Actual Network Environment Research Articles

Software-Defined Virtual Private Network for SD-WAN

Software-Defined Wide Area Networks (SD-WANs) are an emerging Software-Defined Network (SDN) technology to reinvent Wide Area Networks (WANs) for ubiquitous network interconnections in cloud computing, edge computing, and the Internet of Everything. The state-of-the-art overlay-based SD-WANs are simply conjunctions of Virtual Private Network (VPN) and SDN architecture to leverage the controllability and programmability of SDN, which are only applicable for specific platforms and do not comply with the extensibility of SDN. This paper motivates us to refactor traditional VPNs with SDN architecture by proposing an overlay-based SD-WAN solution named Software-Defined Virtual Private Network (SD-VPN). An SDN-based auto-constructed VPN model and its evaluating metrics are put forward to automatically construct overlay WANs by node placement and service orchestration of SD-VPN. Therefore, a joint placement algorithm of VPN nodes and algorithms for overlay WAN service loading and offloading are proposed for SD-VPN controllers. Finally, a three-layer SD-VPN system is implemented and deployed in actual network environments. Simulation experiments and system tests are conducted to prove the high-efficiency controllability, real-time programmability, and auto-constructed deployability of the proposed SD-VPN. Performance trade-off between SD-VPN control channels and data channels is evaluated, and SD-VPN controllers are proven to be extensible for other VPN protocols and advanced services.

Multiantenna Clustering Collaboration for WPCNs Based on Nonlinear EH

This article considers a wireless-powered communication network (WPCN) composed of a multiantenna hybrid access point (HAP) based on nonlinear energy harvesting (EH). To improve some distant WDs’ throughput performance, one of them is allowed to be selected as a cluster head (CH) to help transfer information from other cluster members (CMs). Nevertheless, the proposed clustering collaboration’s performance is essentially restricted by the CH’s energy-intensive consumption (EC), which requires to transfer every WDs’ information, covering its own. In order to figure out the question, the HAP’s energy beamforming (EB) capability with multiple antennas is utilized that can concentrate greater transmission power into the CH to equilibrate its EC to assist other WDs. To be specific, each WD’s throughput performance is firstly derived under the proposed approach. A high-efficiency optimization algorithm for addressing cooperative optimization problem is put forward. In addition, the simulations are carried out in the actual network environment, and the results demonstrate that our proposed clustering collaboration with multiple antennas can validly enhance the WPCN’s throughput fairness based on nonlinear EH.

FL-IIDS: A novel federated learning-based incremental intrusion detection system

With the advantage of analyzing data of multiple work sites comprehensively while ensuring data privacy, federated learning-based intrusion detection systems (IDS) are emerging as a distributed intrusion detection paradigm. Most of these IDS are assumed to work on static data. However, in the actual network environment, the practice of setting data as static will lead to the phenomenon known as catastrophic forgetting, where old classes that have already appeared would be forgotten. In this paper, we propose a novel IDS framework called FL-IIDS to effectively address the catastrophic forgetting problem. Firstly, a new loss function is synthetically designed for local model training. With the new function, the class gradient balance loss function assigns different learning weights to data of the new and old classes so that the learning rate of the new classes would decrease and the memory of the overall old classes would be deepened. Moreover, the sample label smoothing loss function leverages the knowledge distillation method to enhance the local model memory for every specific class of old classes. Secondly, the relay client fusing sample reconstruction is employed to mitigate the spread of catastrophic forgetting globally without compromising data privacy. Extensive experimental results on the UNSW-NB15 dataset and the CICIDS2018 dataset show that our proposed framework improves the memory capability for old classes substantially without affecting the detection effectiveness of the IDS for new classes.

