{'fraction_non_alphanumeric': 0.0287095501183899, 'fraction_numerical': 0.010704419889502763, 'mean_word_length': 4.694662921348314, 'pattern_counts': {'":': 0, '<': 0, '<?xml version=': 0, '>': 1, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
Passive TCP Identification for Wired and WirelessNetworks: A Long-Short Term Memory Approach

Transmission control protocol (TCP) congestion control is one of the key techniques to improve network performance. TCP congestion control algorithm identification (TCP identification) can be used to significantly improve network efficiency. Existing TCP identification methods can only be applied to limited number of TCP congestion control algorithms and focus on wired networks. In this paper, we proposed a machine learning based passive TCP identification method for wired and wireless networks. After comparing among three typical machine learning models, we concluded that the 4-layers Long Short Term Memory (LSTM) model achieves the best identification accuracy. Our approach achieves better than 98% accuracy in wired and wireless networks and works for newly proposed TCP congestion control algorithms.


I. INTRODUCTION
Transmission control protocol / Internet protocol (TCP/IP) lay the foundation of today's information society. With years of research efforts, many TCP algorithms 1 have been devoted to prevent the network congestion as well as the transmission packet losses. As the typical packet transmission over Internet is based on wired architecture, traditional TCP algorithms, such as NewReno [1], Cubic [2] and Vegas [3], focus on the network congestion event. With the rapid development of wireless transmission, current TCP algorithms, e.g. Sprout [4] / Verus [5], jointly consider the transmission packet loss in the wireless environment, and achieve a better trade-off between the transmission delay and throughput.
Ideally, the intelligent network shall automatically identify the TCP algorithms and adapt the network routing policy and transmission resources to maximize the network utility. However, even the initial TCP algorithm identification has been regarded as a challenging task, and plenty of research efforts have been spent until recently [6]- [11]. According to the way of data collection, TCP identification can be mainly divided into two categories, namely active detection and passive measurement, where the former relies on observing the behaviors of injected redundant packets and passive measurement relies on the observations at intermediate nodes, without affecting the current network traffic. The passive measurement has minimum effects on network which is more practical than active detection, so is commonly used in recent work [6], [12], [13].
Among the existing passive TCP identification methods, a cluster based scheme has been proposed in [12], which can identify any 2 out of 14 TCP algorithms and achieves 85% identification accuracy. However, subject to the cluster-based method, the work is difficult to extend for the identification of newly proposed algorithms. Meanwhile the accuracy is affected by the calculation of artificial features. According to [6], the congestion avoidance algorithm identification (CAAI) can identify 15 TCP algorithms available in major operating system and reaches overall 96.98% identification accuracy. The inputs of the model are multiplicative decrease parameter and window growth function (the offset window sizes) that they believe will remain the same for most TCP algorithms. However the assumption is invalid for newly proposed algorithms, like BBR [14], and can not be applied directly. Another kind of passive TCP identification algorithms utilize the back-off factor by inferring the size of congestion window (CWND) during wired transmissions, which can identify 3 TCP algorithms with 95% accuracy as reported in [13]. Since the back-off factor is time-varying, this type of method is only valid for loss-based algorithms. As far as we aware, the previous works are based on the wired environment and new types of features need to be exploited for the identification of newly proposed algorithms in wireless networks.
In this paper, we propose a machine learning based passive TCP identification method to address the above issues, and the main contributions are summarized as follows.
• Unified Passive TCP Identification Framework. We proposed a unified passive TCP identification framework, which consists of a features extraction block and an identification block. Different from the traditional identification algorithms, the proposed framework can easily expanded to support the identification of new types of TCP algorithms. • Joint consideration of wired and wireless performance. In order to jointly support wired and wireless environments, we propose a LSTM based passive TCP identification method, which can extract the time-domain correlations to reflect the congestion-based features (mainly for wired networks) and the transmission loss features (mainly for wireless networks). By fully utilizing the LSTM and dense connected neural network architecture, our proposed method can identify 5 TCP algorithms with 99.8% accuracy in wired networks and 6 TCP algorithms with 98.2% accuracy in wireless networks. The rest of the paper is arranged as follows. In Section II, the problem formulation and limitations are analyzed. Our system model is introduced in Section III, including features selection and identification model. In Section IV, we introduce the experiment settings and evaluation results. Finally, the conclusion and future work are presented in Section V.
