Header Fields Research Articles

Utilizing TabNet Deep Learning for Elephant Flow Detection by Analyzing Information in First Packet Headers.

Rapid and precise detection of significant data streams within a network is crucial for efficient traffic management. This study leverages the TabNet deep learning architecture to identify large-scale flows, known as elephant flows, by analyzing the information in the 5-tuple fields of the initial packet header. The results demonstrate that employing a TabNet model can accurately identify elephant flows right at the start of the flow and makes it possible to reduce the number of flow table entries by up to 20 times while still effectively managing 80% of the network traffic through individual flow entries. The model was trained and tested on a comprehensive dataset from a campus network, demonstrating its robustness and potential applicability to varied network environments.

Encrypted malicious traffic detection based on natural language processing and deep learning

The focus on privacy protection has brought much-encrypted network traffic. However, attackers always abuse traffic encryption to conceal malicious behaviors. Although researchers have proposed several enlightening detection methods, they must enhance the generalization ability or improve detection performance. Our inspiration is that the packet header fields, as do the underlying grammatical rules for constructing sentences, have a strict order. We consider the original packet as text and devise a robust approach with natural language processing and a deep learning model to improve the generalization ability and detection performance. We capture the critical keywords as characteristic representations of the traffic and design an adaptive domain generalization algorithm with a new loss function. It is robust against various datasets by generating more malicious samples to augment the minority of malicious samples. Simultaneously, we design an efficient feature selection algorithm, which obtains an optimal feature subset and reduces feature dimensions by 75.3%. To evaluate our work, we conducted extensive experiments with open-source datasets (CICIDS 2017, CICDDoS 2019, and USTC-TFC 2016), the synthetic dataset from IoT-23, and Internet backbone traffic (CERNET). Experimental results demonstrate that our proposal improves detection accuracy by up to 22.8% compared to others not using domain generalization algorithms and achieves an average detection latency of 0.67 s in the backbone. Besides, our work applies to the Industrial Internet of Things (IIoT) environment. It can be deployed at edge nodes to provide network security support for IIoT devices.

A Joint Model of Entity Linking for RFC Protocols Knowledge Graph Construction

Applying knowledge representation and reasoning to downstream tasks has been considered a promising research direction, as it enables semantic analysis of network protocols. Knowledge Graph is a new way of collecting knowledge, and building a protocol knowledge graph based on RFCs can help us study and analyze network protocols more effectively. However, automatically constructing a protocol knowledge graph from RFCs poses a major challenge, particularly in terms of extracting and linking protocol entities, due to the semi-structured nature of RFC documents. In this paper, we propose a model that combines a fine-tuned language model with an RFC Domain Model to link entities in RFCs to categories in the protocol knowledge base. Firstly, we design a protocol knowledge base as the schema for protocol entity linking. Secondly, we use heuristic methods to identify protocol entities and infer their descriptions from the nearby contexts of their header fields. Finally, we conduct comprehensive experiments on the RFC dataset using our joint model and baseline methods for protocol entity linking. Experimental results demonstrate that our model achieves state-of-the-art performance in entity linking on the RFC dataset, outperforming all baseline methods. In addition, we release a protocol knowledge graph, RFC-KG1.

Enhanced dynamic fine‐grained popularity‐based caching algorithm for ICN‐based edge computing networks

AbstractIn this letter, we propose an Enhanced Dynamic Fine‐Grained Popularity‐based Caching (ED‐FGPC) algorithm to efficiently cache static contents in ICN‐based edge computing networks. The content popularity changes with time. Thus, the ED‐FGPC algorithm considers the number of incoming interests, the practical file size, and the available cache size to adjust the content popularity threshold. This allows dynamic adjustment of the content popularity threshold. Additionally, ED‐FGPC incorporates a single bit called cached bit (CB) in the header field of the content. This eliminates caching redundancy in the on‐path routers. The cache eviction policy jointly considers the content popularity and the average content access timestamp for content replacement. Based on the content access pattern, this allows finer adjustment of the content eviction policy. We use analytical and mathematical modeling to derive the effectiveness and efficiency of our contribution. Results present a better hit ratio due to dynamic adjustment of the content popularity threshold and the elimination of caching redundancy from the on‐path routers.

