Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Network traffic analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 55 records · Page 3
All sourcesNASA NTRSDOE OSTI
DOE OSTI2014

Discrete Mathematical Approaches to Graph-Based Traffic Analysis

Modern cyber defense and anlaytics requires general, formal models of cyber systems. Multi-scale network models are prime candidates for such formalisms, using discrete mathematical methods based in hierarchically-structured directed multigraphs which also include rich sets of labels. An exemplar of an application of such an approach is traffic analysis, that is, observing and analyzing connections between clients, servers, hosts, and actors within IP networks, over time, to identify characteristic or suspicious patterns. Towards that end, NetFlow (or more generically, IPFLOW) data are available from routers and servers which summarize coherent groups of IP packets flowing through the network. In this paper, we consider traffic analysis of Netflow using both basic graph statistics and two new mathematical measures involving labeled degree distributions and time interval overlap measures. We do all of this over the VAST test data set of 96M synthetic Netflow graph edges, against which we can identify characteristic patterns of simulated ground-truth network attacks.

Joslyn, Cliff A.↗
NASA NTRS2016

Traffic Modeling for Deep Space Network in the Human Mars Exploration Era

In this article we describe the analysis and simulation effort of the end-to-end traffic flow for the Deep Space Network (DSN) in the Human Exploration Era, when DSN will provide communication and navigation services for human missions to distant celestial objects like the Moon, asteroids, and Mars. Using the network traffic derived for the 30-day period within July/August 2039 from the Space Communications Mission Model (SCMM), we simulate the bandwidths of the ground links and the buffer profiles of the network nodes. We also use a 2-state Markov scheme that models the store-and-forward mechanism that regulates the ground network traffic. The network traffic modeling and simulation generates ground bandwidth and buffer statistics, which in turn are used to formulate the future DSN ground network bandwidth and storage requirements.

Cheung, Kar-ming↗
DOE OSTI2024

Unconventional Quantum Advantages for Computation (U-QuAC)

While quantum computing offers the promise of exponential advantages, limited quantum speedups are known, especially for practical applications. To open new avenues for quantum advantages, we propose Unconventional Quantum Advantages for Computation (U-QuACs), with respect to unconventional resources such as space (number of bits or quantum bits of memory required to solve a problem), accuracy of solution, communication, or energy consumption. We focus on space-efficient quantum algorithms, where we seek to design algorithms that solve a problem using much less space than the total size of the input. A natural setting in which space is critical is the streaming model of computation, where the input data arrives sequentially in pieces that must each be processed individually. Streaming is motivated by a variety of problems including analysis of internet traffic or social networks. We design the first exponential quantum space advantage for a natural streaming problem, which also constitutes the first quantum advantage for approximating a discrete optimization problem, albeit with respect to space.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2025

MSU IETC ML for Modbus (AN EDGE)

This study explores machine learning for decoding Modbus RTU data using K-Nearest Neighbors (KNN) models. An initial KNN model trained on 8,000 packets achieved 95.15% accuracy. Although ML improves generalization, accuracy still falls short of deterministic methods. These findings have implications for Modbus traffic analysis, intrusion detection in industrial networks, and adaptive error correction in real-time monitoring systems. By refining ML-based decoding, future work could enable more efficient anomaly detection and predictive maintenance in industrial automation and cybersecurity applications.

Communication Protocol↗
DOE OSTI2020

Real-time Intrusion Detection for High-bandwidth Research Networks using Unsupervised Deep Learning

