China Education And Research Network Research Articles

Assessing the Security of Campus Networks: The Case of Seven Universities.

The network security situation of campus networks on CERNET (China Education and Research Network) has received great concern. However, most network managers have no complete picture of the network security because of its special management and the rapid growth of network assets. In this investigation, the security of campus networks belonging to seven universities in Wuhan was investigated. A tool called “WebHunt” was designed for campus networks, and with its help, the network security risks were found. Differently from existing tools for network probing, WebHunt can adopt the network scale and special rules of the campus network. According to the characteristics of campus websites, a series of functions were integrated into WebHunt, including reverse resolution of domain names, active network detection and fingerprint identification for software assets. Besides, WebHunt builds its vulnerability intelligence database with a knowledge graph structure and locates the vulnerabilities through matching knowledge graph information. Security assessments of seven universities presents WebHunt’s applicability for campus networks. Besides, it also shows that many security risks are concealed in campus networks, such as non-compliance IP addresses and domain names, system vulnerabilities and so on. The security reports containing risks have been sent to the relevant universities, and positive feedback was received.

Addressing the train–test gap on traffic classification combined subflow model with ensemble learning

Previous machine learning-based network traffic classification approaches hold the assumption that training and testing network environment are of the same. This assumption is invalid in most real cases due to the changes in traffic features and leads to the train–test gap issue: the model trained in the training environment performs poorly in the testing environment. In this paper, to address the gap, we propose CSA: a traffic classification approach based on packet-wise segmentation and aggregation. Firstly, we observe that some specific fragments of network flows – subflows – are robust against the gap. Therefore, we are motivated to segment the traffic flows into different subflows. Afterward, with the justification of our feature selection, 26 statistical features are extracted from each subflow and input into its corresponding sub-classifier. Secondly, with the results from sub-classifiers, we develop an aggregation method based on their classification accuracy to increase the overall classification performance. We experiment on five real datasets, including three collected from the Northwest Center of CERNET (China Education and Research Network) and two from public traces. By comparing with state-of-the-art baselines, the experiment results demonstrate the effectiveness of our CSA against the gap.

Symmetry Degree Measurement and its Applications to Anomaly Detection

Anomaly detection is an important technique used to identify patterns of unusual network behavior and keep the network under control. Today, network attacks are increasing in terms of both their number and sophistication. To avoid causing significant traffic patterns and being detected by existing techniques, many new attacks tend to involve gradual adjustment of behaviors, which always generate incomplete sessions due to their running mechanisms. Accordingly, in this work, we employ the behavior symmetry degree to profile the anomalies and further identify unusual behaviors. We first proposed a symmetry degree to identify the incomplete sessions generated by unusual behaviors; we then employ a sketch to calculate the symmetry degree of internal hosts to improve the identification efficiency for online applications. To reduce the memory cost and probability of collision, we divide the IP addresses into four segments that can be used as keys of the hash functions in the sketch. Moreover, to further improve detection accuracy, a threshold selection method is proposed for dynamic traffic pattern analysis. The hash functions in the sketch are then designed using Chinese remainder theory, which can analytically trace the IP addresses associated with the anomalies. We tested the proposed techniques based on traffic data collected from the northwest center of CERNET (China Education and Research Network); the results show that the proposed methods can effectively detect anomalies in large-scale networks.

MUCM: Multilevel User Cluster Mining Based on Behavior Profiles for Network Monitoring

Mastering user's behavior character is important for efficient network management and security monitoring. In this paper, we develop a novel framework named as multilevel user cluster mining (MUCM) to measure user's behavior similarity under different network prefix levels. Focusing on aggregated traffic behavior under different network prefixes cannot only reduce the number of traffic flows but also reveal detailed patterns for a group of users sharing similar behaviors. First, we employ the bidirectional flow and bipartite graphs to model network traffic characteristics in large-scale networks. Four traffic features are then extracted to characterize the user's behavior profiles. Second, an efficient method with adjustable weight factors is employed to calculate the user's behavior similarity, and entropy gain is applied to select the weight factor adaptively. Using the behavior similarity metrics, a simple clustering algorithm based on $k$ -means is employed to perform user clustering based on behavior profiles. Finally, we examine the applications of behavior clustering in profiling network traffic patterns and detecting anomalous behaviors. The efficiency of our methods is verified with extensive experiments using actual traffic traces collected from the northwest region center of China Education and Research Network (CERNET), and the cluster results can be used for flow control and traffic security monitoring.

