Estimating the Number of HTTP/3 Responses in QUIC Using Deep Learning

2024-10-08

arXiv.org

AI Summary

Accurately estimating the number of responses per QUIC connection in HTTP/3 traffic remains challenging due to protocol complexity and variability across servers. To address this, we propose a regression framework that models QUIC connection traces as multi-channel temporal image sequences and employs an end-to-end CNN-LSTM architecture for response count prediction. We further design an adaptive regression loss function explicitly optimized for cross-server generalization, significantly improving model robustness on unseen servers and entirely novel connections. To our knowledge, this is the first work achieving high-accuracy response count estimation over full QUIC connections—97% accuracy on both known and unknown servers, and 92% on completely unseen connections—trained on over 7 million temporal image samples derived from 100,000 real-world QUIC connections. Our approach enables practical applications including HTTP/3-aware load balancing optimization and detection of HTTP/3 flood attacks.

Technology Category

• Machine Learning: Large Multimodal Models (LMMs)
• Computer Vision: 3D Computer Vision
• Natural Language Processing: Question Answering

Application Category

• Search and Retrieval-Augmented AI: Efficiency and scalability of Web search engines
• Graph Algorithms and Modeling for the Web: Foundation models and LLMs for Web-related graphs
• Responsible Web: Measurement, analysis, and circumvention of Web censorship

Abstract

QUIC, a new and increasingly used transport protocol, enhances TCP by offering improved security, performance, and stream multiplexing. These features, however, also impose challenges for network middle-boxes that need to monitor and analyze web traffic. This paper proposes a novel method to estimate the number of HTTP/3 responses in a given QUIC connection by an observer. This estimation reveals server behavior, client-server interactions, and data transmission efficiency, which is crucial for various applications such as designing a load balancing solution and detecting HTTP/3 flood attacks. The proposed scheme transforms QUIC connection traces into image sequences and uses machine learning (ML) models, guided by a tailored loss function, to predict response counts. Evaluations on more than seven million images-derived from 100,000 traces collected across 44,000 websites over four months-achieve up to 97% accuracy in both known and unknown server settings and 92% accuracy on previously unseen complete QUIC traces.

Problem

• Estimating HTTP/3 responses in QUIC for traffic analysis
• Using deep learning to predict server-client interaction patterns
• Detecting HTTP/3 flood attacks via QUIC connection monitoring

Innovation

• Estimates HTTP/3 responses in QUIC via deep learning
• Converts QUIC traces into image sequences for analysis
• Uses tailored loss function for high prediction accuracy