Application-level Protocol Research Articles

Analysis of corporate network cyber threats based on parallel processing of Netflow data

Public services of various organizations are subject to constant cyber attacks, which increases information security risks. Network traffic analysis is an important task to ensure the safe operation of network infrastructure, including corporate networks. This paper provides an overview of the main approaches for analyzing network traffic, provides related works, and points out the shortcomings of existing works. One method is to analyze network traffic data using the Netflow protocol, which allows traffic data to be stored at the L3 layer of the OSI model. A feature of the study is the use of long observation periods. When storing data over long time intervals, the logs become large, which requires parallelization for primary data processing. The authors developed a cross-platform software package for distributed processing of network activity logs, which was used to analyze the network activity of the corporate network of the Krasnoyarsk Scientific Center for 2021–2022. A diagram of the software package is shown, its capabilities and operating features are described. Data sources for analysis and processing methods are provided. In this paper the authors formulated and formalized heuristic criteria for the anomaly of network traffic, which identify the presence of possible network attacks, and extracted datasets on the network activity of various application-level protocols. For the obtained data sets, statistical indicators were calculated, information about anomalous network activity was obtained for two years. In this work we tested the previously proposed method for comparing the cyber threats risks for different time intervals, which showed a significant increase in risks for 50% of indicators in 2022. Comparisons of monthly intervals over different years showed similar increases in risk. Thus, the method has shown its efficiency and can be used in other areas in which there are groups of criteria for independent indicators. The authors proposed plans for further development of methods for analyzing network activity.

Congestion Aware WSN-IoT-Application Layer Protocols for Healthcare Services

In the healthcare industry, WSN-IoT networks can be used to gather patient data for statistical purposes. IoT-based application-level protocols do not take into account these facts while forwarding the data to the gateway or server, which may degrade the network performance if the data was collected from a patient with ordinary/critical health issues and the route was busy or congested. In this paper, we'll look at the performance of two application layer protocols (i.e. CoAP and MQTT) within the constraints of a scalable network by integrating a congestion-aware scheme with them.

Enhancing Network Visibility and Security with Advanced Port Scanning Techniques.

Network security is paramount in today's digital landscape, where cyberthreats continue to evolve and pose significant risks. We propose a DPDK-based scanner based on a study on advanced port scanning techniques to improve network visibility and security. The traditional port scanning methods suffer from speed, accuracy, and efficiency limitations, hindering effective threat detection and mitigation. In this paper, we develop and implement advanced techniques such as protocol-specific probes and evasive scan techniques to enhance the visibility and security of networks. We also evaluate network scanning performance and scalability using programmable hardware, including smart NICs and DPDK-based frameworks, along with in-network processing, data parallelization, and hardware acceleration. Additionally, we leverage application-level protocol parsing to accelerate network discovery and mapping, analyzing protocol-specific information. In our experimental evaluation, our proposed DPDK-based scanner demonstrated a significant improvement in target scanning speed, achieving a 2× speedup compared to other scanners in a target scanning environment. Furthermore, our scanner achieved a high accuracy rate of 99.5% in identifying open ports. Notably, our solution also exhibited a lower CPU and memory utilization, with an approximately 40% reduction compared to alternative scanners. These results highlight the effectiveness and efficiency of our proposed scanning techniques in enhancing network visibility and security. The outcomes of this research contribute to the field by providing insights and innovations to improve network security, identify vulnerabilities, and optimize network performance.