How Polynomial Regression Improves DeNATing

The ubiquity of Network Address Translation (NAT) and mobile hotspots that aggregate source IP addresses of connected devices to a single IP address makes it difficult for an observer in the Internet to learn anything about the internal network. The IP Identification header field of Domain Name System requests and the TCP Timestamp (TCP TS) header field of TCP SYN packets are the main features for counting devices in the internal network and association of packets to these devices, also known as DeNATing. This paper introduces a new method that relies on polynomial least-squares curve fitting for DeNATing. Evaluation of our model is performed on multiple real-world datasets containing Windows and Unix devices behind a router using NAT and a mobile hotspot. The proposed method outperforms other state-of-the-art methods for all of the used datasets on all types of devices. Successful DeNATing may help in cybersecurity, anti-fraud, and other use cases.

Scalable packet classification based on rule categorization and cross-producting

Packet classification performs multidimensional point location upon fields in packet headers to categorize packets into multiple forwarding classes based on pre-defined rules. It plays an important role for the data plane of software-defined networking (SDN). Packet classification is also applied to support quality of service and network security. In this work, we propose an algorithm, Segregated Cross-producting, to improve the scalability of cross-producting in term of storage. Our algorithm starts by categorizing rules according to their length combinations, where the rules of the same length combination do not incur any storage penalty for cross-producting. Then, the algorithm selectively merges rules of different length combinations to improve the search performance. Our scheme is suitable for parallel implementation to further improve speed performance and can support real-time incremental updates. We extensively evaluate the performance of our scheme with rulesets of different sizes and characteristics. The experiment results show that our scheme can provide superior scalability for both speed and space performance.

Network Layer Privacy Protection Using Format-Preserving Encryption

Format-Preserving Encryption (FPE) algorithms are symmetric cryptographic algorithms that encrypt an arbitrary-length plaintext into a ciphertext of the same size. Standardisation bodies recognised the first FPE algorithms (FEA-1, FEA-2, FF1 and FF3-1) in the last decade, and they have not been used for network layer privacy protection so far. However, their ability to encrypt arbitrary-length plaintext makes them suitable for encrypting selected packet header fields and replacing their original value with ciphertext of the same size without storing excessive information on the network element. If the encrypted fields carry personally identifiable information, it is possible to protect the privacy of the endpoints in the communication. This paper presents our research on using FPE for network layer privacy protection and describes LISPP, a lightweight, stateless network layer privacy protection system. The system was developed for programmable smart network interface cards (NIC) and thoroughly tested in a real network environment. We have created several implementations ranging from pure P4 to a mix of P4 and C implementations, exploring their performance and the suitability of target-independent P4 language for such processor-intensive applications. Finally, LISPP achieved line rate TCP throughput, up to 4.5 million packets per second, with the penalty of only 30 to 60 microseconds of additional one-way delay, proving that it is adequate for use in production networks. The most efficient implementation was with the FF3-1 algorithm developed in C and carefully adapted to the specific hardware configuration of the NIC.

Spoofed Email Based Cyberattack Detection Using Machine Learning

ABSTRACT Cyberattacks on e-mails are of different types, but the most pervasive and ubiquitous are spoofing attacks. Our approach uses memory forensics to extract e-mail headers from live memory to perform an e-mail header investigation to identify spoofing attacks. We have identified the research gaps and advanced our work to achieve better results. In this paper, we have made two significant improvements. First is URL validation module that uses a novel technique of checking each captured URL with an MX record and e-mail URL features. This scheme is fast, and reduces the total time from 35 sec to 27 sec. Second, spoofed e-mail detection is ameliorated by applying an ML model built using two novel e-mail header fields (BIMI and X-FraudScore) and four authentication header fields (SPF, DKIM, DMARC, and ARC). This enhances the spoofed e-mail detection accuracy from 96.15% to 97.57% with low false positives.

Packet Classification Using TCAM of Narrow Entries

Packet classification based on rules of packet header fields is the key technology for enabling software-defined networking (SDN). Ternary content addressable memory (TCAM) is a widely used hardware for packet classification; however, commercially available TCAM chips have only limited storage. As the number of supported header fields in SDN increases, the number of supported rules in a TCAM chip is reduced. In this work, we present a novel scheme to enable packet classification using TCAM with entries that are narrower than rules by storing the most representative field of a ruleset in TCAM. Due to the fact that not all rules can be distinguished using one field, our scheme employs a TCAM-based multimatch packet classification technique to ensure correctness. We further develop approaches to reduce redundant TCAM accesses for multimatch packet classification. Although our scheme requires additional TCAM accesses, it supports packet classification upon long rules with narrow TCAM entries, and drastically reduces the required TCAM storage. Our experimental results show that our scheme requires a moderate number of additional TCAM accesses and consumes much less storage compared to the basic TCAM-based packet classification. Thus, it can provide the required scalability for long rules required by potential applications of SDN.