A hierarchical deep reinforcement learning model with expert prior knowledge for intelligent penetration testing

Penetration testing (PT) is an effective method to assess the security of a network, mainly carried out by experienced human experts, and is widely applied in practice. It is urgent to develop automated tools to alleviate the pressure of talent shortages. Reinforcement learning (RL) is a promising approach to achieving automated PT. However, the high complexity of PT scenarios and the low sample efficiency of RL hinder its applications in practice. Specifically, it faces two dilemmas: (1) vast state and action spaces and (2) highly ineffective exploration.We propose a hierarchical deep reinforcement learning (HDRL) model with expert prior knowledge to overcome the above dilemmas. The HDRL model mitigates the first dilemma. According to the characteristics of PT, we design the model as a hierarchical structure containing two layers of agents, and the agents as a deep neural network to decompose PT tasks and reduce their complexity. Expert prior knowledge mitigates the second dilemma. It is used as rules and knowledge graphs, carries out action constraints according to the rules, and obtains action advice according to knowledge graphs. The two jointly guide the decision-making of agents to reduce invalid exploration.To verify the effectiveness of the proposed method, we design scenarios based on actual network environments. The experimental results show that our model significantly improves the sample efficiency, greatly reduces the learning time of the agents, and shows good performance on large-scale network scenarios, which has the potential to promote the practical application of intelligent PT based on RL.

SMART: A Lightweight and Reliable Multi-Path Transmission Model against Website Fingerprinting Attacks

The rapid development of IoT technology has promoted the integration of physical space and cyberspace. At the same time, it has also increased the risk of privacy leakage of Internet users. A large number of research works have shown that attackers can infer Internet surfing privacy through traffic patterns without decryption. Most of the existing research work on anti-traffic analysis is based on a weakened experimental assumption, which is difficult to apply in the actual IoT network environment and seriously affects the user experience. This article proposes a novel lightweight and reliable defense—SMART, which can ensure the anonymity and security of network communication without sacrificing network transmission performance. SMART introduces a multi-path transmission model in the Tor network, and divides traffic at multiple Tor entry onion relays, preventing attackers from obtaining network traffic statistical characteristics. We theoretically proved that SMART can improve the uncertainty of website fingerprint analysis results. The experimental result shows that SMART is able to resist encrypted traffic analysis tools, reducing the accuracy of four state-of-the-art classifiers from 98% to less than 12%, without inducing any additional artificial delay or dummy traffic. In order to avoid the performance degradation caused by data reassembly, SMART proposes a redundant slice mechanism to ensure reliability. Even in the case of human interference, the communication success rate is still as high as 97%.

Event-triggered control for uncertain delayed neural networks with actuator saturation against deception attack

In this paper, event-triggered control for uncertain delayed neural networks (DNNs) with actuator saturation against deception attack is discussed. We propose a novel framework into which an event-triggered mechanism (ETM), actuator saturation, system uncertainty, and deception attack are combined. In the framework, the discrete ETM is employed to determine whether the sampled signal should be transmitted to controller so as to save network bandwidth, a random occurrence deception attack model satisfying Bernoulli distribution is introduced to construct the system robust, and actuator saturation is considered due to the actual complex network environment. Based on the framework, we discussed the stochastic stability of a novel delayed neural network model in a closed-loop system. By resorting to the appropriate Lyapunov–Krasovskii functional (LKF), we derive some new sufficient conditions for the stochastically stable of the system and obtain the gain of the system controller using efficient linear matrix inequality (LMI) method. Finally, a numerical example, in the end, demonstrates the effectiveness of the proposed method.

AN INTELLIGENT CYBER SECURITY DETECTION AND RESPONSE PLATFORM

To further solve the cyber security challenges faced by the digital transformation of the Philippines university industry. This paper designed and proposed a cyber security detection and response platform (CSDRP), which can deal with traditional network security problems, improve the network security management capabilities of universities, and provide a method for real-time monitoring of network status and network security response in universities. With the outbreak of the epidemic, many universities in the Philippines have launched online courses and online services. These online courses and online services continue to proliferate, and with them come a host of cyber security risks and hidden dangers. CSDRP extracts logs through the traffic probes, and the platform performs correlation analysis on many security logs, combines relevant models and machine learning algorithms and generates response logs, which can be responded to and linked with policies, and finally presents relevant threats visually. This study deploys the platform in the actual network environment. The experimental results show that it provides accurate threat warnings, as well as good real-time detection and visualization of cyber threats, and can collect logs from different data sources in real time. linkage of safety equipment.

