Packet Header Data Research Articles

AT-GCN: A DDoS attack path tracing system based on attack traceability knowledge base and GCN

The rapid development of the Internet provides sufficient attack entrances for massive malicious terminals, which makes it extremely challenging to effectively trace the path of DDoS attacks. Traditional solutions mainly trace distributed denial of service (DDoS) attacks by adding tags to data packet headers or querying logs, which increases the cost of tagging. There are also some works that implement attack tracking based on the network-wide perspective and centralized control of SDN, but these methods are difficult to deploy on a large scale. In order to solve this problem, we propose a DDoS attack path tracing system (AT-GCN) based on attack traceability knowledge base and graph convolutional network (GCN). We first propose the construction process of the attack traceability knowledge base, and design the intra-domain attack graph and the traceability algorithm recommendation graph to solve the problems of DDoS attack path traceability and optimal traceability solution recommendation. On this basis, we propose a GCN-based intra-domain attack traceability scheme, and design a subgraph sampling algorithm Tracing-Sample adapted to intra-domain DDoS attack traceability, aiming to efficiently use the graph structure in the knowledge base to reproduce DDoS attack paths. Additionally, we recommend the traceability algorithm based on user-based collaborative filtering (UBCF), and dynamically recommend the best traceability algorithm according to the different requirements of administrators for traceability performance. Compared with other GCN algorithms, the results show that the recall of the AT-GCN system is increased by 7.3% on average, and the FPR is reduced by 5.7% on average at the expense of the memory usage rate. Under different scale topologies, the recall of the AT-GCN system can be stabilized at 95%.

Lightweight Differentiated Transmission Based on Fuzzy and Random Modeling in Underwater Acoustic Sensor Networks.

Energy-efficient and reliable underwater acoustic communication attracts a lot of research due to special marine communication conditions with limited resources in underwater acoustic sensor networks (UASNs). In their final analysis, the existing studies focus on controlling redundant communication and route void that greatly influence UASNs' comprehensive performances. Most of them consider directional or omnidirectional transmission for partial optimization aspects, which still have many extra data loads and performance losses. This paper analyzes the main issue sources causing redundant communication in UASNs, and proposes a lightweight differentiated transmission to suppress extra communication to the greatest extent as well as balance energy consumption. First, the layered model employs layer ID to limit the scale of the data packet header, which does not need depth or location information. Second, the layered model, fuzzy-based model, random modeling and directional-omnidirectional differentiated transmission mode comb out the forwarders step by step to decrease needless duplicated forwarding. Third, forwarders are decided by local computation in nodes, which avoids exchanging controlling information among nodes. Simulation results show that our method can efficiently reduce the network load and improve the performance in terms of energy consumption balance, network lifetime, data conflict and network congestion, and data packet delivery ratio.

Implementation of Efficient Intrusion Detection of Imbalanced Network Traffic using Deep Learning

A crucial component of network security is intrusion detection, but this task can be difficult when dealing with statistics on the distribution of network traffic, where benign cases exceed malicious ones by a large margin. The goal of this project is to create a powerful intrusion detection system using a recurrent neural network (RNN) to address this problem. RNNs are excellent at identifying temporal dependencies in sequential data, which makes them useful for examining network traffic patterns. The suggested methodology calls for preprocessing the data, balancing the dataset, feature extraction, choosing an RNN model, training, assessing, adjusting, and monitoring in real time. The network traffic data is cleaned and formatted during the preprocessing stage, and balancing algorithms make sure the RNN is trained on a representative dataset. It then extracts pertinent aspects, including behavioral patterns and packet header data. Effective intrusion detection requires the use of an appropriate RNN architecture, such as LSTM or GRU. The model is subsequently trained, assessed using a range of criteria, and refined through iterations. The optimized RNN model is then implemented for real-time intrusion detection, monitoring network traffic continuously and producing alerts for probable intrusions. This research seeks to improve the precision and efficacy of network security systems, maintaining the integrity of crucial information in the linked world of today, by utilizing RNNs for intrusion detection in imbalanced network trafficking. Keywords IDS, Imbalanced Network Traffic, Deep Learning, Recurrent Neural Network.