Nowadays, data generated by large-scale scientific experiments are on the scale of petabytes per month. These data are transferred through dedicated high-bandwidth networks across distributed collaboration sites for processing, storage, and analysis. Like general purpose networks, research networks experience attacks. However, monitoring traffic in such high-bandwidth network environments is challenging with conventional deep packet inspection (DPI)- based network intrusion detection systems (NIDS). Recently, machine learning (ML) algorithms have shown potential in detecting anomalous patterns with better generalizability and faster speed. Compared to the general purpose networks, traffic movement in research network is less volatile and more likely to benefit from the ML-based anomaly analysis. We present ThunderSecure, an efficient AI-powered system for detecting anomalies in 100G research networks. ThunderSecure implements a high-throughput packet processing infrastructure using multi-cores and GPUs. It takes time-series statistics from a variety of network measurements and uses 2D Convolutional Neural Network (CNN) to explore both spatial and temporal dependencies in network data stream. Patterns of science data traffic are learned with a one-class neural network, which blends an Adversarial Autoencoder (AAE) with Gaussian mixture density estimation. Testing traffic flows exhibiting significant deviations from the learned baseline of normality are marked as anomalies. We trained ThunderSecure on hundreds of billions of science data packets recorded from a 100G research network at Fermi National Accelerator Laboratory. The detection performance was evaluated on traffic captured from the same research network days and weeks after the training with different types of attack flows injected. To the best of our knowledge, this is the first ML work in the area of network anomaly detection that has been validated on such extreme scale datasets. Results show that ThunderSecure can recognize science data traffic that are captured long after the training and make nearly certain detection on those with anomalous flows injected, even in the case when the anomaly-to-normal mixing ratio is 0.1%.

Gong, Qian↗
DOE OSTI2014

A Network Management System for Handling Scientific Data Flows

Large scientific data transfers often occur at high rates causing increased burstiness in Internet traffic. To limit the adverse effects of these high-rate large-sized flows, which are referred to as $\alpha $ flows, on delay-sensitive audio/video flows, a network management system called Alpha Flow Traffic Engineering System (AFTES) is proposed for intra-domain traffic engineering. An offline approach is used in which AFTES analyzes NetFlow records collected by routers, extracts source–destination address prefixes of $\alpha $ flows, and uses these prefixes to configure firewall filters at ingress routers of a provider’s network to redirect future $\alpha $ flows to traffic-engineered paths and isolated queues. The effectiveness of this scheme was evaluated through an analysis of 7 months of NetFlow data obtained from an ESnet router. For this data set, 91 % of bytes generated by $\alpha $ flows during high-rate intervals would have been directed had AFTES been deployed. The negative aspect of using address prefixes in firewall filters, i.e., the redirection of $\beta $ flows to $\alpha $-flow paths/queues, was also quantified.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2015

Peeking Network States with Clustered Patterns

Network traffic monitoring has long been a core element for effec- tive network management and security. However, it is still a chal- lenging task with a high degree of complexity for comprehensive analysis when considering multiple variables and ever-increasing traffic volumes to monitor. For example, one of the widely con- sidered approaches is to scrutinize probabilistic distributions, but it poses a scalability concern and multivariate analysis is not gen- erally supported due to the exponential increase of the complexity. In this work, we propose a novel method for network traffic moni- toring based on clustering, one of the powerful deep-learning tech- niques. We show that the new approach enables us to recognize clustered results as patterns representing the network states, which can then be utilized to evaluate “similarity” of network states over time. In addition, we define a new quantitative measure for the similarity between two compared network states observed in dif- ferent time windows, as a supportive means for intuitive analysis. Finally, we demonstrate the clustering-based network monitoring with public traffic traces, and show that the proposed approach us- ing the clustering method has a great opportunity for feasible, cost- effective network monitoring.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2024

Distributed optimization for multi-commodity urban traffic control

A distributed method for concurrent traffic signal and routing control of traffic networks is proposed. The method is based on the multi-commodity store-and-forward model, in which the destinations are the commodities. The system benefits from the communication between vehicles and infrastructure, providing optimal signal timings to intersections and routes to vehicles on a link-by-link basis. Using the augmented Lagrangian to model the constraints into the objective, the baseline centralized problem is decomposed into a set of objective-coupled subproblems, one for each intersection, enabling the solution to be computed by a distributed- gradient projection algorithm. Further, the intersection agents only need to communicate and coordinate with neighboring intersections to ensure convergence to the optimal solution while tolerating suboptimal iterations that offer more flexibility, unlike other distributed approaches. Through microsimulation, we demonstrate the effectiveness of the proposed algorithm in traffic networks with time-varying demand. Computational analysis shows that the distributed problem is suitable for real-time applications. A robustness analysis show that the distributed formulation enables a graceful degradation of the system in case of failure.

