to applications is important for a wide range of network management tasks. Besides, traditional mapping approaches have become increasingly inaccurate because many applications use non-default or ephemeral port numbers, use well-known port numbers associated with other applications, change application signatures or use traffic encryption. This paper proposes a framework to identify Internet applications that can be mainly used in situations where existing identification frameworks are not efficient or can not be used at all. The core block of the identification tool is based on neural networks and is able to identify different flow patterns generated by various Internet applications. Neural network based identification relies on a previous identification of the different IP applications that can be obtained offline using any reliable method. In this way, the paper also presents a module to process IP traffic flows and identify the underlying applications using payload analysis techniques. The identification results obtained from this tool are used in the training phase of the neural network identification framework. The accuracy of the identification framework was evaluated by performing a set of intensive tests and the results obtained show that, when conveniently trained, neural networks constitute a valuable tool to identify Internet applications while being, at the same time, immune to the most important disadvantages presented by other identification methods.

Computer Communications, 2010

Traffic engineering of IP networks requires the characterization and modeling of network traffic ... more Traffic engineering of IP networks requires the characterization and modeling of network traffic on multiple time scales due to the existence of several statistical properties that are invariant across a range of time scales, such as self-similarity, LRD and multifractality. ...

Lecture Notes in Computer Science (including subseries Lecture Notes in Artificial Intelligence and Lecture Notes in Bioinformatics), 2008

Abstract. There are several network management and measurement tasks, including for example traff... more Abstract. There are several network management and measurement tasks, including for example traffic engineering, service differentiation, performance or failure monitoring or security, that can greatly benefit with the ability to perform an accurate mapping of network traffic to IP ...