Nonlinear remote monitoring system of manipulator based on network communication technology

Abstract In order to study the nonlinear remote monitoring system of the manipulator based on the network communication technology, a research method of the nonlinear remote monitoring system of the manipulator based on the network communication technology is proposed. In this article, in the Visual C++ environment, the transmission control protocol/internet protocol technology is used to build a remote monitoring system for the robotic arm, and it mainly realizes the function of the robotic arm running according to the trajectory in the remote. When storing video, you need to specify the ID of the video source, i.e., the synchronization source in the real-time transport protocol data packet header identifies the robot, which can monitor more clearly. The remote monitoring technology is widely used in the modern automation industry, which not only further extends the human space activity ability, but also removes the human from the dangerous and complex working environment. Therefore, the remote monitoring technology has broad application prospects.

ECHO: Efficient Zero-Control-Packet Broadcasting for Mobile Ad Hoc Networks

Applications such as collaborative mapping motivate a need for network-wide broadcasting in Mobile Ad Hoc Networks (MANET) with low-rate long-range links. Existing MANET protocols are inadequate in such low-capacity regimes due to their high use of control packets. We present a novel protocol called ECHO that constructs and maintains a broadcast backbone without using any control packets. Instead, using a field in the data packet header, a node transmits and listens for an “echo” of the specific packet to determine its membership in the backbone. ECHO is deterministic, source-independent, fully distributed, accommodates mobility, and balances battery consumption across nodes. We prove ECHO’s correctness and show that its communication complexity is lower than that of Multi-Point Relay (MPR) and Flooding, and comparable to that of Opportunistic Announcement (OA). Simulations over random mobile low-capacity networks show that ECHO provides at least a 30 percent better delivery ratio than Flooding, MPR, and OA for 50-node networks and dramatically reduces the communication load. Experiments on a 12-node testbed of goTenna mobile mesh networking devices show that ECHO reduces transmissions by about 3x and increases battery life by more than 50 percent over Flooding. ECHO’s performance advantages are crucial for scalable broadcast in low-power, low-capacity wireless networks.

ACHIEVING ENHANCED HIGH THROUGHPUT ON CLUSTER BASED WIRELESS SENSOR NETWORK WITH MULTIPLE MOBILE SINK

Wireless sensor networks (WSNs) with multiple mobile sink are expected to increase the flexibility for gathering information in large-scale sensing environment. Energy harvesting becomes one of the most important features of the sensor nodes to extend their lifetime of networks. In order to increase the life time, many energy harvesting scheme has been devoted. Despite of many advantageous on those schemes, it still faces several challenges due to heavy involvement of network periphery nodes in data retrieval, processing, buffering, and delivering tasks. In this paper, a new energy efficient technique has been employed to increase the throughput of the data transmission in cluster based wireless sensor network along multiple mobile sink. The model constructs the cluster consisting of the member nodes which route the routing information to the high density node in the cluster which is referred as cluster head. Cluster head provides the routing data to the multiple sinks propagating for data collection and packet header to establish the data transferring path in either single hop or multihop on available mobile sink trajectories. Enhanced high throughput strategies and constrainst employed on the cluster head to filter the redundant data and forward the appropriate data to end nodes with sufficient residual energy whereas to eliminate the packet loss due link destruction. Simulation results confirm the effectiveness and efficiency of the proposed approach on the performance metric such as throughput, traffic, packet losses, bandwidth utilization and packet delivery ratio.

A Trust-Based Active Detection for Cyber-Physical Security in Industrial Environments

For the cyber-physical systems (CPS) in the smart industrial environments, a larger amount of smart sensor nodes, processors and actuators are deployed to sense information from physical world, which is vulnerable to be attacked because the nodes are deployed in unattended areas. Security is a pivotal issue for CPS, therefore, a trust-based active detection (TBAD) scheme is proposed for improving the reliability of collecting data packets and reducing the data redundancy. In TBAD scheme, the trust of the nodes is evaluated by the neighboring nodes and the evaluation results are added into the header of data packets. Thus, according to the reliability of data packets collected by the unmanned aerial vehicle (UAV), the trust of sensor nodes is evaluated by the UAV. In addition, the evaluation trust of nodes stored in the header of data packets will be detected when the UAV suspects the stored trust of sensor nodes. Then, the trust of corresponding sensor nodes is adjusted according to the detection results. The sensor nodes with higher trust are selected to form movement trajectory. A series of simulation experiments are conducted to evaluate the performance of the scheme. The results illustrate that the proposed scheme can greatly improve the efficiency and security of data routing in CPS.

