Address Space Research Articles

Comparison of Data Fluctuations that Lead to Cyber Security Attacks: A Difference between Surface, Deep and Dark Net

The term "darknet" refers to the address space on the internet that is not being used, and users do not anticipate that this area will interact with their machines. Darknet is a source of cyber intelligence. In order to develop network security, it is necessary to conduct studies of the many dangers that comprise the network. In this research, we offer brand new machine learning classifiers that go by the name stacking ensemble learning. Their purpose is to evaluate and categorize darknet traffic. This novel approach employs predictions created by three different base learning techniques in order to deal with the issues relating to darknet attacks. The software was validated using a dataset that had more than 141,000 records and was derived from the CIC-Darknet 2020 database. The findings of the experiment indicated that the classifiers used in the investigation were able to easily differentiate between benign and malignant traffic. The classifiers have the ability to efficiently recognize known as well as unknown threats with a high degree of precision and accuracy that is greater than 99% in the training and 97% in the testing phases, with increments ranging from 4 to 64% based on the algorithms that are currently in use. As a consequence of this, the suggested system will become more reliable and accurate as more data is collected. Additionally, in comparison to other AI algorithms already available, the suggested system has the lowest standard deviation.

Catalyst control over pentavalent stereocentres

A monumental diversity of catalytic methods imparts the ability to select one of two configurations of tetravalent stereocentres. Conversely, catalyst control over pentavalent stereocentres, where a fifth moiety bound to the central atom encodes an expanded stereochemical space, remained a challenge to be accomplished. Herein, we report the feasibility of the catalytic tractability of pentavalent stereocentres. A bifunctional iminophosphorane thiourea catalyst enables enantio- and diastereocontrol over pentavalent phosphoranes to differentiate configurationally stable enantiomers and ensembles of diastereomers which emerge together from a single stereocentre. The desired dioxophosphorane stereoisomers are obtained with excellent yield and selectivity (up to 99% yield, 96:4 e.r. and 99:1 d.r.), while stereodivergent catalysis reroutes the reaction for selective access to each of the viable stereoisomeric states of pentavalent phosphoranes. Considering the diversity of high-valent main group species, it is expected that catalyst control over pentavalent stereocentres significantly increases the synthetically addressable stereochemical space.

Enlightening the Darknets: Augmenting Darknet Visibility With Active Probes

Darknets collect unsolicited traffic reaching unused address spaces. They provide insights into malicious activities, such as the rise of botnets and DDoS attacks. However, darknets provide a shallow view, as traffic is never responded. Here we quantify how their visibility increases by responding to traffic with interactive responders with increasing levels of interaction. We consider four deployments: Darknets, simple, vertical bound to specific ports, and, a honeypot that responds to all protocols on any port. We contrast these alternatives by analyzing the traffic attracted by each deployment and characterizing how traffic changes throughout the responder lifecycle on the darknet. We show that the deployment of responders increases the value of darknet data by revealing patterns that would otherwise be unobservable. We measure Side-Scan phenomena where once a host starts responding, it attracts traffic to other ports and neighboring addresses. uncovers attacks that darknets and would not observe, e.g. large-scale activity on non-standard ports. And we observe how quickly senders can identify and attack new responders. The “enlightened” part of a darknet brings several benefits and offers opportunities to increase the visibility of sender patterns. This information gain is worth taking advantage of, and we, therefore, recommend that organizations consider this option.

Packed to the Brim: Investigating the Impact of Highly Responsive Prefixes on Internet-wide Measurement Campaigns

