Subject: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

From: Sheng Jiang <[email-masked]>
Date: Thu, 8 Oct 2015 03:28:47 +0000

Hi, all,

We have been assigned one session of 2.5 hour for the proposed
NMLRG (Network Machine Learning Research Group) meeting for
IETF-94 (Yokohama) and are starting to collect agenda items for
this session.

The proposed NML RG is still in the very initial stage. So, we have very
open scope. We do not restrict the topics. The only threshold is it should
be relevant to network or network devices, using Machine Learning.

Please send us ([email-masked], [email-masked])
requests for sessions and include:

Name of time slot:
Name of topic(s):
Time requested:
Presenter name(s):
Brief description of the topic:

More details about the Yokohama IETF can be found at
http://www.ietf.org/meeting/94/index.html.

Also, presenters please invoke discussions in the NMLRG list. We have
limited time in the face-to-face meeting. Mail list is a good place
to propagate and discuss the topics.

Best regards,

Brian & Sheng

---

From: Jérôme François <[email-masked]>
Date: Mon, 12 Oct 2015 22:20:57 +0200

Hi all,

I recently introduced a fingerprinting use case on the ML that I could
present but I was wondering if it would not better to present something
about heterogenous data aggregation.

We actually build a method to aggregate multi-dimensional data within a
single tree structure without assuming any order between dimensions and
with variable granularity. It is a kind of mix between k-dimensional
tree and density-based clustering. For example, we applied it to DNS
answers aggregating both domain names and IP address in a single data
structure to be analyzed rather than an individual record inspection to
first identify time period where some divergent behavior appears.

I know that it is not ML itself but we used it is fully in the scope of
data representation and pre-processing of ML.

So, would that topic be interesting for NMLRG participants?

Best regards,
jerome

Le 08/10/2015 05:28, Sheng Jiang a écrit :
> _______________________________________________
> nmlrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/nmlrg

---

From: "Liubing (Leo)" <[email-masked]>
Date: Tue, 13 Oct 2015 02:38:15 +0000

Hi Jerome,

I feel the topic interesting and should be valuable for discussion. 
Please find some specific comments inline.

> -----Original Message-----
> From: nmlrg [mailto:[email-masked]] On Behalf Of Jér?me Fran?ois
> Sent: Tuesday, October 13, 2015 4:21 AM
> To: [email-masked]
> Subject: Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama
> 
> Hi all,
> 
> I recently introduced a fingerprinting use case on the ML that I could present
> but I was wondering if it would not better to present something about
> heterogenous data aggregation.
> 
> with variable granularity. 
[Bing] I guess most of the raw data is more or less mix-dimensional. Orthogonal data should be a fine-tuned result most of the time.
So, I guess your aggregation method should be common in some degree, that not only applied to your fingerprinting use case?

> It is a kind of mix between k-dimensional tree and density-based clustering. 
> For example, we applied it to DNS answers
> aggregating both domain names and IP address in a single data structure to
> be analyzed rather than an individual record inspection to first identify time
> period where some divergent behavior appears.
[Bing] This sounds interesting. An naive question: can this algorithm be applied to network traffic N-tuples analysis, and is there any limitation to the number of "N"?

> I know that it is not ML itself but we used it is fully in the scope of data
> representation and pre-processing of ML.
[Bing] Pre-processing might not be the key factor in ML theory/methodology perspective; but it is curtail in ML engineering perspective. So I'd like to hear it in your presentation.

Best regards,
Bing

> > We have been assigned one session of 2.5 hour for the proposed NMLRG
> > (Network Machine Learning Research Group) meeting for
> > IETF-94 (Yokohama) and are starting to collect agenda items for this
> > session.
> >
> > The proposed NML RG is still in the very initial stage. So, we have
> > very open scope. We do not restrict the topics. The only threshold is
> > it should be relevant to network or network devices, using Machine
> Learning.
> >
> > limited time in the face-to-face meeting. Mail list is a good place to
> > propagate and discuss the topics.
> >
> > Best regards,
> >
> > Brian & Sheng

---

From: <[email-masked]>
Date: Tue, 13 Oct 2015 07:53:51 +0000

Hi Jerome, All,

Yes indeed this topic is relevant and very interesting. 

Actually we (Daniel and Nizar in cc and I) considered and used clustering approaches for pre-processing DNS traffic traces before applying ML techniques (supervised learning, namely a variant of decision trees) for addressing network security issues. 

We would be very interested in listening to your presentation. 