Implementation of Blockchain-Assisted Source Routing for Traffic Management in Software-Defined Networks

The control and infrastructure layers are split into Software-Defined Networks (SDNs). With the control and infrastructure planes split, new network applications may be developed with more simplicity and greater independence. On the other hand, the disadvantages of SDN create a slew of questions. In large-scale networks, such as Wide Area Networks (WANs) covering huge areas, more propagation delays substantially contribute to network convergence time. In addition, traditional SDN restricts network design flexibility due to the influence of controller location on network performance in large-scale networks. SDN-based source routing (SR) has emerged as a viable solution to the issues above, where the packet header field is used to specify a packet's route. This study presents an SR-based End-to-End (E2E) traffic management framework called SoRBlock. In SoRBlock, inter-domain routing uses blockchain technology, while intra-domain routing relies on the SR technique in SDNs. The simulation results show that the proposed SR-based SoRBlock framework outperforms the traditional hierarchical routing approach, HRA, in SDN networks by lowering path setup time (PST) and the number of controller messages. While the same (i.e., identical origin and target) service requests were used for all runs in the simulations, the proposed SoRBlock architecture presents almost three times less total PST between 45ms and 65ms than the HRA method between 130ms and 200ms due to the HRA approach's increased node-controller and controller-controller latencies. On the other hand, SoRBlock shows two times less PST ([75ms – 90ms]) than HRA ([150ms – 175ms]) when different service requests (i.e., different origin and target) were used. Concerning Controller Messages Processed (CMP), the HRA deals nearly 50% more controller messages between 7 and 15 than the SoRBlock between 3 and 10 when the number of domains varies, while the CMP in the SoRBlock scheme ([10 - 17]) approaches that in the HRA framework ([15 - 20]) regarding the ratio while the count of nodes rises in domains.

IMPLEMENTING PACKET CLASSIFICATION USING STANDARD ACL

Packet classification involves the categorization of packets within network systems, such as firewalls and routers, based on their flow. Its primary objective is to match packet headers with a predefined set of filters. In this research, we propose a system that utilizes the source IP address of each incoming packet for packet classification. By employing a rule set, the system can determine whether to grant or deny access to each packet. The algorithm examines the source IP address header field of received packets on a specific link and compares it against a collection of rules. It then outputs the action associated with the highest priority rule that corresponds to the packet header. Ultimately, the classification of individual packets is based on the action specified in the rule set.

Hardware Trojan Mitigation Technique in Network-on-Chip (NoC)

Due to globalization in the semiconductor industry, malevolent modifications made in the hardware circuitry, known as hardware Trojans (HTs), have rendered the security of the chip very critical. Over the years, many methods have been proposed to detect and mitigate these HTs in general integrated circuits. However, insufficient effort has been made for hardware Trojans (HTs) in the network-on-chip. In this study, we implement a countermeasure to congeal the network-on-chip hardware design in order to prevent changes from being made to the network-on-chip design. We propose a collaborative method which uses flit integrity and dynamic flit permutation to eliminate the hardware Trojan inserted into the router of the NoC by a disloyal employee or a third-party vendor corporation. The proposed method increases the number of received packets by up to 10% more compared to existing techniques, which contain HTs in the destination address of the flit. Compared to the runtime HT mitigation method, the proposed scheme also decreases the average latency for the hardware Trojan inserted in the flit’s header, tail, and destination field up to 14.7%, 8%, and 3%, respectively.

TCAM-based packet classification for many-field rules of SDNs

Software-defined networking (SDN) provides an emerging paradigm for future network architectures. OpenFlow is a widely deployed south-bound protocol for SDN. It uses rule-based packet forwarding and each rule may support many header fields for fulfilling various SDN applications. As the number of inspected header fields increases, these long rules may complicate the procedure of packet classification based on TCAM because TCAM only supports limited word sizes. In this paper, we propose a TCAM-based packet classification scheme to support many-field rules. Our scheme incorporates multiple stages of TCAM accesses, where each stage only compares selected bits of rules. Although our scheme may result in additional TCAM accesses, it enables packet classification upon rules longer than TCAM words. The experimental results show that our scheme can search 10K 247-bit rules by using 72-bit TCAM entries, where each packet classification can be accomplished with less than ten TCAM accesses. It also reduces the required TCAM storage by a magnitude of order. In summary, with our scheme, both feasibility and scalability of TCAM-based packet classification for SDN rules are significantly improved.

