Abstract—Network security research is highly dependent on traffic datasets. Fair and comprehensive analysis as well as performance evaluations of different solutions for problems such as detections of intrusions, anomalies and attacks, requires traffic traces that closely resemble data from operational network. Currently available datasets are either getting obsolete with time, or lacking important information such as ground truth of data and payloads in the traffic. While making little compromises, an alternate solution to this problem is to generate traffic data. However, care has to be taken that such a solution is capable to cope up with the changing characteristics of traffic; more generally, it should be flexible enough to generate traffic with specific characteristics as required by a user. In this work, we develop a framework for realistic generation of network traffic, called REGENT, which takes traffic models as input. In REGENT, different protocols generate real traffic independently, and based on the specific models (such as distribution for inter-arrival time between connections, distribution for connection size, etc.) provided by a user. We conduct experiments wherein REGENT takes protocol models as input, and generates real traffic as output. Using analysis, we show that the characteristics of the generated traffic (protocols) are close to the models specified as input.

Index Terms—Network traffic, protocols, security.

The authors are with the Department of Cyber Security & Intelligence, Institute for Infocomm Research (I2R), A*STAR, Singapore 138632.

Cite:Dinil Mon Divakaran, Kar Wai Fok, Li Ling Ko, Yung Siang Liau, Vrizlynn L. L. Thing, "REGENT: A Framework for Realistic Generation of Network Traffic," International Journal of Computer and Communication Engineering vol. 5, no. 6, pp. 430-440, 2016.