Sequence Preserving Network Traffic Generation
  We present the Network Traffic Generator (NTG), a framework for perturbing
recorded network traffic with the purpose of generating diverse but realistic
background traffic for network simulation and what-if analysis in enterprise
environments. The framework preserves many characteristics of the original
traffic recorded in an enterprise, as well as sequences of network activities.
Using the proposed framework, the original traffic flows are profiled using 200
cross-protocol features. The traffic is aggregated into flows of packets
between IP pairs and clustered into groups of similar network activities.
Sequences of network activities are then extracted. We examined two methods for
extracting sequences of activities: a Markov model and a neural language model.
Finally, new traffic is generated using the extracted model. We developed a
prototype of the framework and conducted extensive experiments based on two
real network traffic collections. Hypothesis testing was used to examine the
difference between the distribution of original and generated features, showing
that 30-100\% of the extracted features were preserved. Small differences
between n-gram perplexities in sequences of network activities in the original
and generated traffic, indicate that sequences of network activities were well
preserved.