Internet-wide scans are an important tool to evaluate the deployment of services. To enable large-scale application layer scans, a fast, stateless port scan (e.g., using ZMap) is often performed ahead of time to collect responsive targets. It is a common expectation that port scans on the entire IPv4 address space provide a relatively unbiased view as they cover the complete address space. Previous work, however, has found prefixes where all addresses share particular properties. In IPv6, aliased prefixes and fully responsive prefixes, i.e., prefixes where all addresses are responsive, are a well-known phenomenon. However, there is no such in-depth analysis for prefixes with these responsiveness patterns in IPv4. This paper delves into the underlying factors of this phenomenon in the context of IPv4 and evaluates port scans on a total of 161 ports (142 TCP & 19 UDP ports) from three different vantage points. To account for packet loss and other scanning artifacts, we propose the notion of a new category of prefixes, which we call highly responsive prefixes (HRPs). Our findings show that the share of HRPs can make up 70% of responsive addresses on selected ports. Regarding specific ports, we observe that CDNs contribute to the largest fraction of HRPs on TCP/80 and TCP/443, while TCP proxies emerge as the primary cause of HRPs on other ports. Our analysis also reveals that application layer handshakes to targets outside HRPs are, depending on the chosen service, up to three times more likely to be successful compared to handshakes with targets located in HRPs. To improve future scanning campaigns conducted by the research community, we make our study's data publicly available and provide a tool for detecting HRPs. Furthermore, we propose an approach for a more efficient, ethical, and sustainable application layer target selection. We demonstrate that our approach has the potential to reduce the number of TLS handshakes by up to 75% during an Internet-wide scan while successfully obtaining 99 % of all unique certificates.

Machine and deep learning techniques for detecting internet protocol version six attacks: a review

<span lang="EN-US">The rapid development of information and communication technologies has increased the demand for internet-facing devices that require publicly accessible internet protocol (IP) addresses, resulting in the depletion of internet protocol version 4 (IPv4) address space. As a result, internet protocol version 6 (IPv6) was designed to address this issue. However, IPv6 is still not widely used because of security concerns. An intrusion detection system (IDS) is one example of a security mechanism used to secure networks. Lately, the use of machine learning (ML) or deep learning (DL) detection models in IDSs is gaining popularity due to their ability to detect threats on IPv6 networks accurately. However, there is an apparent lack of studies that review ML and DL in IDS. Even the existing reviews of ML and DL fail to compare those techniques. Thus, this paper comprehensively elucidates ML and DL techniques and IPv6-based distributed denial of service (DDoS) attacks. Additionally, this paper includes a qualitative comparison with other related works. Moreover, this work also thoroughly reviews the existing ML and DL-based IDSs for detecting IPv6 and IPv4 attacks. Lastly, researchers could use this review as a guide in the future to improve their work on DL and ML-based IDS.</span>

A Negotiation-Based Scheme for Interconnecting Heterogeneous Networks With Enhanced Services

Although the TCP/IP protocols have made great contributions to the development of the Internet, there is a consensus that the Internet needs improvement to solve the address space exhausted, content-oriented service, and so on. The academic community has proposed lots of valuable but heterogeneous network protocols, which provide better network services but split the Internet. To connect these heterogeneous networks, many middleboxes (e.g.,NAT and Tunnel) are deployed on the Internet, but these middleboxes mask the communication peers and shield various network services that are provided by these heterogeneous networks. In this article, we propose the HNN (heterogeneous networks negotiation), which provides transparent end-to-end communication and connects heterogeneous networks stateless in the data plane. What's more, HNN enables the host to perceive the available network service provided by heterogeneous networks and helps the host structure appropriate packet header and packet forwarding path to take advantage of these heterogeneous network services. We implement and evaluate an HNN prototype with commodity Barefoot Tofino programmable switch S9180-32X. The evaluation results demonstrate that HNN introduces little processing time overhead (no more than 3%) compared to well-known heterogeneous connectivity techniques (i.e.,NAT and Tunnel) and allows hosts to utilize heterogeneous network services.

SAV6: A Novel Inter-AS Source Address Validation Protocol for IPv6 Internet

IP spoofing is prevalently used for anonymity and reflection attacks, e.g., distributed denial of service (DDoS) attacks, which have shown increasingly destructive power in recent years because today's Internet lacks validation on source addresses. Moreover, the fast deployment of IPv6 on the Internet may further aggravate the damages of DDoS attacks. This paper proposes a novel source address validation mechanism called SAV6, which leverages the huge IPv6 address space to validate source addresses at an inter-autonomous system (AS) granularity. In SAV6, each IPv6 address contains an AS number (ASN), whose corresponding AS announces the prefix of the address to other ASes. An AS can determine the authenticity of the source address by whether the ASN in the address matches the corresponding prefix after receiving an incoming packet. The performance evaluation of a SAV6 prototype shows that it adds little performance overhead to the deployed infrastructures and is a lightweight and deployable protocol.

