High-speed Network Environment Research Articles

Supporting Differentiated Streaming Services in Heterogeneous Vehicle-to-Everything Networks.

Advancements in assisted driving technologies are expected to enable future passengers to use a wide range of multimedia applications in electric vehicles (EVs). To address the bandwidth demands for high-resolution and immersive videos during peak traffic, this study introduces a bandwidth-management algorithm to support differentiated streaming services in heterogeneous vehicle-to-everything (V2X) networks. By leveraging cellular 6G base stations, along with Cell-Free (CF) Massive Multi-Input Multi-Output (mMIMO) Wi-Fi 7 access points, the algorithm aims to provide a high-coverage, high-speed, and low-interference V2X network environment. Additionally, Li-Fi technology is employed to supply extra bandwidth to vehicles with limited connectivity via V2V communication. Importantly, the study addresses the urgency and prioritization of different applications to ensure the smooth execution of emergency applications and introduces a pre-downloading mechanism specifically for non-real-time applications. Through simulations, the algorithm's effectiveness in meeting EV users' bandwidth needs for various multimedia streaming applications is demonstrated. During peak-bandwidth-demand periods, users experienced an average increase in bandwidth of 47%. Furthermore, bandwidth utilization across the V2X landscape is significantly improved.

Identity-based proxy blind signature scheme on lattice in high-speed network environment

The methods of network attacks are becoming more and more diverse In high-speed networks, and protecting private data is a key issue for users’ security. Proxy blind signature technology combines proxy and blind signature technology to achieve signature transitivity and message confidentiality. However, current signature schemes will not be secure in quantum environments. Meanwhile, the certificate storage of the existing scheme is relatively complicated. Therefore, to avoid the need for certificates and resist quantum attacks, this paper proposes an anti-quantum identity-based proxy blind signature (ID-Proxy-BS) scheme on lattice. This ID-Proxy-BS scheme improves the efficiency of signature through Gaussian distribution and sampling techniques. Security analysis shows that the scheme satisfies correctness, efficiency, blindness, and unforgeability.

RT-SAD: Real-Time Sketch-Based Adaptive DDoS Detection for ISP Network

With the great changes in network scale and network topology, the difficulty of DDoS attack detection increases significantly. Most of the methods proposed in the past rarely considered the real-time, adaptive ability, and other practical issues in the real-world network attack detection environment. In this paper, we proposed a real-time adaptive DDoS attack detection method RT-SAD, based on the response to the external network when attacked. We designed a feature extraction method based on sketch and an adaptive updating algorithm, which makes the method suitable for the high-speed network environment. Experiment results show that our method can detect DDoS attacks using sampled Netflowunder high-speed network environment, with good real-time performance, low resource consumption, and high detection accuracy.

Design and implementation of OLT switching function in 40/10G TDM-PON experimental system

Abstract The access network is developing towards large capacity, wide-coverage, and low delay, which puts forward higher requirements for network structure and data exchange performance of optical access network equipment. In this paper, we have designed a high-speed optical network device with 40/10G TDM-PON. To effectively solve the problem of network switching capability in high-speed data transmission, we propose a low delay large capacity switching algorithm, which minimizes the network switching delay. We model the network by integer linear programming and simulate the network based on OMNeT++. The simulation results show that the algorithm can effectively solve the problem of network switching delay in the high-speed network environment.

Effective detection of mobile malware behavior based on explainable deep neural network

The rapid growth of the number of new mobile malware variants has posed a severe threat to user’s property and privacy. Recent studies show that deep neural networks can detect malicious traffic with high accuracy. However, a deep neural network works like a black box in the sense that its structure doesn’t give any insight on how it works. To overcome this drawback, we propose a method to extract rules from a deep neural network and then use the extracted rules to detect malicious network traffic. Specifically, for a trained deep neural network, we first construct one input-hidden tree per each hidden layer to represent the rules extracted between the input of the neural network and the output of that hidden layer. Then we construct one hidden-output tree to represent the rules extracted between the outputs of all hidden layers and the output of the neural network. Finally, these trees are merged to form one rule tree using the outputs of the hidden layers as a bridge. We have performed extensive experiments to verify the effectiveness of our method in terms of accuracy, precision, recall and F-Measure metrics by comparing it with other state-of-the-art methods. Experimental results show that our method achieves high accuracy using the packet size of only the first nine packets as a feature, which also gives good interpretability on how the deep neural network performs to detect malicious traffic. Besides, we design an online detection system based on FPGA to provide online detection in a high-speed network environment using rule tree, which reduces the difficulty of embedding a deep neural network into FPGA.