A complete architecture for Ambient Assisted Living scenarios using a cross protocol proxy

Nowadays, in the most developed countries, modern society is moving towards scenarios in which the self-sufficiency elderly people live alone in their homes. An automatic remote monitoring system using wearable sensors is becoming even more important in Ambient Assisted Living applications. For this type of services, it is important that IoT sensors networks, which are generally composed of devices with limited computing power and storage, implement reliable communication among sensors and the Internet. There are several specialized protocols for the Internet of Things proposed by the scientific community, each characterized by its own levels of Quality of Services. The emergence of new protocols forces the need for developing proxying systems able to intermediate among different types of networks and to translate the relative protocols. In this paper, we propose a complete architecture for monitoring and managing wearable devices, and, in particular, fall detection ones. Our system uses a cross protocol proxy and a device with CoAP and MQTT as application level protocols, while it exploits the NB-IoT at physical and data-link levels. The goal of this work is the performance evaluation of the proposed solution in terms of Throughput, Round Trip Time and Delay. The results highlight the low latency reached by the proposed system architecture thanks to the implemented protocols.

Toward the Concurrent Transportation Protocol for High Traffic Volume in 4G/5G Networks

The Transmission Control Protocol (TCP) was intentionally designed for the sake of service reliability but with the cost of application performance on which TCP clients need to use multiple connections to achieve concurrency and to reduce latency. And more importantly, it was designed mostly for the fixed networks and to transport traffic of non-real-time applications and thus not suitable for the mobile networks with higher packet error rate and real-time traffic. For example, TCP is a connection-oriented protocol, so it has to guarantee delivery of information, in order to maintain that connection. The recipient has to acknowledge the data that was sent and that creates overhead. It means that it's going to take more packets transferred, and thus higher delay. To address this weakness of TCP, and on this paper, we proposed a new application-level protocol that makes use of TCP as transportation, named as CoTCP (Concurrent request-response over TCP). The new proposed protocol allows sending and receiving multiple messages concurrently on one connection. We also evaluated and tested the performance of CoTCP in various application scenarios on the specific hardware platform. Numerical results show that CoTCP can lead to higher concurrency and lower latency.

Microservice Communication for IoT-based Systems. Architecture Review and Performance Test

One of the most important things in IoT system development is the right communication technologies and protocols. Communication of modern IoT systems can be divided into two main parts: device-to-cloud communication and communication between cloud microservices (application level). In this study, the authors designed a test-system environment for evaluating the performance of the existing transmitting protocols for the cloud microservices communication. The proposed environment allows emulate of IoT systems with low network latency which allows evaluating and comparing protocols performance. The authors provide tests for the most popular application-level protocols: HTTP, MQTT, AMQP, and GRPC. The performance evaluation was performed based on such metrics: throughput, concurrency, scalability, transmitting size, and init connection time. The obtained experimental results and testing environment can be used for the efficient design of microservice communication.

Stackable Transactional File System Using Kernel-Level WAL

User applications that require transactional file access generally use user-level transactional protocols such as logging, atomic rename, since the POSIX interface does not support transactional file operations. The user-level protocols are complex and require specific persistence properties of file systems for correctness. If the kernel provides transactional access to file data, application developers can avoid the complex and error-prone application-level protocols. Many previous studies on kernel-level transactional support have several critical limitations such as complex APIs, file system-dependence, and low transaction concurrency. In this paper, we propose a kernel-level write-ahead logging (WAL) technique, called KWAL. KWAL maintains user-transparent WAL files and redirects transactional IOs to them. Since KWAL is implemented as a stackable file system, it can be mounted over any native file systems, without modifying them. To provide a higher transaction concurrency while guaranteeing isolation, KWAL supports byte-level write conflict detection and repeatable read isolation. We also utilize a block remap technique to resolve the duplicate write problem of WAL-based transaction scheme. To demonstrate the usefulness of KWAL, we implemented a simple key-value store using KWAL APIs, fixed the wrong transaction implementation of the Git application, and simplified the implementation of the storage engines of MySQL and SQLite.

Bungie: Improving Fault Tolerance via Extensible Application-Level Protocols

We present Bungie, an approach based on applicationlevel protocols that precisely capture the causality inherent to the interactions among agents. We show through patterns and examples how Bungie provides abstractions for achieving fault tolerance.