Enhancing Bandwidth Utilization of IP Telephony Over IPv6 Networks

The demand for the telecommunication services, such as IP telephony, has increased dramatically during the COVID-19 pandemic lockdown. IP telephony should be enhanced to provide the expected quality. One of the issues that should be investigated in IP telephony is bandwidth utilization. IP telephony produces very small speech samples attached to a large packet header. The header of the IP telephony consumes a considerable share of the bandwidth allotted to the IP telephony. This wastes the network's bandwidth and influences the IP telephony quality. This paper proposes a mechanism (called Smallerize) that reduces the bandwidth consumed by both the speech sample and the header. This is achieved by assembling numerous IP telephony packets in one header and use the header's fields to carry the speech sample. Several metrics have been used to measure the achievement Smallerize mechanism. The number of calls has been increased by 245.1% compared to the typical mechanism. The bandwidth saving has also reached 68% with the G.28 codec. Therefore, Smallerize is a possible mechanism to enhance bandwidth utilization of the IP telephony.

Range-enhanced packet classification to improve computational performance on field programmable gate array

<span lang="EN-US">Multi-filed packet classification is a powerful classification engine that classifies input packets into different fields based on predefined rules. As the demand for the internet increases, efficient network routers can support many network features like quality of services (QoS), firewalls, security, multimedia communications, and virtual private networks. However, the traditional packet classification methods do not fulfill today’s network functionality and requirements efficiently. In this article, an efficient range enhanced packet classification (REPC) module is designed using a range bit-vector encoding method, which provides a unique design to store the precomputed values in memory. In addition, the REPC supports range to prefix features to match the packets to the corresponding header fields. The synthesis and implementation results of REPC are analyzed and tabulated in detail. The REPC module utilizes 3% slices on Artix-7 field programmable gate array (FPGA), works at 99.87 Gbps throughput with a latency of 3 clock cycles. The proposed REPC is compared with existing packet classification approaches with better hardware constraints improvements.</span>

A Learned Bloom Filter-Assisted Scheme for Packet Classification in Software-Defined Networking

Traditional routing technologies based on a single IP address domain faces the challenge to meet the increasing demand for network services and security. Packet classification is a technique to differentiate multi-domain network traffic in a fine-grained manner using packet header fields. Packet classification requires to operate efficiently to avoid it becoming a bottleneck in the packet routing process. Tuple space search (TSS) used in SDN supports fast rule updates but low-speed packet classification. In this paper, we propose a learned Bloom filter (LBF)-based packet classification algorithm that combines LBF and TSS to promote classification speed by avoiding invalid hash table accesses. Specifically, LBF consists of multiple RNN models and one support Bloom filter (SBF), in which the learned models are trained with the positive and negative sets, and used as a pre-filter to identify the two sets. For the filter outcomes with a negative result from learned models, SBF is constructed to perform the second filtration. To ensure efficiency of RNN and SBF, we carefully select key features to be used in RNN and SBF, which can also maintain efficient search in the final stage of hash checking. Our experimental results show that the proposed algorithm saves more memory space than Tuple space pruning (TSP) given the same false positive rate. The proposed algorithm is competitive in terms of the number of memory accesses, while achieving almost one order of magnitude improvement on pre-processing time over NeuroCuts which is an advanced decision tree classifier.

Intelligent SDN Architecture With Fuzzy Neural Network and Blockchain for Monitoring Critical Events