Robot Local Network Using TQS Protocol for Land-to-Underwater Communications

This paper presents a model and an analysis of the Tag QoS switching (TQS) protocol proposed for heterogeneous robots operating in different environments. Collaborative control is topic that is widely discussed in multirobot task allocation (MRTA) – an area which includes establishing network communication between each of the connected robots. Therefore, this research focuses on classifying, prioritizing and analyzing performance of the robot local network (RLN) model which comprises a point-to-point topology network between robot peers (nodes) in the air, on land, and under water. The proposed TQS protocol was inspired by multiprotocol label switching (MPLS), achieving a quality of service (QoS) where swapping and labeling operations involving the data packet header were applied. The OMNET++ discrete event simulator was used to analyze the percentage of losses, average access delay, and throughput of the transmitted data in different classes of service (CoS), in a line of transmission between underwater and land environments. The results show that inferior data transmission performance has the lowest priority with low bitrates and extremely high data packet loss rates when the network traffic was busy. On the other hand, simulation results for the highest CoS data forwarding show that its performance was not affected by different data transmission rates characterizing different mediums and environments.

Analytical Modelling of Software and Hardware Switches with Internal Buffer in Software-Defined Networks

OpenFlow supports internal buffering of data packets in Software-Defined Networking (SDN) switch whereby a fraction of data packet header is sent to the controller instead of an entire data packet. This internal buffering increases the robustness and the utilization of the link between SDN switches and the controller by absorbing temporary burst of packets which may overwhelm the controller. Existing queuing models for an SDN have focused on the switches that immediately sends packets to the controller for decisioning, with no existing models investigating the impact of the internal buffer in SDN software and hardware switches. In this paper, we propose a unified queueing model to characterise the performance of SDN software and hardware switches with the internal buffer. This unified queueing model is an analytical tool for network engineers to predict a delay and loss during SDN deployments in delay and loss sensitive environments. Our results show that a hardware switch achieves up to 80% lower average packet transfer delay and 99% lower packet loss rate at the cost of requiring up to 50% more queue capacity than a software switch. The proposed models are validated with a discrete event simulation, where the error between 0.6% and 2.8% was observed for both average packet transfer delay and average packet loss rate. Moreover, a hardware switch outperforms a software switch with increasing number of hosts per switch suggesting that a hardware switch has better scalability. We use the insights from the model to develop guidelines that help network engineers decide between a software and hardware switch in their SDN deployments.

A Novel Framework for Intrusion Detection Using Distributed Collaboration Detection Scheme in Packet Header Data

A Novel Framework for Intrusion Detection Using Distributed Collaboration Detection Scheme in Packet Header Data

Neuro-fuzzy-based clustering of DDoS attack detection in the network

The detection system developed for wired networks cannot be deployed in wireless networks due to the difference between the two types of networks. The data transmission of the wired network is a standard physical routing. However, the data stream routing of wireless network are based on radio signals with a variety of problems of evolution. The attacker's packet header data are acknowledged with a port number, option field parameters and IP address. The anomalies detection is carried out at a regular interval to monitor the traffic analysed through statistical variance. The change detection detects the statistical variance of the traffic volume. The results obtained from the proposed system are compared with the existing attack detection systems with the propagation delay metric. It shows a reduction of nearly 10% and an improvement of 13% average throughput.

Improved LDSRDV-localized Dynamic Source Routing for Distance Vector Performance in MANET

A considerable amount of research within the field of Quality of Service (QoS) support for distributed environment. In this study, we propose Improved LDSRDV-localized Dynamic Source Routing with aim to improve the Distance Vector Performance in MANET. One of the key issues in providing end-to-end QoS guarantees in packet networks is determining a feasible path that satisfies a number of QoS constraints. Nodes mobility brings flinty challenges to multicast in Mobile Ad hoc Networks (MANETs). To track nodes mobility, flooding messages are widely used for data delivery structure construction and maintenance in many multicast protocols. These periodic flooding messages significantly consume network resources, such as energy and bandwidth and result in network. To release data delivery structure maintenance onus, profited from location based service, a number of stateless location based multicast protocol were proposed, where a destination list is encapsulated into each data packet for data packet orientation. However, due to data packet capability limitation, the way of encapsulating a destination list in each data packet header restricts the protocol scalability. Simulation is performed using network simulator to demonstrate the efficiency of Improved LDSRDV.