II. PROBLEM FORMULATION TCP identification methods are typically based on the analysis of maximum a posteriori estimation (MAP), which can be expressed as (1) according to the Bayes formula.
θ is the variant of TCP algorithm and F is the input vector. P θ/F (θ 0 /f ) is the probability of the TCP algorithm θ 0 when the input is the vector f . P F/θ (f /θ 0 ) is the probability distribution function of f when TCP algorithm is θ 0 . We can further write the above equation (1) in the following form.
is the proportion of TCP algorithm θ 0 in the training set. For a Bayesian generative model, the training set and testing set are assumed to be sampled from the same probability distribution [15], so θ 0 is a constant here. P F (f ) is the normalization parameter, which represents the distribution probability of the input vector f in the entire input set F . As equation (2) is the probability distribution function about TCP θ, the probability of P F (f ) can be considered as a constant. Thus P θ/F (θ 0 /f ) can be written as the right hand side of equation (2). The problem is transformed to find the maximum probability of all TCP algorithms for each input vector f . The TCP algorithm with the maximum probability is considered as the sender's TCP variant in current input conditions. The optimization function is expressed as shown in (3).
is the discrete probability mass function of the TCP algorithm. The important part of TCP identification is to construct the probability function. The previous methods infer the back-off factor β for the identification of TCP algorithms [13]. For example, the β of Cubic is 0.7 [2], for Reno is 0.5. Referring to the traditional Addictive Increase Multiple Decrease (AIMD) mechanism, the core function is (4).
W (t) is the value of CWND at time t. α and β are constant. α is used to increase the CWND and β is used to decrease the CWND quickly. p t−1 indicates a normal ACK when it equals to 1, otherwise a loss or timeout has occurred in last transmission. Two methods are used to infer the β: (i) using packet loss event; (ii) exploiting time out event. By comparing the change in the cwnd value before and after the loss or timeout event occurs, the β can be inferred. However, even for traditional delay-based algorithms, the above method can not work well. The biggest differences are back-off factors which values change over time. Refer to Vegas [3], the common expressions of α and β in delay-based algorithms shown as (5).
T otalSize t−1 is the total bytes sent at last t-1 time. minRtt ∆T is the minimum round trip time (RTT) observed in ∆T period. T otalSize t−1 /minRtt ∆T stands for the expected transmission rate. T otalSize t−1 /Rtt t−1 is the actual transmission rate. When actual transmission rate less than expected rate, α(t) > 0 and CWND increases, otherwise decreases. m, T , k and C are constant. β is decided by a function about recent observed RTT. More factors, like RT T , minRT T and T otalSize which change over time, are introduced to control the CWND. According to [6], the window growth function is introduced to construct the probability function and to realize the identification of the delay-based algorithms.
The newly proposed TCP algorithms that based on different theories and models are more difficult to identify than before. The reason is that they have more control factors that change over time, and the factors are not independent of each other completely [4], [5], [14], which makes the construction of the probability function difficult. The identification model need to deal with multiple control factors so as to identify multiple algorithms. The differences and relations of these factors have to be considered, which is not easy to address in traditional methods. Machine learning has the ability to construct the complex function in this aspect and is used in our method. We will give a further introduction in Sec III.B.

III. SYSTEM MODEL
In this section, the system model of our proposed method will be introduced, as shown in Fig. 1. In order to extract the features that used to train the network, the captured data passively collected from the user side will be pre-processed firstly. Next step, the pre-processed data is sent to data process block so that it can be aligned on the time-domain. After that the data is sent into the well tuned identification model to identify the TCP algorithm of the data. The parts of features selection and learning-based identification model will be introduced in detail.

