Skip to main content
Springer Nature Link
Log in

Application Error Detection in Networks by Protocol Behavior Model

  • Conference paper
  • First Online:
E-Business and Telecommunications (ICETE 2019)

Part of the book series: Communications in Computer and Information Science ((CCIS,volume 1247))

Included in the following conference series:

  • 287 Accesses

Abstract

The identification of causes of errors in network systems is difficult due to their inherent complexity. Network administrators usually rely on available information sources to analyze the current situation and identify possible problems. Even though they are able to identify the symptoms seen in the past and thus can apply their experience gathered from the solved cases the time needed to identify and correct the errors is considerable. The automation of the troubleshooting process is a way to reduce the time spent on individual cases. In this paper, the model that can be used to automate the diagnostic process of network communication is presented. The model is based on building the finite automaton to describe protocol behavior in various situations. The unknown communication is checked against the model to identify error states and associated descriptions of causes. The tool prototype was implemented in order to demonstrate the proposed method via a set of experiments.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Log in via an institution

Subscribe and save

Springer+ Basic
€32.70 /Month
  • Get 10 units per month
  • Download Article/Chapter or eBook
  • 1 Unit = 1 Article or 1 Chapter
  • Cancel anytime
Subscribe now

Buy Now

Chapter
EUR 29.95
Price includes VAT (France)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
EUR 42.79
Price includes VAT (France)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
EUR 52.74
Price includes VAT (France)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

Similar content being viewed by others

Notes

  1. 1.

    http://www.root9.net/2012/11/ssl-decryption-with-wireshark-private.html.

  2. 2.

    https://www.wireshark.org/docs/man-pages/tshark.html.

  3. 3.

    https://github.com/marhoSVK/semiauto-diagnostics.

References

  1. Aggarwal, B., Bhagwan, R., Das, T., Eswaran, S., Padmanabhan, V.N., Voelker, G.M.: NetPrints: diagnosing home network misconfigurations using shared knowledge. In: Proceedings of the 6th USENIX symposium on Networked Systems Design and Implementation, pp. 349–364, July 2009. http://portal.acm.org/citation.cfm?id=1559001

  2. Anand, A., Akella, A.: Net-replay: a new network primitive. ACM SIGMETRICS Perform. Eval. Rev. 37(3), 14–19 (2010). https://doi.org/10.1145/1710115.1710119

    Article  Google Scholar 

  3. Antunes, J., Neves, N., Verissimo, P.: ReverX: reverse engineering of protocols. Technical report 2011–01, Department of Informatics, School of Sciences, University of Lisbon (2011). http://hdl.handle.net/10451/14078

  4. Burschka, S., Dupasquier, B.: Tranalyzer: versatile high performance network traffic analyser. In: 2016 IEEE Symposium Series on Computational Intelligence (SSCI), pp.1–8 (2017). https://doi.org/10.1109/SSCI.2016.7849909

  5. Casas, P., Zseby, T., Mellia, M.: Big-DAMA: big data analytics for network traffic monitoring and analysis. In: Proceedings of the 2016 Workshop on Fostering Latin-American Research in Data Communication Networks (ACM LANCOMM 2016), pp. 1–3 (2016). https://doi.org/10.1145/2940116.2940117

  6. Chen, M., Zheng, A., Lloyd, J., Jordan, M., Brewer, E.: Failure diagnosis using decision trees. In: Proceedings of International Conference on Autonomic Computing, pp. 36–43 (2004). https://doi.org/10.1109/ICAC.2004.1301345. http://ieeexplore.ieee.org/document/1301345/

  7. Comparetti, P.M., Wondracek, G., Krügel, C., Kirda, E.: Prospex: protocol specification extraction. In: 2009 30th IEEE Symposium on Security and Privacy, pp. 110–125 (2009)

    Google Scholar 

  8. Cui, W., Kannan, J., Wang, H.J.: Discoverer: automatic protocol reverse engineering from network traces. In: Proceedings of 16th USENIX Security Symposium on USENIX Security Symposium, SS 2007, p. 14. USENIX Association, Boston (2007). Article no 14. ISBN 1113335555779