A Two-Tier Collection and Processing Scheme for Fog-Based Mobile Crowdsensing in the Internet of Vehicles

In view of the rapid development of the Internet of Vehicles (IoV) and wireless communication technology, intelligent transportation systems play an important role in improving urban road safety, promoting the behavioral interaction between users and networks, improving the service quality, and controlling the network cost. Based on the universality and real-time nature of the IoV, data collectors can cooperate with users to sense and collect relevant data within the driving range of vehicles. To achieve this goal, this article proposes a two-tier sensing scheme around the optimization of the sensing mechanism and data processing. In the routing layer, we build a weighted graph model based on vehicle fog, and we propose a new routing strategy to maximize each vehicle’s utilization. We consider that the sensing information collected by multiple vehicles could be repetitive, which would lead to many unnecessary communication flows in the network. Therefore, in the data processing layer, we consider resource consumption in the whole fog, assign different tasks to the sensing vehicles, and filter similar information on the relay nodes of the routing paths to reduce the waste of resources in IoV. Finally, we compare and analyze our two-tier scheme with related approaches, and the results show that our scheme has higher link utilization and lower resource consumption for a high-speed mobile network environment in IoV.

FBIA: A Fog-Based Identity Authentication Scheme for Privacy Preservation in Internet of Vehicles

In recent years, the Internet of vehicles (IoV) has become an indispensable part of wireless communication. To protect users' privacy and communication security, an increasing number of scholars have focused on studying the safety of the IoV. However, due to the characteristics of the IoV, the problem of privacy protection and communication security has not been sufficiently studied and remains open in the IoV; thus, it is worthwhile for us to further explore and study the precise and dynamic safety certification in high-speed driving environments. In our study, we divide the IoV into several fogs to reduce the burden on the traffic control center and propose a new security authentication scheme with the vehicle's identity based on the security elliptic curve. The fog-based identity authentication (FBIA) scheme consists of two layers: the security authentication layer for vehicles outside the fog and the security monitoring layer for the rest of the vehicles. We propose two-way authentication based on the vehicle's identity in the security authentication layer and a deep learning scheme in the security monitoring layer to conduct real-time security in the IoV. Finally, we compare and analyze our FBIA scheme with related approaches, and the results show that the FBIA scheme has higher authentication accuracy and better adaptability to a high-speed mobile network environment in the IoV.

Fingerprinting Network Entities Based on Traffic Analysis in High-Speed Network Environment

For intrusion detection, it is increasingly important to detect the suspicious entities and potential threats. In this paper, we introduce the identification technologies of network entities to detect the potential intruders. However, traditional entities identification technologies based on the MAC address, IP address, or other explicit identifiers can be deactivated if the identifier is hidden or tampered. Meanwhile, the existing fingerprinting technology is also restricted by its limited performance and excessive time lapse. In order to realize entities identification in high-speed network environment, PFQ kernel module and Storm are used for high-speed packet capture and online traffic analysis, respectively. On this basis, a novel device fingerprinting technology based on runtime environment analysis is proposed, which employs logistic regression to implement online identification with a sliding window mechanism, reaching a recognition accuracy of 77.03% over a 60-minute period. In order to realize cross-device user identification, Web access records, domain names in DNS responses, and HTTP User-Agent information are extracted to constitute user behavioral fingerprints for online identification with Multinomial Naive Bayes model. When the minimum effective feature dimension is set to 9, it takes only 5 minutes to reach an accuracy of 79.51%. Performance test results show that the proposed methods can support over 10Gbps traffic capture and online analysis, and the system architecture is justified in practice because of its practicability and extensibility.