A. Features Selection
For the convenience of actual deployment, the data is collected in a passive way that has the minimal effect on current traffic. Considering different network scenarios, the locations used to collect data differ. The data is collected from the receiver in wired networks, while we choose UE and base station in wireless networks.  1) Features in wired networks: Although higher accuracy can be achieved if the nodes for data collection are closer to the sender [13]. However, server usually runs several service VMs and each of them may use different TCP algorithms which means there are at least two TCP flows in the links from the server to the closest router. One TCP flow may suffer interference from another. We can not change the configuration of router to optimize for a single TCP flow as it is unfair to other flows. In contrast, the reconfiguration of user side is more easy and practical, so the data are collected passively from receiver in wired networks.
The features extracted from raw TCP packets are passively collected from the receiver side using tcpdump tool, including inflight, throughput and oneway RTT, as shown in Fig. 2. In order to collect oneway RTT, the TCP TimeStamps option is open at the server and user side. And the throughput is calculated as (6): P acketSize is the size of received packet and T imeDif is the difference of arrival time between two adjacent received packets. The features of different TCP algorithms have its unique behaviors and relationship which will be exploited to train our identification model. 2) Features in wireless networks: Different from wired networks, the state information of base station (BS) is collected besides the raw TCP packets from user equipment (UE) in wireless networks. Because the performance of TCP degrades seriously and the state information from BS can reflect the situation experienced by TCP in wireless channel to some extent. The accuracy of identification will be improved if combined with the state information from BS.
The features extracted from UE are throughput and oneway RTT 2 . The state information from BS including the buffer size of radio link control (RLC) layer and the delay of packet data convergence protocol (PDCP) layer. The size of RLC buffer can reflect the overall network congestion. The delay of PDCP layer represents the queuing delay of air interface and the delay caused by re-transmissions in wireless channel, such as automatic repeat request (ARQ) in RLC acknowledged mode (AM). Compared with the wired networks, wireless channel has high bit errors that result in more fluctuations of the features' behaviors, as shown in Fig. 3, which is a challenge to TCP identification.  Machine learning has the ability to extract features and has been widely used in image classification and natural language processing. We combine machine learning with TCP identification as shown in Fig. 1. The data collected from the user side is fed into the neural network to train the machine learning model for the identification of TCP algorithms.

B. Learning-Based Identification Model
Three typical machine learning models are exploited and compared in wireless networks, including dense neural network (DNN), convolutional neural network (CNN) and LSTM. We use the same dataset to train 3 and test, and all network models have been well tuned to achieve the best accuracy. The network configurations and results are listed in Table I. The 4layers LSTM network has the highest identification accuracy, and its model shown in Fig. 4.
The reason for poor performance of DNN is that the output of fully connected DNN is only decided by current state which means the timing information is not considered. Although CNN has strong ability to extract features, the features of different time are not considered either. The LSTM model that combines the information from the current state with the previous state to get the output is suited for identifying because it takes account of the time series. In our well tuned model the number of previous state which we consider is 131. The model also has high scalability, when a new TCP algorithm join the model, the model can be fine-tuned using most of existed parameters except for the output softmax layer, which means the model will converge quickly. The training property of the LSTM used in this paper will be introduced, including the input and output, training dataset, data process, loss function, and other implementation details.
Input and output. The input data is a set of features with time series which is different between wired and wireless networks. In wired networks, the input consists of PacketSize, TimeDif, OnewayDelay and Inflight. In wireless networks, PacketSize, TimeDif, OnewayDelay, PDCPDelay, and RL-CBufferSize are included. The output is the TCP algorithm variant of the input data.
Training dataset. The dataset is generated using mininet and ns-3 which will be introduced in Sec IV.A. We use 16800 sets of data to train wired identification model and 4320 sets of data to train wireless model.
Data process. The data directly obtained from the networks can not be aligned on the time-domain, which will affect the training and testing of LSTM model. We re-sample the data using linear interpolation and the sampling interval is set to 5 ms. The exponential weighted moving average method is then used to reduce the impact of interpolation operation and the discontinuity of input data.
Loss function. The loss function we use is cross entropy calculated as equation (7) shows. x is the input data of the network and c is the label.
Other implementation details. The total epochs used to train the LSTM model is 500. The batch size is 32. We use Adam optimizer with 10 −4 initial learning rate and reduce the learning rate by ten times when in 0.5 and 0.7 total epochs, respectively.