High-Frequency Trajectory Map Matching Algorithm Based on Road Network Topology

Accurately mapping the raw global position system (GPS) trajectories to the road network is the basis for studying the application of trajectory data. This study proposes a novel off-line map matching algorithm based on road network topology, to address the problems of low execution efficiency and poor matching accuracy of selective look-ahead map matching (SLAMM) algorithm. First, the noise points of the trajectory data are removed by data preprocessing. Second, the algorithm searches for critical samples in the trajectory data and segments the data accordingly. Then, the adjacent road segments around the transition node corresponding to the critical sample are selected as candidate arcs. Finally, the segmented trajectory data are matched to the road network by constructing an error ellipse. The algorithm fully considers the topology of the road network and the characteristics of high-frequency trajectory data. The experimental results, using Beijing trajectory data to perform matching on an actual road network environment, show that the proposed algorithm is more efficient and robust than other map matching algorithms for high-frequency trajectories.

Experimental Demonstration of an Efficient Mach–Zehnder Modulator Bias Control for Quantum Key Distribution Systems

A Mach–Zehnder modulator (MZM) is necessary for implementing a decoy-state protocol in a practical quantum key distribution (QKD) system. However, an MZM bias control method optimized for QKD systems has been missing to date. In this study, we propose an MZM bias control method using N (≥2) diagnostic pulses. The proposed method can be efficiently applied to a QKD system without any additional hardware such as light sources or detectors. Furthermore, it does not reduce the key rate significantly because it uses time slots allocated to existing decoy pulses. We conducted an experimental demonstration of the proposed method in a field-deployed 1 × 3 QKD network and a laboratory test. It is shown that our method can maintain the MZM extinction ratio stably over 20 dB (bit error rate ≤1%), even in an actual network environment for a significant period. Consequently, we achieved successful QKD performances.

Network security situational level prediction based on a double-feedback Elman model

Network Security Situational Awareness (NSSA) is an important element in network security research. Predicting network security situational level can help grasp the network security situation. This study mainly focuses on the double-feedback Elman model. Firstly, NSSA was briefly introduced. Then, relevant indicators were selected to establish a security situational indicator system. A back-propagation neural network (BPNN) model was designed to evaluate the situational value. A dual-feedback Elman model was used to predict the future situational level. The actual network environment was built to conduct experiments. The results showed that the evaluation results of only three samples obtained by the BPNN model did not match the actual situation, with an accuracy of 90%, and the prediction results of only four samples obtained by the dual-feedback Elman model did not match the actual situation, with an accuracy of 96.67%. The experimental results verify the reliability of the network security situational level prediction method designed in this study. The NSSA method can be promoted and applied in practice.

MAE-CAD: An IP-Based Core Network Asset Discovery Technology Based on Multiple Autoencoders

With the continuous development of the network, the number of network assets continues to increase. Despite the convenience diversified network assets bring, it also poses new challenges to IP-based network asset management. Traditional asset discovery technologies mainly analyze network traffic, and detect relevant information (operating system, running software, etc.) of IP-based assets through methods such as active discovery, passive discovery, and discovery methods based on cyberspace search engines. These methods assign the same weight to all network IP-based network assets, and it is difficult to effectively analyze diversified network assets. In this paper, we propose the concept of IP-based core network assets, and collect the data of the relevant network assets based on this concept. Then, we construct a dataset and establish feature engineering for data preprocessing. As there is currently no relevant IP-based core network asset detection method, we propose an IP-based core network asset discovery technology based on pretraining of multiple autoencoders, MAE-CAD. The results show that our method can achieve 95.74% in Acc and 95.04% in F1 in the experimental environment (Acc = 98.11% and F1 = 97.16% in the actual network environment because of duplicate samples). In addition, MAE-CAD has excellent robustness. In an environment where the proportion of data is extremely unbalanced, when the IP-based core network asset data in the training set only accounts for 1/200 (0.5%), MAE-CAD can still obtain 92.91% in Acc and 91.57% in F1.

Improving SSH detection model using IPA time and WGAN-GP

In the machine learning-based detection model, the detection accuracy tends to be proportional to the quantity and quality of the training dataset. The machine learning-based SSH detection model’s performance is affected by the size of the training dataset and the ratio of target classes. However, in an actual network environment within a short period, it is inconvenient to collect a sufficient and diverse training dataset. Even though many training data samples are collected, it takes a lot of effort and time to prepare the training dataset through data classification. To overcome these limitations, we generate sophisticated samples using the WGAN-GP algorithm and present how to select samples by comparing generator loss. The synthetic training dataset with generated samples improves the performance of the SSH detection model. Furthermore, we add the new features to include the distinction of inter-packet arrival time. The enhanced SSH detection model decreases false positives and provides a 0.999 F1-score by applying the synthetic dataset and the packet inter-arrival time features.

