Encrypted traffic has been known to be vulnerable to traffic analysis attacks that exploit the statistical features of encrypted traffic flows, such as packet sizes, timing, and direction, to infer information about the underlying content, which undermines the privacy guarantees of end-to-end encryption. While state-of-the-art attacks leverage deep learning models to achieve high accuracy, most attacks work under the less realistic closed-set assumption. Deploying such attacks in practice requires addressing the open-set scenario, which allows the models to filter out target content from other background traffic. Concurrently, Large Language Models (LLM) are increasingly gaining traction due to their ability to adapt to diverse tasks in domains outside NLP, especially in applications with sequential data. Inspired by this, our work introduces TrafficGPT, a novel traffic analysis attack that leverages GPT-2, a popular LLM, to enhance feature extraction, thereby improving the open-set performance of downstream classification. We use five existing encrypted traffic datasets to show how the feature extraction by GPT-2 improves the open-set performance of traffic analysis attacks compared to ET-BERT and CNN-based approaches by 12.7% and 13.7%, respectively.
eBPF and XDP are promising technologies that are capable of accelerating packet processing inside the Linux kernel. Despite these benefits, eBPF is constrained by a number of rigorous restrictions that are imposed to protect the kernel. One such restriction is the lack of support for floating-point values, which was introduced to achieve faster execution and avoid non-deterministic behavior. However, this has become a significant obstacle to expanding the functionality of eBPF programs with advanced algorithms. In this paper, we propose dynamic fixed-point as a solution to overcome this challenge within the restrictions of eBPF. Dynamic fixed-point values are an expansion from traditional fixed-point values, with the bit allocation adjusted dynamically. Benefit of dynamic fixed-point is that the accuracy of calculations are improved, which is one of the critical shortcomings of fixed-point. To demonstrate the effectiveness of our approach, we have designed and implemented a prototype of an entropy-based traffic anomaly detection framework and have reported on its throughput and the detection accuracy. Our prototype, which employs dynamic fixed-point, has achieved an 18% improvement in throughput while also matching the detection accuracy of a similar system that employs floating-point values in user space.
As the number of Internet users continues to increase, there is an urgent need to train Internet engineers to support this infrastructure. Our research team is designing and managing an educational program to foster Internet engineers for undergraduate students in the Asia-Pacific (APAC) region. As part of the program, we are conducting on-site hands-on exercises to create a computer network with remote locations using Research and Education Networks (RENs). Since these onsite hands-on exercises will be conducted in various places in the APAC region, delays caused by physical distance are unavoidable. Therefore, our team has designed a low response time hands-on exercise environment to ensure comfortable student activities. Furthermore, to verify the effectiveness of this design, we conducted a simulation verification using a virtual environment. We confirmed that the design provides a low response time, even considering the unavoidable latency over distances in the APAC region.
Deploying Internet-of-Things (IoT) assets, such as cameras, printers, and building sensors, at scale introduces operational and cyber risks to organizations. While public repositories such as the National Vulnerability Database (NVD) or Exploit-DB provide valuable data on known cyber risks, each comes with its specific query format, and their knowledge is often fragmented, lacking a comprehensive perspective. Organizations often require the capability to assess current vulnerabilities and forecast future risks from distributed and nonunified sources. This paper aims to empower digital infrastructure teams to obtain a complete view of IoT cyber risks. First, we map public repositories for digital product vulnerabilities, exploits, and patches (solutions). This includes highlighting their interrelationships and the information they offer. Second, we develop a data schema to detail cyber risks associated with specific products, like equipment, operating systems, or applications. We build “vesData", a tool that takes a product name as input and automatically produces a machine-processable data structure of its risk knowledge. We apply our tool to obtain public risk data of about 20 consumer IoT products in our lab—our tool and data will be released openly. Third, we demonstrate a preliminary use case of our structured IoT risk data, which predicts new vulnerabilities, patches, and exploits for existing ones.
Generally, a network administrator designs, constructs, and operates an enterprise network. Since inconsistency between the network design understood by the administrator and the actual network configuration might arise due to mistakes or errors, a method for automatically detecting such inconsistency is needed. The following four techniques are necessary for this purpose. (i) A machine-readable notation to represent the network configuration. (ii) A tool to write down the network design using the machine-readable notation. (iii) A tool to automatically detect the current network configuration and write it down in the machine-readable notation. (iv) A tool to compare the two outputs generated in (ii) and (iii). This paper employs the network ontology called Bonsai for (i). Bonsai can represent not only physical configurations but also virtualization technologies such as VLAN and overlay. This paper proposes three tools, nc-design, nc-detect, and nc-diff for (ii)-(iv), and confirms that they work as expected in the test network. This paper also measures their fundamental performance.