CUFTI: Methods for core users finding and traffic identification in P2P systems

Peer-to-Peer system has achieved great success with millions of end users in the past several years. P2P traffic has occupied about 60–80 % of the total traffic volumes, which greatly consumes network bandwidth and causes congestions. To achieve the goal of efficacious P2P system management in the monitored network, in this paper we develop a framework named CUFTI (Core Users Finding and Traffic Identification). The core users are referred as long-lived peers, and we focus on life-time characteristics of coexisting peers within each snapshot of the overlay. Based on the analysis results of user’s behaviour in PPlive system, we develop an accurate model to forecast the peer’s residual life-time and identify the long-lived peers. Furthermore, we develop a flow identification model for P2P traffic management of those core users. Based on the analysis results of actual traffic traces, we find the P2P traffic flows are composed of data and control packets. Most of the control packets appear at the beginning and end of each flow to establish and close the communication between peers. We employ the direction and payload length of the control packets at the beginning of the flow as features to perform flow identification. Experimental results based on traces collected from the Northwest Region Center of CERNET (China Education and Research Network) show that the newly developed methods outperforms other existing methods with lower false negative rate (FNR) and false positive rate (FPR).

Robust application identification methods for P2P and VoIP traffic classification in backbone networks

Application identification plays an essential role in network management such as intrusion detection and security monitoring. But the continuous growth of bandwidth and massive amount of packets pose serious challenges for efficacious and accurate application identification. In this paper, we develop a new method to reduce the number of packets being processed while achieving the goal of accurate P2P and VoIP application identification. Firstly, we employ the Bi-flow model to aggregate traffic packets into Bi-flow, which can capture the exchange behavior characteristics between different terminals. Then we employ the signature of Packet Size Distribution (PSD) to capture flow dynamics, which is defined as the payload length distribution probability of the packets in one Bi-flow. Secondly, we collect PSD of several different P2P and VoIP applications and the analysis results show that PSD of different applications are different with each other, which can be used as features to perform traffic identification. We also find the PSD characteristics of one Bi-flow can be captured by its first few packets, which demonstrate our methods can identify the Bi-flow quickly after its establishment. We employ the Renyi cross entropy to perform identification by calculating the similarity between PSD of the Bi-flow being identified and that of specific application. If the similarity is higher than a selected threshold, the Bi-flow being identified is classified to the specific application. Finally, as the PSD is a type of probability feature which is not sensitive to packet lose, we integrate the Poisson sampling method into our framework to process the massive data in backbone networks. Experimental results using the artificial and actual traces collected from monitoring platform in the Northwest Center of CERNET (China Education and Research Network) verify the accuracy and robustness of our method.

Exploring Flow Characteristics in IPv6: A Comparative Measurement Study with IPv4 for Traffic Monitoring

With the exhaustion of global IPv4 addresses, IPv6 technologies have attracted increasing attentions, and have been deployed widely. Meanwhile, new applications running over IPv6 networks will change the traditional traffic characteristics obtained from IPv4 networks. Traditional models obtained from IPv4 cannot be used for IPv6 network monitoring directly and there is a need to investigate those changes. In this paper, we explore the flow features of IPv6 traffic and compare its difference with that of IPv4 traffic from flow level. Firstly, we analyze the differences of the general flow statistical characteristics and users’ behavior between IPv4 and IPv6 networks. We find that there are more elephant flows in IPv6, which is critical for traffic engineering. Secondly, we find that there exist many one-way flows both in the IPv4 and IPv6 traffic, which are important information sources for abnormal behavior detection. Finally, in light of the challenges of analyzing massive data of large-scale network monitoring, we propose a group flow model which can greatly reduce the number of flows while capturing the primary traffic features, and perform a comparative measurement analysis of group users’ behavior dynamic characteristics. We find there are less sharp changes caused by abnormity compared with IPv4, which shows there are less large-scale malicious activities in IPv6 currently. All the evaluation experiments are carried out based on the traffic traces collected from the Northwest Regional Center of CERNET (China Education and Research Network), and the results reveal the detailed flow characteristics of IPv6, which are useful for traffic management and anomaly detection in IPv6.