Image Link Through Adaptive Encoding Data Base and Optimized GPU Algorithm for Real-time Image Processing of Artificial Intelligence

This paper presents the latest Ethernet standardization of in-vehicle network and the future trends of automotive ethernet technology. The proposed system provides a design and optimization algorithm of in-vehicle networking technologies related Ethernet Audio Video Bridge (AVB) technology. We present a design of in-vehicle network system as well as the optimization of AVB for automotive. A proposal of Reduced Latency of Machin to Machine (RLMM) plays a significant role in reducing the latency between devices. The approach of RLMM on realistic test cases indicated that there was a latency reduction about 30.41% It is expected that the optimized settings for the actual automotive network environment can greatly shorten the time period in the development and design process. The results achieved from the experiments on the latency present in each function are trustworthy since average values are obtained via repeated tests for several months. It would considerably benefit the industry because analyzing the delay between each function in a short period of time is tremendously significant. In addition, through the proposed real-time camera and video streaming via optimized settings of AVB system, it is expected that AI (Artificial Intelligence) algorithms in autonomous driving will be of great help in understanding and analyzing images in real time.

Event-triggered fault detection for nonlinear semi-Markov jump systems based on double asynchronous filtering approach

The event-triggered fault detection problem for nonlinear semi-Markov jump systems constructed by Takagi–Sugeno fuzzy approach is studied in this paper. Owing to that the premise variables and the modes are usually mismatched for both the filter and the plant in actual network environment, i.e., the double asynchronous phenomenon, a novel double asynchronous fault detection filter is designed to take the place of the traditional filter and tackle the fault detection problem for fuzzy semi-Markov jump systems. Particularly, the event-triggered scheme is considered to reduce the waste of communication resources, which gives rise to the premise variables asynchronous phenomenon for the plant and the filter. The modes information of the fuzzy semi-Markov jump systems is not always instantaneously accessible, which leads to the mode asynchronous phenomenon for the plant and the filter. This mode asynchronous phenomenon is described by a hidden semi-Markov model. Based on Lyapunov stability theory, the sufficient conditions are developed to ensure that the system not only is stochastically stable and meets an H∞ performance, but also can make sure that the filter gains could be captured. Finally, an illustrative tunnel diode circuit example is provided to show the effectiveness of proposed approach.

Length matters: Scalable fast encrypted internet traffic service classification based on multiple protocol data unit length sequence with composite deep learning

As an essential function of encrypted Internet traffic analysis, encrypted traffic service classification can support both coarse-grained network service traffic management and security supervision. However, the traditional plaintext-based Deep Packet Inspection (DPI) method cannot be applied to such a classification. Moreover, machine learning-based existing methods encounter two problems during feature selection: complex feature overcost processing and Transport Layer Security (TLS) version discrepancy. In this paper, we consider differences between encryption network protocol stacks and propose a composite deep learning-based method in multiprotocol environments using a sliding multiple Protocol Data Unit (multiPDU) length sequence as features by fully utilizing the Markov property in a multiPDU length sequence and maintaining suitability with a TLS-1.3 environment. Control experiments show that both Length-Sensitive (LS) composite deep learning model using a capsule neural network and LS-long short time memory achieve satisfactory effectiveness in F1-score and performance. Owing to faster feature extraction, our method is suitable for actual network environments and superior to state-of-the-art methods.

Graph neural network‐based virtual network function deployment optimization

SummarySoftware‐defined networking (SDN) and network function virtualization (NFV) help reduce the operating expenditure (OPEX) and capital expenditure (CAPEX) as well as increase the network flexibility and agility. However, since the network is more dynamic and heterogeneous than before, operators have problems to cope with the increased complexity of managing virtual networks and machines. This complexity is paired with strict time requirements for making management decisions; traditional mechanisms that rely on, for example, integer linear programming (ILP) models are no longer feasible. Machine learning has emerged as one of the possible solution to address network management problems to get near‐optimal solutions in a short time. However, applying machine learning to network management is also not simple and has many challenges. Especially, understanding the network environment is an important problem for designing a machine learning model. In this paper, we proposed to use graph neural network (GNN) for virtual network function (VNF) management. The proposed model solves the complex VNF management problem in a short time and gets near‐optimal solutions. We developed a model by taking into account various network environment conditions so that it can be applied in the actual network environment. Also, through in‐depth experiments, we suggested the direction of the machine learning‐based network management method.