BTW Sheng, Brian, do you already know the date and time which will be allocated for this NMLRG session at the forthcoming IETF-94?
Also, will it be possible to participate to the session via conf call? 
Thanks 

Best regards,
Stephane 
 
Stephane SENECAL 
Research Engineer/Scientist 
Orange Labs 
+33 1 4529 8589 
[email-masked]

-----Message d'origine-----
De : nmlrg [mailto:[email-masked]] De la part de Jérôme François
Envoyé : lundi 12 octobre 2015 22:21
À : [email-masked]
Objet : Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

Hi all,

I recently introduced a fingerprinting use case on the ML that I could present but I was wondering if it would not better to present something about heterogenous data aggregation.

We actually build a method to aggregate multi-dimensional data within a single tree structure without assuming any order between dimensions and with variable granularity. It is a kind of mix between k-dimensional tree and density-based clustering. For example, we applied it to DNS answers aggregating both domain names and IP address in a single data structure to be analyzed rather than an individual record inspection to first identify time period where some divergent behavior appears.

I know that it is not ML itself but we used it is fully in the scope of data representation and pre-processing of ML.

Best regards,
jerome

Le 08/10/2015 05:28, Sheng Jiang a écrit :
> it should be relevant to network or network devices, using Machine Learning.
>

_________________________________________________________________________________________________________________________

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorisation.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, Orange is not liable for messages that have been modified, changed or falsified.
Thank you.

---

From: Jérôme François <[email-masked]>
Date: Tue, 13 Oct 2015 18:02:53 +0200

Hi Bing,

> So, I guess your aggregation method should be common in some degree, that not only applied to your fingerprinting use case?
Yes, it is a generic method. We actually did not apply for
fingerprinting (yet). Actually, once you are able to define a hierarchy
over a dimension, you can use it. We apply on domain names, IP
addresses, port taxonomy and geographical positions.
> [Bing] This sounds interesting. An naive question: can this algorithm be applied to network traffic N-tuples analysis, and is there any limitation to the number of "N"?
The number of N is not limited. It is basically what we do, we just
represent network traces or trafic recors as N-tuples and then aggregate
them.
For performance reason, the maximal size of tree is set and then
aggregation is invoked when the tree starts to be too large.
More details can be found here:
https://www.usenix.org/system/files/conference/lisa12/lisa12-final-26.pdf
We have been inspired by Aguri
(http://www.wide.ad.jp/news/event/stanford2002/documents/Measurement/aguri.pdf)

> [Bing] Pre-processing might not be the key factor in ML theory/methodology perspective; but it is curtail in ML engineering perspective. So I'd like to hear it in your presentation.
Great!

Best,
jerome

---

From: Jérôme François <[email-masked]>
Date: Tue, 13 Oct 2015 18:06:04 +0200

Hi Stephane,

What is the purpose of your DNS traffic analysis.
I did also some work (not only aggregation) using semantic analysis of
domain name, and even URL, for fighting phishing.
Using some Natural Language Processing (NLP) techniques, we basically
tried to define a phisher's language such that people will feel secure
with the url they are accessing on.

Best regards,
jerome

---

From: Brian E Carpenter <[email-masked]>
Date: Wed, 14 Oct 2015 10:33:49 +1300

Stephane,

> BTW Sheng, Brian, do you already know the date and time which will be allocated for this NMLRG session at the forthcoming IETF-94?

Meeting agenda (in Yokohama time) is at https://tools.ietf.org/agenda/94/,
search for nmlrg.

> Also, will it be possible to participate to the session via conf call? 

There will be live streaming (details nearer the time).

Sheng, will there be Meetecho support as well?

   Brian

---

From: Sheng Jiang <[email-masked]>
Date: Wed, 14 Oct 2015 01:01:38 +0000

>> BTW Sheng, Brian, do you already know the date and time which will be
>allocated for this NMLRG session at the forthcoming IETF-94?
>

The NMLRG session is 150 minutes on Tuesday:

Tuesday, Morning Session I, 0900-1130, Room 304

>Sheng, will there be Meetecho support as well?

For now, I am not fully sure. The "Remote Participation" on the IETF main web page has not become active, yet. But it is certainly possible to arrange this with IETF secretary. We did have remote presentions in ANIMA meeting. The quality is acceptable.

Best regards,

Sheng

---

From: "Eggert, Lars" <[email-masked]>
Date: Wed, 14 Oct 2015 07:16:54 +0000

> Sheng, will there be Meetecho support as well?

All sessions will have outbound Meetecho; if you have remote presenters, you need to let them know ahead of time.

Lars

---

From: <[email-masked]>
Date: Wed, 14 Oct 2015 10:08:59 +0000

Hi Brian, Sheng & All,

Thank you very much for the information below. 
Unfortunately I will not be able to attend this meeting F2F but I am looking forward to participate remotely if this will be possible. 