Estimation Algorithms of the Flow Number from Sampled Packets on Approximate Approaches

PDF HTML阅读 XML下载 导出引用 引用提醒 基于近似方法的抽样报文流数估计算法 DOI: 10.3724/SP.J.1001.2013.04316 作者: 作者单位: 作者简介: 通讯作者: 中图分类号: 基金项目: 国家自然科学基金(60973123);国家重点基础研究发展计划(973)(2009CB320505);江苏省科技计划项目(科技支撑计划——工业部分)(BE2011173) Estimation Algorithms of the Flow Number from Sampled Packets on Approximate Approaches Author: Affiliation: Fund Project: 摘要 | 图/表 | 访问统计 | 参考文献 | 相似文献 | 引证文献 | 资源附件 | 文章评论 摘要:维护每个报文的流记录需要占用大量测量资源.目前已有多种抽样技术估计网络流统计信息,然而精确地估计出流数统计信息是目前的研究难点.提出了Integral和Iteration 两种基于报文抽样样本估计网络流数的算法.Integral算法只需使用抽样流长为1的流数信息就可以近似推导出未抽样的流数.Iteration算法通过建立迭代函数估计未抽样流数,然后根据未抽样流数和已抽样的流数推断出原始流量的流数.采用CERNET(China education andresearch network)骨干网络链路数据将这两种算法与EM(expectation maximization)算法进行对比,表明Iteration算法具有较好的精度和性能. Abstract:Recording flow statistics for each network packet is resource-intensive. Various sampling techniques are used to estimate flow statistics. However, the estimation accuracy based on the sampling remains a significant challenge. This paper introduces both sampling techniques denoted as Integral and Iteration algorithms, which can accurately infer the number of original flows from the sampled flow records. The Integral algorithm uses only the number of sampled flows with one sampled packet to approximately deduce the number of unsampled flows. The Iteration algorithm can estimate the number of unsampled flows using an iteration method. The number of original flows can be precisely estimated according to both the number of sampled flows and unsampled flows. Both the algorithms are compared to the EM (expectation maximization) algorithm using multiple traffic traces collected from CERNET (China education and research network) backbone. The result shows that the Iteration algorithm is superior to the EM algorithm and can provide highly accurate estimation on the number of original flows. 参考文献 相似文献 引证文献

Efficient Two Dimensional-IP routing: An incremental deployment design

High dimensional routing has attracted more attentions to satisfy the increasing demands for more flexible services in the Internet. These routing schemes make routing decisions not only based on the destination address, but also on the source address, flow label, etc. With these schemes, networks can provide more than best-effort services.There are several research issues towards high dimensional routing. Clearly routers face additional CPU and memory burden in looking up and maintaining the additional information. While some overheads are unavoidable, we need to minimize such burden incurred. A more important problem is the deployment. It is widely known that making changes to the network layer is notoriously difficult. The proposed scheme should have least impact on the current Internet protocols and infrastructure. A node-by-node incremental deployment scheme is highly preferred. Obviously, without full deployment, the resulting paths for traffic diversion may deviate from the pre-defined ones. The incremental deployment scheme should minimize such deviation.In this paper, we illustrate the problem by using a real example from China Education and Research Network 2 (CERNET2). Then we formulate it as finding a deployment sequence where the traffic flows should follow the pre-defined paths given (1) the number of nodes to be deployed and (2) the extra burden each router can spare. We transform our problem to boolean clauses and develop efficient solutions following the Maximum Satisfiability (MAX-SAT) problem. We present several related algorithms for different practical scenarios.We evaluate our algorithms using comprehensive simulations with BRITE generated topologies and real world topologies. We conduct a case study on CERNET2 configurations. Compared to an ad hoc deployment and an arbitrary TwoD-IP forwarding, our algorithms compute a deployment sequence that achieves close to optimal performance after deploying a few nodes. The CPU and memory requirement are small for packet forwarding.