AVX-TSCHA: Leaking information through AVX extensions in commercial processors

Modern x86 processors support an AVX instruction set to boost performance. However, this extension set may also cause security issues. We discovered that there are vulnerable properties in the implementation of the masked load/store instructions. First, these instructions can suppress exceptions caused by invalid or inaccessible memory access. Second, the execution time of these instructions leaks the current state of the page mappings, permissions, and TLB states.Based on this, we present a novel AVX timing side-channel attack that can defeat address space layout randomization. We demonstrate the significance of our side-channel attack by showing User and Kernel ASLR breaks on the recent Intel and AMD processors in various environments, including cloud computing systems (Amazon AWS, Google GCP, and Microsoft Azure), an SGX enclave (a fine-grained ASLR break), and major OSes (Linux, Windows, and macOS). Our attack can identify the Linux kernel's base address in 0.29 ms as well as those of loaded kernel modules in 2.24 ms, with a near-zero error rate. We further demonstrate that our attack can be used to infer user behavior, such as mouse movements and data transmissions over the network. Our evaluation results on multiple mobile, desktop, and server processors (a total of 26 Intel and AMD CPUs) show that 1) the AVX timing side-channel works on the vast majority of Intel processors (from the Sandy Bridge microarchitecture) as well as AMD processors (from the Zen microarchitecture onward) and 2) our KASLR breaks are very fast and reliable. To the best of our knowledge, our attack is the first to demonstrate a KASLR break on both the recent Intel Alder Lake and AMD Zen 3 CPUs. We highlight that more robust isolation or fine-grained randomization should be adopted to mitigate our presented attacks successfully.

The procedure for resolving domain disputes

The article is devoted to a complex scientific study of the procedure for consideration and resolution of domain disputes. The article discloses the legal nature of the domain name, features of judicial and extrajudicial dispute resolution. It has been established that the subject of domain disputes is the illegal use of other people’s trademarks, commercial names, other commercial designations, and copyright objects in domain names. It has been proven that the procedure for resolving domain disputes can be judicial or extrajudicial; in the case of a judicial procedure for the protection of rights to a domain name, disputes are considered by a court, in an out-of-court case, by an arbitrator of the WIPO Mediation and Conciliation Center (or another similar structure). It has been proven that a significant problem in law enforcement is legal uncertainty regarding the legal regime of a domain name. It has been established that a domain dispute arises regarding the legality of the use of a domain name by a certain person. It is justified that a domain and a domain name are not identical concepts; a domain name is a unique name of a part of the hierarchical address space of the Internet, in relation to which domain disputes arise. It is substantiated that the determining factor for the protection of the violated right by the court is the correct identification by the plaintiff of the object of the intellectual property right, for the protection of which a case has been initiated in court, and which is reflected in the content of the domain, since in case of failure to indicate such an object, the court may refuse to satisfy the claim , because the domain itself as an object does not receive legal protection.It has been established that the out-of-court procedure for resolving domain disputes is a convenient mechanism for the prompt protection of rights to a trademark that is displayed in someone else’s domain name without the right holder’s permission and thereby creates confusion with the right holder’s trademark, providing undue influence on consumers.It has been established that the reason for the occurrence of domain disputes is: the domain name is identical or deceptively similar to the trademark to which the plaintiff has intellectual property rights; the owner of the domain name has no rights or legal interests in the domain name; such domain name is registered or used in bad faith.It has been proven that when resolving domain disputes, special methods of protecting domain name rights are used – re-delegating domain name rights to the plaintiff or canceling domain name registration.It has been established that the judicial procedure for resolving domain disputes is universal and can be applied to the protection of rights to any object of intellectual property rights that can be reflected in a domain name (it concerns not only trademarks, but also commercial names, geographical indications, copyright objects, etc.). It is justified that such an approach is expedient to apply in relation to the out-of- court procedure for resolving domain name disputes, however, the relevant provisions must be approved by ICANN, making appropriate changes to Uniform Domain Name Dispute Resolution Policy.