IV. EXPERIMENTS AND EVALUATIONS
In this section, the experiment settings of wired and wireless networks topology and evaluation results are given in detail. A. Networks Topology and Parameters Setup 1) Wired Network Topology: The wired network topology is constructed using mininet [16] as shown in Fig. 5 (a). The server connects to a router and Netem is used to set links delay from the server to the receiver. The rate limiting and buffer size at the router is configured by Token-Bucket Filter [17]. Tcpdump is used to passively collect data from the receiver.
The TCP algorithms used to generate the dataset for training including Cubic, NewReno, Hybla, Vegas and BBR, which are commonly used in current networks 4 . The maximum bandwidth is 5∼10 M bps, and the range of link RTT is from 40 to 100 ms. The size of bandwidth delay product (BDP) is 200∼1000 packets 5 . We repeat each simulation 10 times for 60 s and generated 16,800 sets of data for training, and 900 sets of data are generated for testing.
2) Wireless Network Topology: The ns-3 [18] is used to construct the wireless network topology as shown in Fig. 5 (b). Compared with wired network, the Westwood is added because of its good performance in wireless channel. The implementations of Cubic [19] and BBR [20] have been added to the original ns-3. The RLC AM mode is used in actual deployment, so is also considered in simulation. The maximum size of RLC buffer is unlimited in original ns-3, we modified the implementation of AM to support the drop-tail mechanism [21]. The tracing system of ns-3 is turned on to collect the TCP packets from receiver side. As for the delay of PDCP layer and RLC buffer size, which can be extracted from log files.
In terms of bandwidth, the number of resource block sets to 6, 15 and 25, respectively. The RTT is 20∼100 ms and the delay of the link between server and the closest router is adjust accordingly. The delay of air interface between BS and UE is considered as 3 ms. The maximum RLC buffer size sets to 100∼700 packets. The error model is MiErrorModel and the fading model is EVA60kmph. The Bulksend is used to generate data at the server side. Finally, 4320 sets of data are generated for training and 1440 sets of data for testing.

B. Performance Evaluations
The identification results of our proposed method are analyzed in this section. In terms of accuracy, we mainly use the   confusion matrix and the criterias of precision, recall and F1score. The identification accuracy in wired networks is listed in Table II and Table III, from which we can see that almost all TCP algorithms are accurately identified and the overall accuracy is 99.8%. The model shows a high accuracy on the identification of BBR, Vegas and Westwood in wireless networks from Table  IV and Table V. The identification accuracy of the other three algorithms is no less than 94.6%, which also demonstrates that our proposed method performs well in wireless networks. The impact of selected features on the accuracy of each TCP algorithm identification is analyzed, as shown in Fig. 6, which provides a reference for selecting appropriate input for future optimization. Fig. 6 (a) shows that all features have high accuracy on BBR. However the performance is different on the other algorithms, especially for throughput. The reason is the behavior of throughput is steady if no loss occurs when use loss-based algorithms. Fig. 6 (b) shows that the selected features have large fluctuations on accuracy although the overall accuracy is above 94.6%, which is caused by the errorprone wireless channel. The accuracy of throughput is higher in wireless networks than in wired networks. In contrast, the RTT has a poor performance than in wired networks.

V. CONCLUSION AND FUTURE WORK
In this paper, a machine learning based passive TCP identification method is proposed. The proposed method can realize high identification accuracy for loss based, delay based and even the newly proposed algorithms with high scalability. Our method can be used in both wired and wireless network that covers most of scenes in current network. More than 98.2% identification accuracy is achieved in both network scenarios. This work will be extended in the following aspects. 1) combine the identification method with actual system to test its performance, including optimizing configurations after identifying the variant of TCP algorithms; 2) update the identification model under multiple flows competitions.