A new connection degree calculation and measurement method for large scale network monitoring

Traffic pattern characteristics monitoring is useful for abnormal behavior detection and network management. In this paper, we develop a framework for connection degree calculation and measurement in high-speed networks. The bi-directional traffic flow model is employed to aggregate traffic packets, which can reduce the number of flow records and capture user's alternation behavior characteristics. The first order connection degree and joint correlation degree are selected as the features to capture the characteristics of traffic profiles. To perform careful traffic inspection and attack detection, not only the abnormal changes of a single traffic feature but also the correlations between the features are analyzed in the new framework. First, the symmetry of in and out connection degrees is analyzed. And we found that incomplete flows are an important information source for abnormal behavior detection. Second, joint correlation degree can characterize the user's communication profiles and their behavior dynamics, which are employed to perform abnormal detection using measurements based on Renyi cross entropy. Finally, the reversible degree sketch is employed for querying abnormal traffic pattern sources for real-time traffic management. The experimental results based on actual traffic traces collected from Northwest Regional Center of CERNET (China Education and Research Network) show the efficiency of the proposed method. The method based on Renyi entropy can detect abnormal changing points correctly. FNR of the reversible sketch for locating abnormal sources is below 4% and time complexity is constant and less than 4s, which is critical for real-time traffic monitoring.

Source address filtering for large scale networks

Source address filtering is very important for protecting networks from malicious traffic. Most networks use hardware-based solutions such as TCAM-based filtering, however, they suffer from limited capacity, high power consumption and high monetary cost. Although software, such as SRAM, is larger, cheaper and consumes less power, the software-based solutions need multiple accesses in memory, which as a result bear much more additional lookup burden.In this paper, we propose a new software-based mechanism. In our mechanism, routers cooperate with each other, and each only checks a few bits rather than all bits in source addresses. Our mechanism can guarantee the correctness, i.e., filtering all malicious traffic. We formulate it as an optimization problem where the loads across the network can be optimally balanced. We solve the problem by dynamic programming.With the increasing number of filters, storage could also become a bottleneck for source address filtering. Our mechanism improves this by distributing filters among different routers. We re-formulate the problem by adding an additional storage constraint. Then we prove that the problem is NP-Complete, and propose a heuristic algorithm to solve it.At last, using comprehensive simulations with various topologies, we show that the mechanism greatly improves both lookup burden and storage space. We conduct a case study on China Education and Research Network 2 (CERNET2), the largest pure-IPv6 network in the world. Using CERNET2 configurations, we show that our algorithm checks less than 40bits on each router, compared with 128bits in IPv6 addresses.

Key enabling techniques and deployment of 120Gb/s long-haul optical transmission in backbone networks

The explosive increase in data traffic requires networks to provide higher capacity and long-haul transmission capabilities. This paper introduces new results on high-order modulation and efficient Digital Signal Processing algorithms to reduce various transmission limitations in coherent receiving systems. Polarization Division Multiplexed Quadrature Phase Shift Keying (PDM-QPSK) is deployed to reach high bit rates, provides modified digital clock recovery, and allows BER-Aided Constant Modulus Algorithm (BA-CMA) equalising. A Soft Decision-Forward Error Correction (SD-FEC) algorithm and a joint scheme with timing recovery and adaptive equaliser are used to achieve better performance. A compact coherent transceiver is also developed. These techniques have been applied in the largest 100 G Optical Transport Network (OTN) deployment in the world, the backbone expansion project for Phase 3 of the China Education and Research Network (CERNET), with a total transmission length of 10 000 km.