    Google Scholar 

  9. De Paola, A., et al.: Rule based reasoning for network management. In: 7th International Workshop on Computer Architecture for Machine Perception (CAMP 2005), pp. 25–30, July 2005. https://doi.org/10.1109/CAMP.2005.47

  10. Dhamdhere, A., Teixeira, R., Dovrolis, C., Diot, C.: NetDiagnoser: troubleshooting network unreachabilities using end-to-end probes and routing data. In: Proceedings of the 2007 ACM CoNEXT (2007). https://doi.org/10.1145/1364654.1364677

  11. Dong, C., Dulay, N.: Argumentation-based fault diagnosis for home networks. In: Proceedings of the 2nd ACM SIGCOMM Workshop on Home Networks, Home Networks 2011, pp. 37–42. Association for Computing Machinery. New York (2011). https://doi.org/10.1145/2018567.2018576

  12. El Sheikh, A.Y.: Evaluation of the capabilities of wireshark as network intrusion system. J. Global Res. Comput. Sci. 9(8), 01–08 (2018)

    Google Scholar 

  13. Holkovič, M., Ryšavý, O., Polčák, L.: Using network traces to generate models for automatic network application protocols diagnostics. In: Proceedings of the 16th International Joint Conference on e-Business and Telecommunications Volume 1: DCNET, ICE-B, OPTICS, SIGMAP and WINSYS, pp. 43–53. SciTePress - Science and Technology Publications (2019). https://www.fit.vut.cz/research/publication/12012

  14. Ivković, N., Milić, L., Konecki, M.: A timed automata model for systems with gateway-connected controller area networks. In: 2018 IEEE 3rd International Conference on Communication and Information Systems (ICCIS), pp. 97–101. IEEE (2018)

    Google Scholar 

  15. Kim, S., et al.: A rule based approach to network fault and security diagnosis with agent collaboration. In: Kim, T.G. (ed.) AIS 2004. LNCS (LNAI), vol. 3397, pp. 597–606. Springer, Heidelberg (2005). https://doi.org/10.1007/978-3-540-30583-5_63

    Chapter  Google Scholar 

  16. Krueger, T., Gascon, H., Krämer, N., Rieck, K.: Learning stateful models for network honeypots. In: Proceedings of the 5th ACM Workshop on Security and Artificial Intelligence, AISec 2012, pp. 37–48. Association for Computing Machinery, New York 2012). https://doi.org/10.1145/2381896.2381904

  17. Ladi, G., Buttyon, L., Holczer, T.: Message format and field semantics inference for binary protocols using recorded network traffic. In: 2018 26th International Conference on Software, Telecommunications and Computer Networks (SoftCOM) (2018). https://doi.org/10.23919/SOFTCOM.2018.8555813

  18. Lunze, J., Supavatanakul, P.: Diagnosis of discrete-event system described by timed automata. IFAC Proc. Vol. 35(1), 77–82 (2002)

    Article  Google Scholar 

  19. Luo, M., Zhang, D., Phua, G., Chen, L., Wang, D.: An interactive rule based event management system for effective equipment troubleshooting. In: Proceedings of the IEEE Conference on Decision and Control, vol. 8(3), pp. 2329–2334 (2011). https://doi.org/10.1007/s10489-005-4605-0

  20. Orzach, Y.: Network Analysis Using Wireshark Cookbook. Packt Publishing Ltd., Birmingham (2013)

    Google Scholar 

  21. Pellegrino, G., Lin, Q., Hammerschmidt, C., Verwer, S.: Learning behavioral fingerprints from netflows using timed automata. In: 2017 IFIP/IEEE Symposium on Integrated Network and Service Management (IM), pp. 308–316. IEEE (2017)