6Search: A reinforcement learning-based traceroute approach for efficient IPv6 topology discovery

Topology discovery can infer the interconnection relationship between network entities. A complete network topology is of great significance for network security analysis, application research, etc. However, due to the huge address space and uneven distribution of active addresses in the IPv6 Internet, it is infeasible to use brute-force traceroute to discover the entire topology. To address this problem, we propose 6Search, a target generation method based on reinforcement learning algorithm for IPv6 topology discovery. 6Search first obtains the routeable BGP prefixes and then carries out traceroute in each (/32) prefix. The number of probes allocated is dynamically adjusted based on the results of previous scans. Using the reinforcement learning algorithm, 6Search allocates more probes to prefixes with more address discovery in each scan iteration. Real-world experiments demonstrate that 6Search has better performance in terms of discovery efficiency, which is 24.1%–139.8% improvement over the existing methods.

APIASO: A Novel API Call Obfuscation Technique Based on Address Space Obscurity

API calls are programming interfaces used by applications. When it is difficult for an analyst to perform a direct reverse analysis of a program, the API provides an important basis for analyzing the behavior and functionality of the program. API address spaces are essential for analysts to identify API call information, and therefore API call obfuscation is used as a protection strategy to prevent analysts from obtaining call information from API address spaces. API call obfuscation avoids direct API calls and aims to create a more complex API calling process. Unfortunately, current API call obfuscation methods are not effective in preventing analysts from obtaining usable information from the API address space. To solve this issue, in this paper, we propose an API call obfuscation model based on address space obscurity. The key functions within the API are encrypted and moved to the user code space for execution. This breaks the relationship between the API and its address space, making it impossible for analysts to obtain address information about a known API from the API address space. In our experiments, we developed an archetypical compiler-level API call obfuscation system to automate the obfuscation of input source code into an obfuscated file. The results show that our approach can thwart existing API deobfuscation techniques and is highly resistant to various open-source dynamic analysis platforms. Compared to other obfuscation techniques, our scheme improves API address space obscurity by more than two times, the detection rate of deobfuscation techniques such as Scylla, etc. is zero, and the increase in obfuscation overhead is not more than 20%. The above results show that APIASO has better obfuscation effect and practicability.

6Scan: A High-Efficiency Dynamic Internet-Wide IPv6 Scanner With Regional Encoding

Efficient Internet-wide scanning plays a vital role in network measurement and cybersecurity analysis. While Internet-wide IPv4 scanning is a solved problem, Internet-wide scanning for IPv6 is still a mission yet to be accomplished due to its vast address space. To tackle this challenge, IPv6 scanning generally needs to use pre-defined seed addresses to guide further IPv6 scanning directions. Under this general principle, various solutions have been developed, but all suffer from two primary pitfalls, low hit rate and low probing speed, caused by the inherent sparse distribution of active IPv6 addresses and the high computational complexity of the search algorithms, respectively. We develop 6Scan, a novel asynchronous IPv6 scanner that effectively addresses the above two problems. To increase the hit rate, 6Scan infers the promising search directions by encoding the regional identifiers of the target addresses within the probing packets and recording the regional activities from the asynchronously arrived replies. It then dynamically adjusts the search directions according to the scanning result of the previous steps. To speed up the search algorithm, 6Scan leverages the regional identifier encoding to quickly adjust search direction without excessive computation. Real-world experiments over the IPv6 Internet in a billion-scale probing budget show that compared with the state-of-the-art solutions, on average 6Scan can discover <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$6\%$</tex-math> </inline-formula> more active addresses with nearly the same scanning time.

Toward Practical 128-Bit General Purpose Microarchitectures

Intel introduced 5-level paging mode to support 57-bit virtual address space in 2017. This, coupled to paradigms where backup storage can be accessed through load and store instructions (e.g., non volatile memories), lets us envision a future in which a 64-bit address space has become insufficient. In that event, the straightforward solution would be to adopt a flat 128-bit address space. In this early stage letter, we conduct high-level experiments that lead us to suggest a possible general-purpose processor micro-architecture providing 128-bit support with limited hardware cost.