An Effective Conversation-Based Botnet Detection Method

A botnet is one of the most grievous threats to network security since it can evolve into many attacks, such as Denial-of-Service (DoS), spam, and phishing. However, current detection methods are inefficient to identify unknown botnet. The high-speed network environment makes botnet detection more difficult. To solve these problems, we improve the progress of packet processing technologies such as New Application Programming Interface (NAPI) and zero copy and propose an efficient quasi-real-time intrusion detection system. Our work detects botnet using supervised machine learning approach under the high-speed network environment. Our contributions are summarized as follows: (1) Build a detection framework using PF_RING for sniffing and processing network traces to extract flow features dynamically. (2) Use random forest model to extract promising conversation features. (3) Analyze the performance of different classification algorithms. The proposed method is demonstrated by well-known CTU13 dataset and nonmalicious applications. The experimental results show our conversation-based detection approach can identify botnet with higher accuracy and lower false positive rate than flow-based approach.

Discovering abnormal behaviors via HTTP header fields measurement

SummaryIn recent years, more and more intrusion detection systems and firewalls have been used to detect and block malicious applications or unknown protocols in order to enhance the security of systems. Therefore, some malicious applications begin to shape themselves as common ones to escape malicious protocol detection. Being an important protocol for many Internet services, hypertext transfer protocol (HTTP) is responsible for nearly 10% of the traffic volume on the Internet. Therefore, many malicious applications pretend their traffic to be HTTP protocol to go into hiding their malicious behaviors. In the paper, we study the problem of discovering these abnormal behaviors in HTTP protocol traffic. We find that the characteristics of many abnormal behaviors are performed in the header fields of their shaping HTTP such as Tor and malicious web crawlers, and the information of HTTP header fields of HTTP traffic generated by normal application is also discussed. And then, a method based on the measurement of HTTP header fields proposed three patterns that make them specific to detect abnormal behaviors of shaping HTTP protocol. The experimental results indicate that the proposed method is effective for abnormal behaviors by shaping to be HTTP on large‐scale traffic of one Internet service provider. The experimental results also show that the proposed method could be extended to large‐scale and high‐speed network environment for detecting abnormal behaviors of shaping HTTP protocol. Copyright © 2016 John Wiley & Sons, Ltd.

Uniform free-space cell shaping using diffractive-type beam diffusers for optical wireless links.

This Letter presents the design of a diffractive beam diffuser to homogenize the irradiance within optical free-space cells generated from multimode fibers in an indoor high-speed network environment. Native speckled beams with a Gaussian envelope are transformed into circular flat-top distributions to guarantee a constant signal-to-noise ratio at the wireless receiving stage. Design considerations followed by the device fabrication and test results are given, showing its ability to shape narrow line-of-sight optical wireless cells operating at the Gbps range.

For Deformation Web Attacks based on Feature Recognition IPS Intrusion Prevention Technology Research

The paper analyzes the characteristics of various types of Web application system security vulnerabilities. Based on the deformation of Web attack , according to the principle of Web application vulnerabilities occur, attack methods and targets, the attack characteristics is extended, Proposed a structural model of IPS intrusion prevention based on the feature recognition. The experiments showed that the feature recognition-based Intrusion Prevention System can ensure higher performance in high-speed attack traffic network environment.