Effect of network parameters on neighbor wireless link breaks in GPSR protocol and enhancement using mobility prediction model

The greedy perimeter stateless routing (GPSR) protocol is a well-known position-based routing protocol. Data packet routing in position-based routing protocols uses the neighbors' geographical position information, which is stored in the sender's neighbors list, and the destination's position information stored in the routing data packet header field to route the packet from source to destination. In the GPSR protocol, the sender routes the packets to a neighboring node, whose geographical position is the closest to the destination of all the sender's neighbors. However, the selected neighbor is closer to the edge of the maximum of the sender's transmission range and thus has a higher likelihood of leaving the transmission range of the sender. Thus, the wireless link between the sender node and its routing neighboring node may break down, which degrades the performance of the routing protocol. In this study, we identify and study the effects of network parameters (beacon packet interval-time, node speed, network density, transmission range, and network area size) on wireless link breakage, identified as the neighbor wireless link break (NWLB) problem, in the GPSR protocol. To overcome the NWLB problem, we propose a neighbor wireless link break prediction (NWLBP) model. The NWLBP model predicts the accurate position of a routing neighboring node in the sender's neighbors list before routing the data packet to that neighbor. The simulation results show the ability of the NWLBP model to overcome the observed problem and to improve the overall performance of the GPSR protocol.

Scalable location guide overlay multicast in mobile ad hoc networks using tree partition scheme

ABSTRACTNodes mobility brings flinty challenges to multicast in Mobile ad hoc Networks (MANETs). To track nodes mobility, flooding messages are widely used for data delivery structure construction and maintenance in many multicast protocols. These periodic flooding messages significantly consume network resources, such as energy and bandwidth, and result in network collisions. To release data delivery structure maintenance onus, profited from GPS location service, a number of stateless location based multicast protocol were proposed, where a destination list is encapsulated into each data packet for data packet orientation. However, due to data packet capability limitation, the way of encapsulating a destination list in each data packet header restricts the protocol scalability. To solve the scalability issue of multicast protocols, we propose a Scalable Location Guide Overlay Multicast (SLGOM) for MANETs. Analysis and simulation results show that SLGOM achieves high performance in large multicast group and significantly improves the scalability of stateless multicast with respect to group size. Copyright © 2010 John Wiley & Sons, Ltd.

Security in ad hoc networks and pervasive computing

Security in <i>ad hoc</i> networks and pervasive computing

Home Telemedicine: Encryption is Not Enough

Implantable medical devices and home monitors make use of wireless radio communication for both therapeutic functions and remote monitoring of patients' vital signs. While our past work showed that lack of cryptographic protection results in disclosure of private medical data and manipulation of therapies (Halperin et al., IEEE S&amp;P, 2008) our present work shows that even using encryption is insufficient to protect the confidentiality of patient telemetry. Our experiment analyzes the security of data traffic patterns of two sets of real medical telemetry: a corpus from PhysioNet (an online biomedical research database) and a network trace of a live disaster drill using Harvard's CodeBlue medical sensor network (Chen et al., DCOSS, 2008). Our work shows that even if a wireless medical device uses encryption, patient data can leak to unauthorized parties who need not be near the patient. Our measurements show that data packet timing information and headers distinguish the types of medical and monitoring devices even if traditional cryptographic mechanisms are used. Furthermore, the highly repetitive nature of medical data, such as ECG or respiration signals, leads to additional privacy vulnerabilities that cannot be easily mitigated by means of encryption without significant modification. Data compression technology further exposes encrypted telemetry to cryptanalysis. The information leakage of telemetry could facilitate unauthorized tracking of a patient because an ECG is known to uniquely identify a person in a predetermined group (Biel et al., IEEE I&amp;M, 2002). Moreover, our study shows that data packet padding, encryption, authentication, and other common defenses against security threats require significant energy, storage, and computation that impose on the already scarce battery and space resources. Two of our experiments show how to automatically recover data from encrypted telemetry using Bayesian classifiers. In one experiment, we encrypted an ECG signal. By observing only the length of the digitally encrypted data, we were able to reconstruct sufficient information about the original ECG data that we determined the patient's heart rate. Using similar techniques, we recovered a leaked respiration signal that visually matches the original signal. Our findings show the weakness of using common cryptographic techniques on highly periodic and often compressed medical telemetry. Our work further discusses techniques to mitigate these security and privacy risks in wireless medical telemetry systems. However, all known techniques require extra energy, computation, and bandwidth from the medical device. The lesson learned is that encryption is not enough to protect the privacy of medical telemetry, and that reasonable assurance for security and privacy will require an energy budget. Future design of medical devices will have to make difficult tradeoffs between battery life versus security and privacy. This work was supported by NSF grants CNS-0627529, CNS-0716386, and CNS-0831244.