Harnessing the x86 Intermediate Rings for Intra-Process Isolation

Modern applications often involve the processing of sensitive information. However, the lack of privilege separation within the user space leaves sensitive application secrets such as cryptographic keys just as unprotected as a &#x201D;hello world&#x201D; string. Cutting-edge hardware-supported security features are being introduced. However, the features are often vendor-specific or lack compatibility with older generations of the processors. The situation leaves developers with no portable solution to incorporate protection for the sensitive application component. We propose LOTRx86, a fundamental and portable approach for user-space privilege separation. Our approach creates a more privileged user execution layer called <i>PrivUser</i> by harnessing the underused intermediate privilege levels on the x86 architecture. The PrivUser memory space, a set of pages within process address space that are inaccessible to user mode, is a safe place for application secrets and routines that access them. We implement the LOTRx86 ABI that exports the <monospace>privcall</monospace> interface to users to invoke secret handling routines in PrivUser. This way, sensitive application operations that involve the secrets are performed in a strictly controlled manner. The memory access control in our architecture is <i>privilege-based</i>, accessing the protected application secret only requires a change in the privilege, eliminating the need for costly remote procedure calls or change in address space. We evaluated our platform by developing a proof-of-concept LOTRx86-enabled web server that employs our architecture to securely access its private key during an SSL connection. We conducted a set of experiments, including a performance measurement on the PoC on <i>both</i> Intel and AMD PCs, and confirmed that LOTRx86 incurs only a limited performance overhead.

What you can read is what you can't execute

Due to the address space layout randomization (ASLR), code reuse attacks (CRAs) require memory probes to get available gadgets. Code reading is the basic way to obtain code information. In theory, setting the code to be unreadable can prevent code reading. However, the pages are loaded dynamically, and the existing methods cannot set all code as unreadable at one time. They can only control code permissions page-by-page via time-consuming page tracking. Moreover, since some special users need to read code, turning off the read permission will affect their execution. To solve these problems, this paper proposes a method AntiRead. It rebuilds the buddy system for memory allocation. The new buddy system places code pages in a specific memory pool to manage their read permissions. In the presence of AntiRead, what is obtained by adversaries through code reading is either randomized code or non-executable code. Experiments and analysis show that AntiRead can prevent the code that has been read from being used as gadgets without affecting the normal code reading. In addition, the CPU overhead introduced by AntiRead is 1.8%.

PointerScope: Understanding Pointer Patching for Code Randomization

Various fine-grained randomization schemes have been designed to increase the entropy of process space, while none of them can rise from an academic exercise to industrial deployment like Address Space Layout Randomization (ASLR). One of the critical reasons is the incorrectness of randomization caused by the mismatch between their pointer collection capabilities and the high accuracy requirements of the pointer patching task. In this article, we present PointerScope, an accurate compile-time pointer collection scheme deriving from a group of novel observations. The success of PointerScope relies on the complete tracing of the pointer generation process, including the compilation chain from compiler to static linker and the interface specification between them. From this view, PointerScope identifies four types of pointer-related static linker behaviors and clarifies five types of inherent addressing modes in the x86-64 architecture. The vague understanding of them causes the Compiler-assisted Code Randomization (CCR) to incorrectly collect pointers and patch them to the wrong values after randomization. Further, we measure the pointer collection capability of augmented binary analysis, the experimental results show that they can mitigate challenges from the traditional binary analysis by the given premises, but additional heuristics still need to be designed to support the fine-grained randomization.

Locality-preserving minimal perfect hashing of k-mers.

Minimal perfect hashing is the problem of mapping a static set of n distinct keys into the address space {1,…,n} bijectively. It is well-known that n log 2(e) bits are necessary to specify a minimal perfect hash function (MPHF) f, when no additional knowledge of the input keys is to be used. However, it is often the case in practice that the input keys have intrinsic relationships that we can exploit to lower the bit complexity of f. For example, consider a string and the set of all its distinct k-mers as input keys: since two consecutive k-mers share an overlap of k-1 symbols, it seems possible to beat the classic log 2(e) bits/key barrier in this case. Moreover, we would like f to map consecutive k-mers to consecutive addresses, as to also preserve as much as possible their relationship in the codomain. This is a useful feature in practice as it guarantees a certain degree of locality of reference for f, resulting in a better evaluation time when querying consecutive k-mers. Motivated by these premises, we initiate the study of a new type of locality-preserving MPHF designed for k-mers extracted consecutively from a collection of strings. We design a construction whose space usage decreases for growing k and discuss experiments with a practical implementation of the method: in practice, the functions built with our method can be several times smaller and even faster to query than the most efficient MPHFs in the literature.

