Discovering the Dynamic Complexity of TCP Using Machine Learning and Deep Learning Techniques

Abstract

Understanding the dynamic complexity of the internal states of TCP is a fundamental challenge, and particularly demanding due to the dynamics and complexity of modern networks. TCP is one of the key transport protocols of today’s IP suite that supports most of the popular applications on the Internet. The main objective of this dissertation is to discover the dynamic complexity of TCP and obtain detailed knowledge about the end hosts from passive measurements using modern machine learning and deep learning techniques. Passive measurement has a clear advantage over active measurements since it doesn’t generate traffic overhead to the underlying network. In the networking research community, there is an increasing interest in applying machine learning and deep learning techniques in different contexts. Machine learning approaches have effectively revolutionized and advanced the state-of-the-art for many research domain problems. In this dissertation, we study the applicability of state-of-the-art machine learning and deep learning approaches in computer networks by focusing on three main use cases: (i ) TCP state monitoring from passive traffic measurements (ii) Network intrusion detection (iii) Passive operating system fingerprinting. The main research questions around which this dissertation is centered are: (i) How can an intermediate node (e.g., a network operator) infer functionalities that determine a network condition from passive measurements? (ii ) How can we enhance computer network security attack analysis using regularized machine learning techniques? (iii ) Are we able to accurately classify the remote computer’s operating system from passive measurements? Finally, this dissertation shows how an intermediate node can passively identify the transmission states of the TCP client associated with a TCP flow. We empirically demonstrate how the intermediate node can infer the cwnd size, predict at real-time the RTT between the sender and receiver, predict the underlying TCP variants of both loss-based and delay-based congestion control algorithms of the TCP client. Consequently, combining these contributions together, we built a deep learning-based universal tool for passive monitoring that can be applied to first estimate the cwnd, second predict the underlying TCP flavor and finally uses the predicted TCP variant as an input feature to passively fingerprint the remote computer’s operating system. Our experimental results indicate the effectiveness of the proposed prediction models with reasonably high accuracy across different validation scenarios and multiple TCP variants. We believe that our work will be useful for the industry since passive measurements are becoming increasingly useful for network operators and Internet service providers to evaluate the communication performance of applications and services running on their networks.