시그니쳐 계층 구조에 기반한 HTTP 트래픽 분석 시스템의 처리 속도 향상

최근 웹 기반의 다양한 응용과 서비스의 제공으로 인해 HTTP 트래픽의 양이 급격하게 증가하고 있다. 따라서 안정적인 네트워크 관리를 위해서 HTTP 트래픽에 대한 분석이 필수적으로 요구된다. HTTP 트래픽을 다양한 관점에서 분석하기 위해서는 다양한 시그니쳐 기반 분석 방법 중에 페이로드 시그니쳐 기반 분석 방법이 효과적이다. 하지만 트래픽 분류 있어서 페이로드 시그니쳐 기반 방법은 고속 링크의 대용량 트래픽을 실시간으로 처리하는 과정에서 헤더 정보 및 통계 정보 이용 방법론에 비해 상대적으로 높은 부하를 발생시키며 처리 속도가 느린 단점을 갖는다. 따라서 본 논문에서는 HTTP 시그니쳐의 계층 구조에 기반하여 HTTP 트래픽을 다양하게 분류할 수 있는 방법론을 제시한다. 또한 계층 구조의 특징을 반영하여 패턴 매칭의 처리 속도 향상을 위한 방법을 제안한다. 제안하는 방법을 학내망의 실제 트래픽에 적용하여 평가한 결과, Aho-Corasick 알고리즘 보다 더 빠른 처리속도를 보일 수 있었다. Currently, HTTP traffic has been developed rapidly due to appearance of various applications and services based web. Accordingly, HTTP Traffic classification is necessary to effective network management. Among the various signature-based method, Payload signature-based classification method is effective to analyze various aspects of HTTP traffic. However, the payload signature-based method has a significant drawback in high-speed network environment due to the slow processing speed than other classification methods such as header, statistic signature-based. Therefore, we proposed various classification method of HTTP Traffic based HTTP signatures of hierarchical structure and to improve pattern matching speed reflect the hierarchical structure features. The proposed method achieved more performance than aho-corasick to applying real campus network traffic.

A study of fairness among heterogeneous TCP variants over 10 Gbps high-speed optical networks

Several high-speed TCP variants are adopted by end users and therefore, heterogeneous congestion control has become the characteristic of newly emerging high-speed optical networks. In contrast to homogeneous TCP flows, fairness among heterogeneous TCP flows now depends on router parameters such as queue management scheme and buffer size. To the best of our knowledge, this is the first study of fairness performance among heterogeneous TCP variants over a 10Gbps high-speed optical network environment. Our evaluation scenarios for heterogeneous TCP flows consist of TCP variants with substantial presence in current Internet; therefore, TCP-SACK, CUBIC TCP (CUBIC) and HighSpeed TCP (HSTCP) compete for bottleneck bandwidth. Experimental results for fairness are presented for different queue management schemes, such as Drop-tail, Random Early Detection (RED), CHOose and Keep for responsive flows CHOose and Kill for unresponsive flows (CHOKe), and Approximate Fair Dropping (AFD), with varying degree of buffer sizes. We observe heterogeneous TCP flows induce more unfairness than homogeneous ones. Active queue management (AQM) schemes, RED, CHOKe, and AFD, improve fairness for large buffer sizes as compared to Drop-tail, whereas AQM schemes lose the fairness advantage for small buffer sizes. This study provides preliminary results for fairness challenges to deploy all-optical routers with limited buffer size.

TCP-Adaptive in High Speed Long Distance Networks

With the development of high performance computing and increasing of network bandwidth, more and more applications require fast data transfer over high-speed long-distance networks. Research shows that the standard TCP Reno cannot fulfill the requirement of fast transfer of massive data due to its conservative congestion control mechanism. Some works have been proposed to improve the TCP throughput performance using more aggressive window increasing tactics and obtain substantial achievements. However, they cannot be strictly proved to be comprehensively suitable for high-speed complex network environments. In this paper, we propose TCP-Adaptive, an adaptive congestion control algorithm adjusting the increasing congestion window dynamically. The algorithm improves logarithmic detection procedure for available bandwidth in the flow path by distinguishing the first detection in congestion avoidance and retransmission timeout. On the other hand, an adaptive control algorithm is proposed to achieve better performance in high-speed long-distance networks. The algorithm uses round trip time (RTT) variations to predict the congestion trends to update the increments of congestion window. Simulations verify the property of TCP-Adaptive and show satisfying performance in throughput, RTT fairness aspects over high-speed long-distance networks. Especially in sporadic loss environment, TCP-Adaptive shows a significant adaptability with the variations of link quality

For Deformation Web Attacks Based on Feature Recognition IPS Intrusion Prevention Technology Research

The paper analyzes the characteristics of various types of Web application system security vulnerabilities. Based on the deformation of Web attack , according to the principle of Web application vulnerabilities occur, attack methods and targets, the attack characteristics is extended, Proposed a structural model of IPS intrusion prevention based on the feature recognition. The experiments showed that the feature recognition-based Intrusion Prevention System can ensure higher performance in high-speed attack traffic network environment.