WITHDRAWN: Wireless sensor network and IoT based systems for healthcare application

Internet of Things (IoT) for healthcare applications is an emerging research field that has gained a lot of attention in the last few years. The paper presents the IoT remote healthcare monitoring system that provides the patient’s conditions through Web browser. For simulation purposes, we use Contiki OS with 6LoWPAN protocol stack, and Cooja, the built-in Contiki simulator. CoAP is selected as application level protocol for remote data access and representation.

Vulnerability analysis and method of selection of communication protocols for information transfer in Internet of Things systems

The subject of study in the paper is the analysis of technologies, architectures, vulnerabilities and cyberattacks, communication patterns of smart objects, messaging models, and Internet of Things (IoT) / Web of Things (WoT) protocols for solving applied problems of critical and non-critical systems. The goal is to develop a method for selecting messaging models and application-level protocols in non-critical and critical multi-level IoT/WoT systems, provided that the type of access to intelligent objects is initially determined by the initial data, as well as analysis of vulnerabilities and attacks using these protocols. Objectives: to formalize the procedure for choosing communication protocols for IoT/WoT systems; analyze possible vulnerabilities of communication protocols; develop a method for selecting communication protocols for given initial data, depending on the selected type of communication template for smart objects; check practically the proposed method. The methods of research are methods of system analysis. The following results were obtained. The analysis of the features of communication protocols is conducted by comparing the main interrelated characteristics of IoT/WoT, the results of which are presented in the form of a table. A method has been developed for selecting communication protocols, depending on the selected type of communication template. The analysis of possible vulnerabilities of communication protocols and possible attacks using these protocols is conducted. The author has tested the method using the example of a corporate system (Smart House) based on the WoT concept. Findings. The scientific novelty of the results obtained is as follows: the analysis conducted in the paper shows that currently there is no unified approach to the choice of a messaging model and application-level protocols for building IoT/WoT, depending on the selected type of communication template for smart objects. The method for selecting communication protocols for the given conditions (for each IoT system its interaction pattern will correspond, depending on which components interact with each other), improved by the authors of the paper, makes it possible to simplify the task of using separate protocols for given IoT systems, considering vulnerabilities of protocols.

Distributed real-time SlowDoS attacks detection over encrypted traffic using Artificial Intelligence

SlowDoS attacks exploit slow transmissions on application-level protocols like HTTP to carry out denial of service against web-servers. These attacks are difficult to be detected with traditional signature-based intrusion detection approaches, even more when the HTTP traffic is encrypted. To cope with this challenge, this paper describes and AI-based anomaly detection system for real-time detection of SlowDoS attacks over application-level encrypted traffic. Our system monitors in real-time the network traffic, analyzing, processing and aggregating packets into conversation flows, getting valuable features and statistics that are dynamically analyzed in streaming for AI-based anomaly detection. The distributed AI model running in Apache Spark-streaming, combines clustering analysis for anomaly detection, along with deep learning techniques to increase detection accuracy in those cases where clustering obtains ambiguous probabilities. The proposal has been implemented and validated in a real testbed, showing its feasibility, performance and accuracy for detecting in real-time different kinds of SlowDoS attacks over encrypted traffic. The achieved results are close to the optimal precision value with a success rate 98%, while the false negative rate takes a value below 0.5%.

Packet reservations in real-time multipath transmissions

Subject of Research. The paper presents research of mechanisms of multipath redundant transmissions in computer networks. Method. The developed application level protocol gives the possibility to increase the probability of timely and faultless data delivery in computer networks which work within the conditions of delivery time limits using multipath redundant transmissions of packet copies via different channels. Main Results. The protocol with redundant multipath transmissions opportunity based on UDP transport protocol is developed. The efficiency analysis of the presented solutions is carried out on the basis of simulation modeling in OMNeT++ environment. Models of the proposed protocol and computer network with redundant transmissions opportunity are developed. Experiments with these models are carried out and efficiency area of the developed protocol application is determined. The multiplicative criterion that shows time reserve of timely and faultless transmitted packets is used as an efficiency indicator. The presented protocol shows efficiency in various working cases with the intensity and redundancy coefficient change of packet arrival. Practical Relevance. The developed algorithms and mechanisms can be used for program implementation of protocol with redundant multipath transmissions aimed at its application in cyberphysic real-time systems.