ABSTRACT The article deals with the creation of an intelligent architecture of the Internet of Things transport environment based on software-defined network (SDN) and blockchain for detecting threats and attacks. The transport environment is created for the monitoring system of critical events in the road transport infrastructure. Blockchain technology is used to authenticate network nodes, store sensor data in a distributed ledger. The network packet clustering method based on a fuzzy neural network is used to detect packets with possible malicious content. The intelligent SDN architecture is a hierarchy of four layers with six levels and includes: a) edge computing layer (sensor nodes and routers level, SDN switches data level), b) fog computing layer (zone server level, control level in SDN controllers), c) a cloud computing layer with data center servers, d) a layer for presenting monitoring results on user devices and applications. Detection of threats and attacks is implemented by validating network nodes and analyzing header fields of IP packets and TCP segments. The intrusion detection system includes a parser and analyzer of data packets, a module for filtering traffic by type, port numbers and other characteristics of packets, a module for synthesizing digital signatures of trusted nodes and their validation, a module for analyzing and clustering packets based on fuzzy logic and a neural network, modules for logging procedures. The probability function of packets belonging to clusters is tuned through deep learning of a five-layer neural network. The conclusion about belonging and degree of similarity with malicious packages is formed using the fuzzy logic apparatus. To train the neural network, the previously synthesized rules of the flow tables and the identified signs of atypical data packets are used. The functionality and effectiveness of the SDN architecture with an intrusion detection system is validated by simulating procedures in the NS3 Simulator system, evaluating authenticity, latency, throughput, response time, and accuracy in detecting atypical data packets.

ClassBench-ng: Benchmarking Packet Classification Algorithms in the OpenFlow Era

Packet classification, i.e., the process of categorizing packets into flows, is a first-class citizen in any networking device. Every time a new packet has to be processed, one or more header fields need to be compared against a set of pre-installed rules. This is done for basic forwarding operations, to apply security policies, application-specific processing, or quality-of-service guarantees. A lot of research efforts have identified better lookup techniques, i.e., finding the best match between packet headers and rules, by capitalizing on the rule sets characteristics. Here, ClassBench has greatly served the community by enabling the generation of IPv4 rule sets. In this paper, we present a new tool, ClassBench-ng, that creates synthetic IPv4, IPv6, and OpenFlow rules. We start from an analysis of classification rules deployed in-the-wild and we use the findings to craft our solution. ClassBench-ng can generate a user-defined number of rules as well as an associated header trace matching them. Compared to state-of-the-art solutions, the rule set generation process is usually more accurate and it is able to produce rules matching a number of different use cases, i.e., from an IPv4 router to an OpenFlow switch, which is unique among current rule set generation tools.

Traffic classification in an increasingly encrypted web

Traffic classification is essential in network management for a wide range of operations. Recently, it has become increasingly challenging with the widespread adoption of encryption in the Internet, for example, as a de facto in HTTP/2 and QUIC protocols. In the current state of encrypted traffic classification using deep learning (DL), we identify fundamental issues in the way it is typically approached. For instance, although complex DL models with millions of parameters are being used, these models implement a relatively simple logic based on certain header fields of the TLS handshake, limiting model robustness to future versions of encrypted protocols. Furthermore, encrypted traffic is often treated as any other raw input for DL, while crucial domain-specific considerations are commonly ignored. In this paper, we design a novel feature engineering approach used for encrypted Web protocols, and develop a neural network architecture based on stacked long short-term memory layers and convolutional neural networks. We evaluate our approach on a real-world Web traffic dataset from a major Internet service provider and mobile network operator. We achieve an accuracy of 95% in service classification with less raw traffic and a smaller number of parameters, outperforming a state-of-the-art method by nearly 50% fewer false classifications. We show that our DL model generalizes for different classification objectives and encrypted Web protocols. We also evaluate our approach on a public QUIC dataset with finer application-level granularity in labeling, achieving an overall accuracy of 99%.

A variable-trust threshold-based approach for DDOS attack mitigation in software defined networks.

Software-defined networks offer a new approach that attracts the attention of most academic and industrial circles due to the features it contains. However, some loopholes make such modern networks vulnerable to many types of attacks. Among the most important types of these attacks is the Distributed Denial of Service (DDoS) attack, which in turn affects the network’s performance and delays many real user requests. As one of the main features of SDN is the centralization of all the control plane in the SDN controller, it becomes a central point of attack that may compromise the whole network. Hence, in our proposed approach, we aim to mitigate the DDoS attack that maybe launched to compromise the SDN controller, flood the control plane and cripple the entire network. Many DDoS mitigation scheme have been proposed, however, determining the threshold between legitimate requests and malicious requests is still a challenging task. Our proposed approach relies on a two-phases algorithm that assigns a variable trust value for every user. This trust value is compared with schemes relying on a threshold value that changes dynamically and assists in detecting the DDoS attack. The first phase of our two-phases algorithm is Header fields extraction, and the second phase is calculating the trust value based on header fields information. Our proposed approach shows better performance than related detection schemes in terms of accuracy, detection rate, and false-positive rate. Where the accuracy of the system reaches up to 98.83% which is high compared to other traditional methods.