Augmented Lagrangian↗
DOE OSTI2020

Truck platooning in the U.S. national road network: A system-level modeling approach

Truck platooning enables a group of trucks to move close together, which helps reduce truck fuel use and increase effective road capacity. In this paper, a system-level equilibrium model is developed to characterize spontaneous truck platooning with coexistence of non-platooning vehicles in a network, by explicitly accounting for the interlocking relationship among platoon formation time, truck fuel saving, and increase in effective road capacity. To equilibrate the relationships, an algorithm is proposed which involves a diagonalization approach and a bush based algorithm to solve decomposed subproblems. The condition of proportionality is imposed to obtain unique traffic flows for each class of vehicles on road links. In addition, a spatially constrained multivariate clustering technique is employed to construct origin/destination zones that are smaller than the coarse Freight Analysis Framework (FAF) zones, while maintaining reasonable computational burden for network traffic assignment. Model implementation in the U.S. shows that platooning could lead to 7.9% fuel saving among platoonable trucks in 2025 and a comparable increase in effective capacity of platoonable road links, which would account for 60% of rural interstate roads. The fuel saving and road capacity improvement translate into an annual cost reduction of $\$$868 million for the U.S. intercity trucking sector and reduced road infrastructure investment needs worth $\$$4.8 billion. Extensive sensitivity analysis further reveals that fuel saving of platoonable trucks increases with platoon size but decreases with inter-truck distance in a platoon. Fuel saving potential suggests that priority should be given to rural rather than urban roads in deploying platooning technologies. As we expected, greater market penetration of platooning technologies means higher fuel saving and greater increase in effective road capacity.

33 ADVANCED PROPULSION SYSTEMS↗
DOE OSTI2022

Network upgrade exploiting multi band: S- or E-band?

Nowadays, the fiber spectrum is only partially exploited, i.e., mainly in the C-band and more recently in the C + L-band, where the fiber attenuation profile experiences the minimum. Thus, fiber communications technology—amplifiers, switching, transceivers, etc.—and networking solutions are mature for those spectrum bands. However, the continuous increase in traffic means that capacity saturation of the current infrastructure is looming. Taking advantage of the unused portions of the spectrum (e.g., the S- and E-bands) may be an efficient solution to accommodate an increase in traffic without installing new fibers. Research is thus investigating multi-band transmission and networking to evaluate and enable such network upgrades. Some issues need to be solved or taken into account, from the enabling technology (e.g., amplifiers in the S- or E-band are still under development) to physical layer effects previously neglected, such as stimulated Raman scattering (SRS). SRS affects wideband transmission, potentially degrading active channels. The contribution of this paper is the investigation of network upgrades for C + L-band systems. In particular, upgrades exploiting the E- and S-bands are compared taking into account each band capacity and the effects of SRS on both new and already deployed channels (in both the C- and L-bands). A detailed analysis of the physical layer is provided also in the presence of guard bands between previously exploited bands and the bands used for upgrade. By leveraging the physical layer assessment, a networking analysis is carried out to evaluate the supported traffic increase and also the signal quality degradation due to SRS on active channels. Overall, the results suggest that upgrades to the E- and S-bands support a comparable increase in traffic. However, the exploitation of the E-band with 14 THz of guard band between the C- and E-bands may avoid detrimental effects to already active channels in the C + L-band, suggesting this upgrade strategy can be the most effective of the two.

47 OTHER INSTRUMENTATION↗
DOE OSTI2025

Reducing Communication Overhead in Federated Learning for Network Anomaly Detection with Adaptive Client Selection

Communication overhead in federated learning (FL) poses a significant challenge for network anomaly detection systems, where the myriad of client configurations and network conditions can severely impact system efficiency and detection accuracy. While existing approaches attempt to address this through individual optimization techniques, they often fail to maintain the delicate balance between reduced overhead and detection performance. This paper presents an adaptive FL framework that dynamically combines batch size optimization, client selection, and asynchronous updates to achieve efficient anomaly detection. Through extensive profiling and experimental analysis on two distinct datasets-UNSW-NBIS for general network traffic and ROAD for automotive networks-our framework reduces communication overhead by 97.6%; (from 700.0s to 16.8s) compared to synchronous baseline approaches while maintaining comparable detection accuracy (95.10%; vs. 95.12%;). Statistical validation using Mann-Whitney U test confirms significant improvements (p < 0.05) over existing FL approaches across both datasets, demonstrating the framework's adaptability to different network security contexts. Detailed profiling analysis reveals the efficiency gains through dramatic reductions in GPU operations and memory transfers while maintaining robust detection performance under varying client conditions.