Quick Response Code for Controlling Web of Things

It is widely acknowledged that the current Internet of Things (IoT) ecosystem is highly fragmented. The Web of Things (WoT) aims to counter the fragmentation using the principles of Web, standardized metadata and APIs. QR i.e. "Quick Response" code is a 2D matrix code that is designed by keeping two points under consideration, i.e. it must store large amount of data as compared to 1D barcodes and it must be decoded at high speed using any handheld device like phones. QR code provides high data storage capacity, fast scanning, omnidirectional readability, and many other advantages including, error-correction (so that damaged code can also be read successfully) and different type of versions. Different varieties of QR code symbols like logo QR code, encrypted QR code, iQR Code are also available so that user can choose among them according to their need. The WoT relies exclusively on application level protocols and tools. Web protocols are a critical factor in the successful implementation of the WoT. However, one of the main issues is web latency that may significantly affect the real-time performance of IoT systems. Some pioneer open stages and models are likewise shown. The latest research results are painstakingly outlined. Moreover, numerous efficient examinations are made to give the understanding in the advancement and eventual fate of WoT. At last, we call attention to some open testing issues that will be confronted and handled by research network.

An Improved Mechanism for SDN Flow Space to Control Oriented Authentication NAA Network

The Open Daylight platform with its power by working with IEEE 802.1X port level authentication for wired and wireless networks has been very supportive because of the massive deployments at mean charge for main design considerations. Within the current marketplace, 802.1X has flourished the ground works for wireless, wire stability, LAN stability and authentication methods. EAP (Extensible Authentication Protocol) supports long time protection of the supplicant and the authentication software till the end condition of the RADIUS (Remote Authentication Dial-In User Service) server is met. This paper is focused on the RAR (RADIUS Access Request) unique identification about the users on the network with SAA (Supplicant, Authenticator and Authentication server) system which records on the attribute cost of RFC 2865 according to the forwarding server. NAA (Non-Adaptive Algorithm) using FlowVisor based virtualization packages drive inward the network timescales or statistics, dynamically controlling the flow space of switches to control the speed and results in scaling of networks. NAA is an application level protocol that contains authentication and configuration information between a Network Access Server and a shared authentication server. It avoids the attacker from listening for requests and responses from the server and calculates the improved MD5 client secret key of the response.

Survey, comparison and research challenges of IoT application protocols for smart farming

Smart farming era has already begun and its societal and environmental implications are expected to be huge. In this context, the Internet of Things (IoT) technologies have become the major path forward towards novel farming practices. The unprecedented capability of data collection and management offered by IoT is based on several factors of the underlying communication network architecture and technology, one of the most important being the application level protocol that is used among IoT nodes, gateways, and application servers. This work offers an up-to-date survey of research efforts on the IoT application layer protocols, focusing on their basic characteristics, their performance as well as their recent use in agricultural applications. Furthermore, it provides a comparison among them, in terms of well-accepted key performance indicators and comments on their suitability in the framework of smart farming as well as the corresponding challenges that have to be faced towards their efficient implementation.

A Secure Link State Routing Protocol for NDN

The Named-data Link State Routing protocol (NLSR) is a protocol for intra-domain routing in Named Data Networking (NDN). It is an application level protocol similar to many IP routing protocols, but NLSR uses NDN’s interest/data packets to disseminate routing updates, directly benefiting from NDN’s built-in data authenticity. The NLSR design, which was first developed in 2013 and deployed on the NDN test bed in August 2014, has undergone significant changes. Following an application-driven design approach, NLSR’s development helped drive the development of the trust/security functionality of NDN libraries as well as a number of features in NDN’s forwarding daemon and ChronoSync. In this paper, we describe the current design and implementation of NLSR, with emphasis on those features that differentiate it from an IP-based link state routing protocol: 1) naming: a hierarchical naming scheme for routers, keys, and routing updates; 2) security: a hierarchical trust model for routing within a single administrative domain; 3) routing information dissemination: using ChronoSync to disseminate routing updates; and 4) multipath routing: a simple way to calculate and rank multiple forwarding options. Although NLSR is designed in the context of a single domain, its design patterns may offer a useful reference for future development of inter-domain routing protocols.