TDD-based mobile communication solutions for high-speed railway scenarios

Mobile communication solutions for highspeed railway scenarios aim at providing seamless coverage, high system capacity and a high data rate for end users, which in turn face the challenges of Doppler frequency shift, penetration loss, mobility management and system capacity planning. Because the scarcity of frequency resources and increasing wireless broadband requirements have become very serious problems worldwide, increasing attention has been focused on time-division duplexing based technology, on which we focus in this article. Time-division synchronous code-division multiple access based and time-division Long Term Evolution based solutions are introduced with appropriate technology analysis. The experimental results of TD-SCDMA-based solutions in the Shanghai maglev high-speed network environment and the simulation results of TD-LTE-based solutions are presented. Finally, to improve performance, we discuss an enhanced solution based on mobile relays with performance evaluation, which is considered as a more comprehensive solution for high-speed railway scenarios.

응용 트래픽의 지역성을 이용한 페이로드 시그니쳐 기반 트래픽 분석 시스템의 성능 향상

응용 레벨 트래픽 분류는 안정적인 네트워크 운영과 자원 관리를 위해서 필수적으로 요구된다. 트래픽분류에 있어서 페이로드 시그니쳐 기반 응용 레벨 트래픽 분류 방법은 고속 링크의 트래픽을 실시간으로 처리하는 과정에서 헤더 정보 및 통계 정보 이용 방법론에 비해 상대적으로 높은 부하를 발생시키며 처리 속도가 느린 단점을 갖는다. 본 논문에서는 페이로드 시그니쳐 기반 트래픽 분류 시스템의 처리 속도를 향상 위하여 응용 트래픽의 지역성을 이용한 서버 IP, Port캐쉬 기반 트래픽 분석 시스템을 제안한다. 제안하는 방법을 학내 망의 실제 트래픽에 적용하여 최대 10배 이상의 처리 속도 향상과 10% 이상의 플로우 분석률을 향상 시킬 수 있었다. The traffic classification is a preliminary and essential step for stable network service provision and efficient network resource management. However, the payload signature-based method has a significant drawback in high-speed network environment that the processing speed is much slower than other method such as header-based and statistical methods. In this paper, We propose the server IP, Port cache-based traffic classification method using application traffic locality to improve the processing speed of traffic classification. The suggested method achieved about 10 folds improvement in processing speed and 10% improvement in completeness over the payload-based classification system.

Dynamically Real-time Anomaly Detection Algorithm with Immune Negative Selection

Network anomaly detection has become the promising aspect of intrusion detection. The existing anomaly detection models depict the detection profiles with a static way, which lack good adaptability and interoperability. Furthermore, the detection rate is low, so they are difficult to be deployed the realtime detection under the high-speed network environment. In this paper, the excellent mechanisms of self-learning and adaptability in the human immune system are referred and a dynamic anomaly detection algorithm with immune negative selection, named as DADAI, is proposed. The concepts and formal definitions of antigen, antibody, and memory cells in the network security domain are given; the dynamic clonal principle of antibody is integrated; the mechanism of immune vaccination is discussed, and the dynamic evolvement formulations of detection profiles are established (including the detection profiles' dynamic generation and extinction, dynamic learning, dynamic transformation, and dynamic self-organization), which will accomplish that the detection profiles dynamically synchronize with the real network environment. Both our theoretical analysis and experimental results show that DADAI is a good solution to network anomaly detection, which increase the veracity and timeliness on anomaly detection problem.

The Realization of the International High-Speed Private Network Based-on HS-TCP Protocol in the Fusion Research

In order to facilitate the exchange and cooperation for the fusion research, we proposed the high-speed special network environment to achieve the design, research of the program and manage the project contracts, schedule, video conference system and data sharing. The article states the network acceleration mechanisms based-on the HS-TCP protocol and proposes a kind of data encryption based-on AES and SSL and describes the framework of the special network. Then we have verified the feasibility and security of the project by the experiment.