Research on Network Traffic Identification Based on Improved BP Neural Network

Traffic identification is a key task for any Internet Service Providers (ISP) or network administrators. Neural network is an important research method on traffic classification, this paper introduces the important methods of traffic classification,through study on Principal Component Analysis(PCA) and BP neural network. An improved BP neural network to identify traffic is proposed and M OORE SET is used as dataset, meanwhile, building N OC SET dataset based on CERNET(China Education and Research Network).the experiment results show that the accuracy rate of traffic classification based on the improved BP neural network model is relatively high.Finally,this paper analyzes packet sampling impact on traffic identification.

An efficient critical protection scheme for intra-domain routing using link characteristics

In recent years, there are substantial demands to reduce packet loss on the Internet. Among the proposed schemes, finding backup paths in advance is considered to be an effective method to reduce the reaction time. Very commonly, a backup path is chosen to be the most disjoint path from the primary path, or on the network level, a backup path is computed for each link (e.g., IPFRR). The validity of this straightforward choice is based on two things. The first thing is all the links may have the equal likelihood to fail; the second thing is, facing the high protection requirement today, it just looks weird to have links not protected or to share links between the primary and backup paths. Nevertheless, many studies have confirmed that the individual vulnerability of the links on the Internet is far from being equal. In addition, we have observed that full protection schemes (In this paper, full protection schemes means schemes (1) in which backup path is a most disjoint path from the primary path; or (2) which compute backup path for each link.) may introduce high cost (e.g., computation).In this paper, we argue that such approaches may not be cost-efficient and therefore propose a novel critical protection scheme based on link failure characteristics. Firstly, we analyze the link failure characteristics based on real world traces of CERNET2 (China Education and Research NETwork 2). The analysis results clearly show that the failure probabilities of the links in CERNET2 backbone are heavy-tailed, i.e., a small set of links causing most of the failures. Based on this observation, we find out two key parameters which strongly impact link criticality and propose a critical protection scheme for both single link failure situation and multi-link failure situation. We carefully analyze the implementation details and overhead for backup path schemes of the Internet today; the problem is formulated as an optimization problem to guarantee the routing performance and minimize the backup cost. This cost is special as it involves computational overhead. Based on this, we propose a novel Critical Protection Algorithm which is fast itself for both the single link failure and the multi-link failure versions. A comprehensive set of evaluations with randomly generated topologies, real world topologies and the real traces from CERNET2, shows that our scheme gains significant achievement over full protection in both single link failure situation and multi-link failure situation. It costs only about 30–60% of the full protection cost when the network relative availability increment is 90% of the full protection scheme.

Minimum Protection Cost Tree: A tunnel-based IP Fast Reroute Scheme

Diverse delay-sensitive realtime applications, e.g., Voice over IP, are emerging in the Internet and bringing a rigorous requirement on the transmission delay. Therefore, several IP Fast Reroute (IPFRR) schemes have been proposed. However, these schemes are all either too computationally expensive or unsatisfactory in protection coverage. In this paper, we propose Minimum Protection Cost Tree (MPCT), a tunnel-based IP Fast Reroute Scheme. First, MPCT provides 100% single-node protection coverage with direct forwarding (DF). Second, the computational complexity of MPCT is less than one full shortest path first (SPF) calculation. Third, by simulation with the data from China Education and Research Network (CERNET), Rocketfuel and BRITE, we show that even without DF, MPCT can provide more than 99% protection coverage. Besides, the protection path stretch ratios in real topologies are between 10% and 20%, which is acceptable compared with the corresponding achievement of reducing the algorithm complexity. We believe that our scheme MPCT moves a big step towards practical deployment.

CNGI-CERNET2

Research and promotion of next generation Internet have drawn attention of researchers in many countries. In USA, FIND initiative takes a clean-slate approach. In EU, EIFFEL think tank concludes that both clean slate and evolutionary approach are needed. While in China, researchers and the country are enthusiastic on the promotion and immediate deployment of IPv6 due to the imminent problem of IPv4 address exhaustion. Since 2003, China launched a strategic programme called China Next Generation Internet (CNGI). China is expecting that Chinese industry is better positioned on future Internet technologies and services than it was for the first generation. Under the support of CNGI grant, China Education and Research Network (CERNET) started to build an IPv6-only network, i.e. CNGI-CERNET2. Currently it provides IPv6 access service for students and staff in many Chinese universities. In this article, we will introduce the CNGI programme, the architecture of CNGI-CERNET2, and some aspects of CNGI-CERNET2's deployment and operation, such as transition, security, charging and roaming service etc.