Passive Online Detection of 802.11 Traffic Using Sequential Hypothesis Testing with TCP ACK-Pairs

In this paper, we propose two online algorithms to detect 802.11 traffic from packet-header data collected passively at a monitoring point. These algorithms have a number of applications in real-time wireless LAN management, for instance, in detecting unauthorized access points and detecting/predicting performance degradations. Both algorithms use sequential hypothesis tests and exploit fundamental properties of the 802.11 CSMA/CA MAC protocol and the half-duplex nature of wireless channels. They differ in that one requires training sets, while the other does not. We have built a system for online wireless traffic detection using these algorithms and deployed it at a university gateway router. Extensive experiments have demonstrated the effectiveness of our approach: the algorithm that requires training provides rapid detection and is extremely accurate (the detection is mostly within 10 seconds, with very low false-positive and false-negative ratios), the algorithm that does not require training detects 60 percent to 76 percent of the wireless hosts without any false positives, and both algorithms are lightweight, with computation and storage overhead well within the capability of commodity equipment.

Image-Based Anomaly Detection Technique: Algorithm, Implementation and Effectiveness

The frequent and large-scale network attacks have led to an increased need for developing techniques for analyzing network traffic. This paper presents NetViewer, a network measurement approach that can simultaneously detect, identify, and visualize attacks and anomalous traffic in real-time by passively monitoring packet headers. We propose to represent samples of network packet header data as frames or images. With such a formulation, a series of samples can be seen as a sequence of frames or video, revealing certain kinds of attacks to the human eye. This enables techniques from image processing and video compression to be applied to the packet header data to reveal interesting properties of traffic. We show that "scene change analysis" can reveal sudden changes in traffic behavior or anomalies. We also show that "motion prediction" techniques can be employed to understand the patterns of some of the attacks. We show that it may be feasible to represent multiple pieces of data as different colors of an image enabling a uniform treatment of multidimensional packet header data. We compare the effectiveness of NetViewer with classical detection theory-based Neyman-Pearson test

Explicit multicasting for mobile ad hoc networks

In this paper we propose an explicit multicast routing protocol for mobile ad hoc networks (MANETs). Explicit multicasting differs from common approaches by listing destination addresses in data packet headers. Using the explicit destination information, the multicast routing protocol can avoid the overhead of employing its own route construction and maintenance mechanisms by taking advantage of unicast routing table. Our protocol - termed Differential Destination Multicast (DDM) - is an explicit multicast routing protocol specifically designed for MANET environment. Unlike other MANET multicasting protocols, instead of distributing membership control throughout the network, DDM concentrates this authority at the data sources (i.e. senders) thereby giving sources knowledge of group membership. In addition, differentially-encoded, variable-length destination headers are inserted in data packets which are used in combination with unicast routing tables to forward multicast packets towards multicast receivers. Instead of requiring that multicast forwarding state to be stored in all participating nodes, this approach also provides the option of stateless multicasting. Each node independently has the choice of caching forwarding state or having its upstream neighbor to insert this state into self-routed data packets, or some combination thereof. The protocol is best suited for use with small multicast groups operating in dynamic MANET environment.

Coupon TFRC: a mechanism being friendly to both TCP and continuous stream

With the appearance of continuous stream services, such as video and audio on the Internet, which do not use end-to-end congestion control mechanism, the Internet is facing the danger of “congestion collapse”. It has been recognized that TCP is not suitable as a congestion control mechanism for continuous stream. Many mechanisms have been proposed to provide end-to-end congestion control for continuous stream. However, all these mechanisms proposed so far have a common drawback: They pay little attention to the characteristics that distinguish a continuous stream from a non-real-time service. After identification of the special requirements of a continuous stream, a new mechanism is proposed in this paper that is friendly to both continuous stream and TCP by modifying TFRC [Equation based congestion control for unicast application, SIGCOMM 2000] and RED [IEEE/ACM Trans. Network. 1 (4) (1993) 397]. With this mechanism, continuous service can trade smaller loss probability with sending rate that the continuous service should own. This mechanism guarantees the TCP friendliness by using a terminal protocol similar to TFRC. The relation between the actually consumed bandwidth and the available bandwidth by TCP is indicated with a stamp carried in each data packet header. Network provides different QoS according to this stamp. Simulation results show that this mechanism can promote the QoS of a continuous stream but without hurting TCP.