Distributed Shared Memory : A Page-Based Approach

In 1986, Kai Li's PhD thesis, "Shared Virtual Memory on Loosely Coupled Microprocessors," introduced the concept of Distributed Shared Memory (DSM) systems, which has since facilitated further research in this field. One approach to implementing DSM in distributed systems is the page-based method, which utilizes virtual memory techniques to map pages of a process' address space onto the physical memory of multiple nodes. The system automatically moves pages between nodes as needed, ensuring coherence and consistency for shared page updates. Page-based DSM offers several advantages, including improved performance due to reduced communication overhead and better data locality, simplified programming models that resemble centralized systems, and improved scalability by allowing additional nodes to join the system and expand memory capacity. However, its suitability for certain distributed systems depends on their specific requirements and characteristics. Page-based DSM has been applied in various distributed systems, including high- performance computing, cloud computing, and distributed databases. Nonetheless, remote memory access overheads, cache coherence issues, and the necessity of a well-connected network remain potential limitations of this approach. Key words: Distributed memory, Shared memory, Paging, Virtual memory, memory coherence, memory consistency

Main memory controller with multiple media technologies for big data workloads

SRAM and DRAM memory technologies have been dominant in the implementations of memory subsystems. In recent years, and mainly driven by the huge memory demands of big data applications, NVRAM technology has emerged as a denser memory technology, enabling the design of new hybrid DRAM/NVRAM memory hierarchies that combine multiple memory media technologies to balance memory capacity, latency, cost, and endurance. Two main approaches are being applied to the design of hybrid memory hierarchies: the hybrid address space approach, which relies on the programmer or the operating system to choose the memory technology where each memory page should be stored; and the (only) NVM address space approach, where a faster technology (e.g. commodity DRAM) is needed to acts as a cache of NVRAM to boost the performance. This approach presents architectural challenges such the organization of metadata (e.g. cache tags) and the selection of the proper technology for each memory component. In contrast to existing approaches, this work proposes a memory controller that leverages novel memory technologies such as eDRAM and MRAM to mitigate NVRAM bus contention and improve the performance of the NVM address space. The devised solution proposes a two-level cache hierarchy in the memory controller: a SRAM sector cache and a (x)RAM cache. The (x)RAM cache, much denser, helps significantly reduce the number of accesses to NVRAM. Experimental results show that implementing the (x)RAM cache with eDRAM or MRAM is the best performing approach. Moreover, the eRAM is able to improve the SRAM cache miss penalty by up to 50% and 80%, and overall system performance by 15% and 23%.

ICMPv6-based DDoS Flooding-Attack Detection Using Machine and Deep Learning Techniques

IPv6 was created to resolve the problem of adopting IPv4 addresses by providing many address spaces. Currently, security is becoming an increasingly important concern in exploiting networks and reaping the benefits of IPv6. ICMPv6 is a key protocol in IPv6 implementation that is utilized for neighbor and router discovery. However, attackers can use this protocol to deny network services using ICMPv6 DDoS flooding attacks, which reduce network performance. DDoS is a difficult challenge on the internet since it is one of the most common attacks impacting a network, causing enormous economic harm to people as well as companies. This paper provides an intelligent ICMPv6-based DDoS flooding-attack detection system based on an artificial neural network to address this issue. This study additionally investigates and examines the suggested framework's detection accuracy. Using real datasets, we illustrate the efficiency of our methodology. To validate our system, we chose different machine learning algorithms and compared their outcomes. The findings show that the proposed framework can identify ICMPv6 DDoS flood assaults with detection accuracy rates of 99.98% for the first dataset and 85.91% for the second dataset.