REGENT: A Framework for Realistic Generation of Network Traffic

Network security research is highly dependent on traffic datasets. Fair and comprehensive analysis as well as performance evaluations of different solutions for problems such as detections of intrusions, anomalies and attacks, requires traffic traces that closely resemble data from operational network. Currently available datasets are either getting obsolete with time, or lacking important information such as ground truth of data and payloads in the traffic. While making little compromises, an alternate solution to this problem is to generate traffic data. However, care has to be taken that such a solution is capable to cope up with the changing characteristics of traffic; more generally, it should be flexible enough to generate traffic with specific characteristics as required by a user. In this work, we develop a framework for realistic generation of network traffic, called REGENT, which takes traffic models as input. In REGENT, different protocols generate real traffic independently, and based on the specific models (such as distribution for inter-arrival time between connections, distribution for connection size, etc.) provided by a user. We conduct experiments wherein REGENT takes protocol models as input, and generates real traffic as output. Using analysis, we show that the characteristics of the generated traffic (protocols) are close to the models specified as input.