Thanks, best regards,
Stephane 

-----Message d'origine-----
De : Sheng Jiang [mailto:[email-masked]] 
Envoyé : mercredi 14 octobre 2015 03:02
À : Brian E Carpenter; SENECAL Stephane IMT/OLN; Jérôme François; [email-masked]
Cc : [email-masked]; KHEIR Nizar IMT/OLPS
Objet : RE: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

Best regards,

Sheng

---

From: Jérôme François <[email-masked]>
Date: Wed, 14 Oct 2015 14:50:36 +0200

Hi Daniel

Le 14/10/2015 02:19, Daniel Migault a écrit :
> Hi, 
>
> The purpose of the DNS traffic was to detect CC. The traffic was only composed of NX domain. We clustered FQDNs based on shared IP addresses to identify Bots. Then infected hosts with corresponding bots were detected by looking at the time series of NX response.
Looks very interesting as well. I guess so your target is randomly
generated domain. Did you also look at the how such domains look like,
i.e. how they have been generated ?

BR,
jerome

> BR, 
> Daniel 
> From: Jérôme François [mailto:[email-masked]] 
> Sent: Tuesday, October 13, 2015 12:06 PM
> To: [email-masked]; [email-masked]
> Cc: Daniel Migault; KHEIR Nizar IMT/OLPS
> I did also some work (not only aggregation) using semantic analysis of domain name, and even URL, for fighting phishing.
> Using some Natural Language Processing (NLP) techniques, we basically tried to define a phisher's language such that people will feel secure with the url they are accessing on.
>
> Best regards,
> jerome
>
>
>> De : nmlrg [mailto:[email-masked]] De la part de Jérôme 
>> François Envoyé : lundi 12 octobre 2015 22:21 À : [email-masked] Objet 
>> : Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama
>>
>> Hi all,
>>
>> ______________________________________________________________________
>> ___________________________________________________
>>
>> Ce message et ses pieces jointes peuvent contenir des informations 
>> confidentielles ou privilegiees et ne doivent donc pas etre diffuses, 
>> exploites ou copies sans autorisation. Si vous avez recu ce message 
>> par erreur, veuillez le signaler a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration, Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci.
>>
>> This message and its attachments may contain confidential or 
>> privileged information that may be protected by law; they should not be distributed, used or copied without authorisation.

---

From: <[email-masked]>
Date: Wed, 14 Oct 2015 14:54:56 +0000

Hi Jerome,

Thanks. Yes you are perfectly right, we aim at detecting DGA Bots. 
However, as you mentioned, we did not address the problems and mechanisms of the domain names generation itself.  
We have actually written a paper about these works, it is now under review, we will release it after. 

Best regards,
Stephane 

-----Message d'origine-----
De : Jérôme François [mailto:[email-masked]] 
Envoyé : mercredi 14 octobre 2015 14:51
À : Daniel Migault; SENECAL Stephane IMT/OLN; [email-masked]
Cc : KHEIR Nizar IMT/OLPS
Objet : Re: [Nmlrg] Call for Agenda NMLRG @IETF94, Yokohama

Hi Daniel

> The purpose of the DNS traffic was to detect CC. The traffic was only composed of NX domain. We clustered FQDNs based on shared IP addresses to identify Bots. Then infected hosts with corresponding…
Looks very interesting as well. I guess so your target is randomly generated domain. Did you also look at the how such domains look like, i.e. how they have been generated ?

BR,
jerome

>>> very open scope. We do not restrict the topics. The only threshold 
>>> is it should be relevant to network or network devices, using Machine Learning.
>>>
>>> Also, presenters please invoke discussions in the NMLRG list. We 
>>> have limited time in the face-to-face meeting. Mail list is a good 
>>> place to propagate and discuss the topics.
>>>
>>> Best regards,
>>>
>>> Brian & Sheng
>> _____________________________________________________________________
>> _ ___________________________________________________
>>

Ce message et ses pieces jointes peuvent contenir des informations confidentielles ou privilegiees et ne doivent donc
pas etre diffuses, exploites ou copies sans autorisation. Si vous avez recu ce message par erreur, veuillez le signaler
a l'expediteur et le detruire ainsi que les pieces jointes. Les messages electroniques etant susceptibles d'alteration,
France Telecom - Orange decline toute responsabilite si ce message a ete altere, deforme ou falsifie. Merci

This message and its attachments may contain confidential or privileged information that may be protected by law;
they should not be distributed, used or copied without authorization.
If you have received this email in error, please notify the sender and delete this message and its attachments.
As emails may be altered, France Telecom - Orange shall not be liable if this message was modified, changed or falsified.
Thank you.