Performance analysis of multi-fiber WDM network with limited-range wavelength conversion

Wavelength routed optical networks have emerged as a technology that can effectively utilize the enormous bandwidth of the optical fiber. Wavelength conversion technology and wavelength converters play an important role in enhancing fiber utilization and in reducing the overall call blocking probability of the network. In this paper, we develop a new analytical model to calculate the average blocking probability in multi-fiber link networks using limited range wavelength conversion. Based on the results obtained, we conclude that the proposed analytical model is simple and yet can effectively analyze the impact of wavelength conversion ranges and number of fibers on network performance. Also a new heuristic approach for placement of wavelength converters to reduce blocking probabilities is explored. Finally, we analyze network performance with the proposed scheme. It can be observed from numerical simulations that limited range converters placed at a few nodes can provide almost the same blocking probability as full range wavelength converters placed at all the nodes. We also show that being equipped with a multi-fiber per-link has the same effect as being equipped with the capability of limited range wavelength conversion. So a multi-fiber per-link network using limited range wavelength conversion has similar blocking performance as a full wavelength convertible network. Since a multi-fiber network using limited range wavelength conversion could use fewer converters than a single-fiber network using limited range wavelength conversion and because wavelength converters are today more expensive than fiber equipment, a multi-fiber network in condition with limited range wavelength conversion is less costly than a single fiber network using only limited range wavelength conversion. Thus, multi-fiber per-link network using limited range wavelength conversion is currently a more practical method for all optical WDM networks. Simulation studies carried out on a 14-node NSFNET, a 10-node CERNET (China Education and Research Network), and a 9-node regular mesh network validate the analysis.

Data management services and transfer scheme in ChinaGrid

ChinaGrid is a nationwide grid project supported by the Chinese government that aims at integrating massive heterogeneous resources distributed on the China Education and Research Network (CERNET). The ChinaGrid Supporting Platform (CGSP) is a grid middleware developed for ChinaGrid. It provides a series of system-level services for ChinaGrid, helps to build application portals and integrate grid resources, and supports the secondary development of grid services. Data Management Services (DMS) is a group of system-level services in CGSP for managing storage and data resources, supporting transparent data access, and guaranteeing high-performance data transfer on the grid. It consists of metadata management service, storage resource management service, replication management service, storage agent and transfer client. It offers the fundamental support for data access on ChinaGrid. In this paper, we introduce the design principle and implementation of DMS and its transfer scheme.

The Transition to IPv6, Part 1: 4over6 for the China Education and Research Network

Researchers at the Tsinghua University in Beijing propose a mechanism for letting IPv4 networks communicate with each other across an IPv6 backbone via a Border-Gateway Protocol (BGP)-based control plane for advertising tunnels and IPv4 network prefixes. They've deployed a prototype implementation on the native-IPv6 China Education and Research Network 2 (CERNet2) backbone as the major part of the China Next-Generation Internet (CNGI) project, using current packet encapsulation technology and an extension of BGP, and the IETF is currently considering their 4over6 mechanism as well.

Academic library user education in China

The role of academic libraries is changing and expanding in China. Education reform in higher education has initiated many changes in the universities. Developing information technology has enabled academic libraries to move from traditional paper‐based environments toward networked‐electronic ones. A great number of global information resources are available to libraries now. Tsinghua University’s library, for example, has built an integrated library information system including CD‐ROM online searching. In 1998, the university was the first one to be connected to the Internet in China. In the same year, it began its leadership of the China Education and Research Network (CERNET). These accomplishments, as discussed here, have provided new and great challenges for faculty, students, and staff, especially librarians.