    Google Scholar 

  22. Polčák, L.: Lawful interception: identity detection. Ph.D. thesis, Brno University of Technology, Faculty of Information Technology (2017). https://www.fit.vut.cz/study/phd-thesis/679/

  23. Procházka, M., Macko, D., Jelemenská, K.: IP networks diagnostic communication generator. In: Emerging eLearning Technologies and Applications (ICETA), pp. 1–6 (2017)

    Google Scholar 

  24. Samhat, A., Skehill, R., Altman, Z.: Automated troubleshooting in WLAN networks. In: 2007 16th IST Mobile and Wireless Communications Summit (2007). https://doi.org/10.1109/ISTMWC.2007.4299084

  25. łgorzata Steinder, M., Sethi, A.S.: A survey of fault localization techniques in computer networks. Sci. Comput. Program. 53(2), 165–194 (2004)

    Google Scholar 

  26. Tong, V., Tran, H.A., Souihi, S., Mellouk, A.: Network troubleshooting: survey, taxonomy and challenges. In: 2018 International Conference on Smart Communications in Network Technologies, SaCoNeT 2018, pp. 165–170 (2018). https://doi.org/10.1109/SaCoNeT.2018.8585610

  27. Traverso, S., et al.: Exploiting hybrid measurements for network troubleshooting. In: 2014 16th International Telecommunications Network Strategy and Planning Symposium, Networks (2014). https://doi.org/10.1109/NETWKS.2014.6959212

  28. Wang, Y., Zhang, Z., Yao, D.D., Qu, B., Guo, L.: Inferring protocol state machine from network traces: a probabilistic approach. In: Lopez, J., Tsudik, G. (eds.) ACNS 2011. LNCS, vol. 6715, pp. 1–18. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-21554-4_1

    Chapter  Google Scholar 

  29. Wondracek, G., Comparetti, P.M., Kruegel, C., Kirda, E.: Automatic network protocol analysis. In: Proceedings of the 15th Annual Network and Distributed System Security Symposium, NDSS (2008)

    Google Scholar 

  30. Xiao, M.M., Yu, S.Z., Wang, Y.: Automatic network protocol automaton extraction. In: NSS 2009 - Network and System Security (2009). https://doi.org/10.1109/NSS.2009.71

  31. Zeng, H., Kazemian, P., Varghese, G., McKeown, N.: A survey on network troubleshooting. Technical report Stanford/TR12-HPNG-061012, Stanford University (2012)

    Google Scholar 

Download references

Acknowledgements

This work was supported by The Ministry of Education, Youth and Sports from the National Programme of Sustainability (NPU II) project IT4Innovations excellence in science - LQ1602.

Author information

Authors and Affiliations

  1. Faculty of Information Technology, NES@FIT, Brno University of Technology, Bozetechova 1/2, 612 66, Brno, Czech Republic

    Martin Holkovič

  2. Faculty of Information Technology, Centre of Excellence IT4Innovations, Brno University of Technology, Bozetechova 1/2, 612 66, Brno, Czech Republic

    Libor Polčák & Ondřej Ryšavý

Authors
  1. Martin Holkovič
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Libor Polčák
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Ondřej Ryšavý
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Martin Holkovič .

Editor information

Editors and Affiliations

  1. Fellow of IEEE, Dean of College of Computing & Informatics, University of Sharjah, Sharjah, United Arab Emirates

    Mohammad S. Obaidat

Rights and permissions

Reprints and permissions

Copyright information

© 2020 Springer Nature Switzerland AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Holkovič, M., Polčák, L., Ryšavý, O. (2020). Application Error Detection in Networks by Protocol Behavior Model. In: Obaidat, M. (eds) E-Business and Telecommunications. ICETE 2019. Communications in Computer and Information Science, vol 1247. Springer, Cham. https://doi.org/10.1007/978-3-030-52686-3_1

Download citation

  • DOI: https://doi.org/10.1007/978-3-030-52686-3_1

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-030-52685-6

  • Online ISBN: 978-3-030-52686-3

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics

Search

Navigation