Information security assessment of wireless sensor networks based on bayesian attack graphs

Network security issues have become increasingly prominent, and information security risk assessment is an important part of network security protection. Security risk assessment based on methods such as attack trees, attack graphs, neural networks, and fuzzy logic has problems such as difficulty in data collection during the assessment process, excessive reliance on expert experience, failure to consider the actual network environment, or ineffective joint application. The qualitative and quantitative information security fuzzy comprehensive evaluation method uses the theory of fuzzy mathematics to better solve the above problems, so that the evaluation method is scientific, comprehensive and operable. To improve the accuracy of information security risk assessment in wireless sensor networks, we propose a fuzzy comprehensive evaluation method based on Bayesian attack graphs. This considers the impact of environmental factors of the assessed system on security risk and the spread of the effects on the Bayesian network. Therefore, this model can reflect possible situations due to network attacks in the wireless sensor network system. The results show that this quantitative evaluation method is applicable to assessing risk in wireless sensor network systems, and the results are more objective and accurate.

Efficient Authentication for Internet of Things Devices in Information Management Systems

With the rapid development of the Internet of Things (IoT) technology, it has been widely used in various fields. IoT device as an information collection unit can be built into an information management system with an information processing and storage unit composed of multiple servers. However, a large amount of sensitive data contained in IoT devices is transmitted in the system under the actual wireless network environment will cause a series of security issues and will become inefficient in the scenario where a large number of devices are concurrently accessed. If each device is individually authenticated, the authentication overhead is huge, and the network burden is excessive. Aiming at these problems, we propose a protocol that is efficient authentication for Internet of Things devices in information management systems. In the proposed scheme, aggregated certificateless signcryption is used to complete mutual authentication and encrypted transmission of data, and a cloud server is introduced to ensure service continuity and stability. This scheme is suitable for scenarios where large‐scale IoT terminal devices are simultaneously connected to the information management system. It not only reduces the authentication overhead but also ensures the user privacy and data integrity. Through the experimental results and security analysis, it is indicated that the proposed scheme is suitable for information management systems.

Utilization-Weighted Algorithm for LoRaWAN Capacity Improvement for Local Smart Dairy Farms in Ratchaburi Province of Thailand

This paper presents Long Range Wide Area Network (LoRaWAN) scalability improvement using the Utilization Weighted (UW) spreading factor (SF) assignment algorithm that was logically designed to equalize SFs usage based on the M/D/1 queuing model. The test area containing dairy farms housing approximately 1,200 cows in Photharam district, Ratchaburi province of Thailand, was selected to simulate the proposed algorithm and evaluate its performance. The suburban Hata path loss model was chosen as a reference to incorporate the actual network environment into the simulation. It is then carefully optimized by factoring in the empirical path loss data collected in a 12-kilometer radius of the gateway location and then applying the parameters adjustment (PA) tuning method that proved to provide lower root mean square errors (RSMEs) than the RMSE tuning method. Two key performance indicators, including packet received rate (PRR) and energy consumption, were compared between the UW algorithm and the Min-airtime or traditional method. The simulation was focused on the 2-kilometer radius wherein most dairy farms reside. It was found that the UW algorithm provided higher PRR without jeopardizing the energy consumption comparing to the traditional LoRaWAN, due to the more equalization of SFs employment. The maximum improvement of PRR was around 43.90%, while the energy consumption level was maintained at approximately 113 J per day per node.

A novel method for network traffic classification based on robust support vector machine

ABSTRACTThe increasing demand for high‐speed transmission and traffic classification has been widely applied for network resource management, quality of service, dynamic access control, and others. Some normal machine learning algorithms for network traffic classification are becoming obsolete, as the increasing deployment of encryption in protocols and dynamic ports, as well as some new technology are available, such as HTML5 protocols and HTTP adaptive streaming in video traffic. This article presents a novel classification algorithm for video traffic. We produce a new video traffic dataset and propose an original parameter adaptive algorithm for robust support vector machine with a fuzzy membership function. The results show that the proposed model is an effective alternative to be applied in actual network environment.