Marfo, William [University of Texas at El Paso]↗
NASA NTRS2008

Analysis of a Dynamic Multi-Track Airway Concept for Air Traffic Management

The Dynamic Multi-track Airways (DMA) Concept for Air Traffic Management (ATM) proposes a network of high-altitude airways constructed of multiple, closely spaced, parallel tracks designed to increase en-route capacity in high-demand airspace corridors. Segregated from non-airway operations, these multi-track airways establish high-priority traffic flow corridors along optimal routes between major terminal areas throughout the National Airspace System (NAS). Air traffic controllers transition aircraft equipped for DMA operations to DMA entry points, the aircraft use autonomous control of airspeed to fly the continuous-airspace airway and achieve an economic benefit, and controllers then transition the aircraft from the DMA exit to the terminal area. Aircraft authority within the DMA includes responsibility for spacing and/or separation from other DMA aircraft. The DMA controller is responsible for coordinating the entry and exit of traffic to and from the DMA and for traffic flow management (TFM), including adjusting DMA routing on a daily basis to account for predicted weather and wind patterns and re-routing DMAs in real time to accommodate unpredicted weather changes. However, the DMA controller is not responsible for monitoring the DMA for traffic separation. This report defines the mature state concept, explores its feasibility and performance, and identifies potential benefits. The report also discusses (a) an analysis of a single DMA, which was modeled within the NAS to assess capacity and determine the impact of a single DMA on regional sector loads and conflict potential; (b) a demand analysis, which was conducted to determine likely city-pair candidates for a nationwide DMA network and to determine the expected demand fraction; (c) two track configurations, which were modeled and analyzed for their operational characteristic; (d) software-prototype airborne capabilities developed for DMA operations research; (e) a feasibility analysis of key attributes in the concept design; (f) a near-term, transitional application of the DMA concept as a proving ground for new airborne technologies; and (g) conclusions. The analysis indicates that the operational feasibility of a national DMA network faces significant challenges, especially for interactions between DMAs and between DMA and non-DMA traffic. Provided these issues are resolved, sectors near DMAs could experience significant local capacity benefits.

Wing, David J.↗
DOE OSTI2022

GradientGraph

Under this SBIR Phase II, Reservoir Labs has developed G2 Analytics, a new technology that allows network operators to analyze bottleneck and flow performance with high precision. G2 delivers a new analytical approach and framework to resolve a variety of key problems found in modern communication networks, including: traffic engineering, routing, flow scheduling, network design, capacity planning, resiliency analysis, network slicing, or service level agreement (SLA) management, among others. G2 leverages the bottleneck structure of congestion-controlled communication networks, a recent mathematical discovery by the Reservoir team [RL19b, RL20a, RL20b, RL21a]. Bottleneck structures reveal how perturbations on flows and links propagate through the network, providing an analytical framework to measure (qualitatively and quantitatively) the ripple effects induced as they traverse the network. Leveraging the mathematics of bottleneck structures, Reservoir Labs is developing the G2 technology to provide network operators with a framework to design, optimize and troubleshoot network performance. This delivery includes the G2 software stack.

Yellamraju, Sruthi↗
DOE OSTI2021

Modeling Data Flows with Network Calculus in Cyber-Physical Systems: Enabling Feature Analysis for Anomaly Detection Applications

The electric grid is becoming increasingly cyber-physical with the addition of smart technologies, new communication interfaces, and automated grid-support functions. Because of this, it is no longer sufficient to only study the physical system dynamics, but the cyber system must also be monitored as well to examine cyber-physical interactions and effects on the overall system. To address this gap for both operational and security needs, cyber-physical situational awareness is needed to monitor the system to detect any faults or malicious activity. Techniques and models to understand the physical system (the power system operation) exist, but methods to study the cyber system are needed, which can assist in understanding how the network traffic and changes to network conditions affect applications such as data analysis, intrusion detection systems (IDS), and anomaly detection. In this paper, we examine and develop models of data flows in communication networks of cyber-physical systems (CPSs) and explore how network calculus can be utilized to develop those models for CPSs, with a focus on anomaly and intrusion detection. This provides a foundation for methods to examine how changes to behavior in the CPS can be modeled and for investigating cyber effects in CPSs in anomaly detection applications.

97 MATHEMATICS AND COMPUTING↗