Practical Aspects of Physical and MAC Layer Security in Visible Light Communication Systems

Abstract Visible light communication (VLC) has been recently proposed as an alternative standard to radio-based wireless networks. Originally developed as a physical media for PANs (Personal area Networks) it evolved into universal WLAN technology with a capability to transport internet suite of network and application level protocols. Because of its physical characteristics, and in line with the slogan "what you see is what you send", VLC is considered a secure communication method. In this work we focus on security aspects of VLC communication, starting from basic physical characteristics of the communication channel. We analyze the risks of signal jamming, data snooping and data modification. We also discuss MAC-level security mechanisms as defined in the IEEE 802.15.7 standard. This paper is an extension of work originally reported in Proceedings of the 13th IFAC and IEEE Conference on Programmable Devices and Embedded Systems - PDES 2015

Software Defined Monitoring of Application Protocols

With the ongoing shift of network services to the application layer also the monitoring systems focus more on the data from the application layer. The increasing speed of the network links, together with the increased complexity of application protocol processing, require a new way of hardware acceleration. We propose a new concept of hardware acceleration for flexible flow-based application level traffic monitoring which we call Software Defined Monitoring. Application layer processing is performed by monitoring tasks implemented in the software in conjunction with a configurable hardware accelerator. The accelerator is a high-speed application-specific processor tailored to stateful flow processing. The software monitoring tasks control the level of detail retained by the hardware for each flow in such a way that the usable information is always retained, while the remaining data is processed by simpler methods. Flexibility of the concept is provided by a plugin-based design of both hardware and software, which ensures adaptability in the evolving world of network monitoring. Our high-speed implementation using FPGA acceleration board in a commodity server is able to perform a 100 Gb/s flow traffic measurement augmented by a selected application-level protocol analysis.

Network traffic application identification based on message size analysis

Identifying network applications is centric to many network management and security tasks. A large number of approaches exist in the literature, most of which are based on statistical and machine learning techniques. For protecting the user privacy, the majority of the existing methods rely on discriminative traffic attributes at the network and transport layers, such as interaction schemes, packet sizes and inter-arrival times. In this work, we propose a novel blind, quintuple centric approach by exploring traffic attributes at the application level without inspecting the payloads. The identification model is based on the analysis of the first application-layer messages in a flow (quintuple), based on their sizes, directions and positions in the flow. The underlying idea is that the first messages of a flow usually carry some application level signaling and data transfer units (command, request, response, etc.) that can be discriminative through their patterns of size and direction. A Gaussian mixture model is proposed to characterize the applications, based on a study of the common characteristics of application-level protocols. The blind classifier is based on Markov models with low complexity and reasonable computational requirements, where the training procedure consists of profiling the target applications separately. Promising results were obtained for some popular protocols including many peer-to-peer applications.

From Communicating Machines to Graphical Choreographies

Graphical choreographies, or global graphs, are general multiparty session specifications featuring expressive constructs such as forking, merging, and joining for representing application-level protocols. Global graphs can be directly translated into modelling notations such as BPMN and UML. This paper presents an algorithm whereby a global graph can be constructed from asynchronous interactions represented by communicating finite-state machines (CFSMs). Our results include: a sound and complete characterisation of a subset of safe CFSMs from which global graphs can be constructed; an algorithm to translate CFSMs to global graphs; a time complexity analysis; and an implementation of our theory, as well as an experimental evaluation.