Internet Protocol Packets Research Articles

Ways to Organize and Identify Steganographic Channels in IP Networks

The article is devoted to an overview of network steganography methods that can be used to build hidden message transmission channels in IP networks, as well as methods aimed at identifying such hidden channels. The article gives the concept of a stegocontainer, and provides classification of network steganography methods. The article discusses the following methods of organizing hidden channels: the method of changing the contents of network packet headers, the Transcoding Steganography (TranSteg) method, the delay modulation method, the Lost Audio Packet Steganography (LACK) method, the Retransmission Steganography (RSTEG) method. In the review of the method of changing the contents of network packet headers, the principle of implementing changes in values in some service fields of IP (Internet Protocol) and TCP (Transmission Control Protocol) packet headers, which do not lead to data transmission failure, are considered. In the overview of the TranSteg method, the principle of transcoding the contents of network packets delivering real-time traffic is considered in order to free up space in the packet, which will be used to transmit hidden information. In the review of the delay modulation method, the principles of hidden message encoding are considered, which is carried out by changing the delay value of sending packets in the network. In the review of the LACK method, the mechanism of deliberate retention of RTP packets with an embedded steganographic message is considered. In the review of the RSTEG method, the principle of TCP segment exchange is considered, which provides the possibility of transmitting a steganogram. A number of parameters are given by which it is possible to conclude that there is a hidden channel in the network. The applicability of statistical methods and the methods with a classifier for detecting hidden channels in IP networks is considered. The expediency of implementing statistical methods and methods with a classifier in integration with systems for capturing and analyzing network traffic is indicated.

Machine Learning-based Enhanced Deep Packet Inspection for IP Packet Priority Classification with Differentiated Services Code Point for Advance Network Management

In modern networking, the efficient prioritization and classification of network traffic is paramount to ensure optimal network performance and optimization. This study presents an approach to enhance intelligent packet forwarding priority classification on Differentiated Services Code Point (DSCP), leveraging classifiers from machine learning algorithms for Deep Packet Inspection (DPI). The DSCP resides inside the Differentiated Services (DS) field of the Internet Protocol (IP) packet header in an OSI or TCP/IP model, which prioritizes different types of packets for forwarding to the router based on the attached payload. Similarly, DPI plays a crucial role in network management, enabling the identification of applications, services, and potential threats within the network traffic. In this study, various machine learning models, namely Support Vector Machine (SVM), K-Nearest Neighbors (KNN), Decision Tree, Random Forest, Logistic Regression and ensemble models such as, XGBoost, AdaBoost were used to harness the capabilities of network packet classification based on DSCP. Detailed experimentation was conducted to evaluate their performance. The results show that AdaBoost demonstrated superior performance with an accuracy of around 89.91%, showcasing its ability to adapt the evolving network configurations and conditions while maintaining high classification accuracy on the IP packets. The random forest model also performed well, achieving an accuracy of 89.41%, making it a strong candidate for the DSCP classification in network transmission. This study has the potential to significantly improve how networks manage traffic, prioritize packets, and secure complex and dynamic network environments.

Processing and classifying IP packet data on the Internet based on machine learning

Nowadays, the continuous development of information technology, communication over the Internet is increasing rapidly, and network congestion has become an alarming issue. To develop communication network infrastructure in a large city, a country, or globally, streamlining and controlling network data flow to optimize communication processes and minimize network congestion is crucial and necessary. In this study, the authors analyze and process data according to the delay of Internet Protocol (IP) packets, using machine learning models with the Random Forest (RF) and the Support Vector Machines (SVM) method to classify IP packets. The primary goal of classifying packets by delay is to optimize network performance by prioritizing processing of low-delay packets, ensuring stable and uninterrupted online services such as video streaming and voice calls. Furthermore, it is easy to manage and control packet traffic, hence minimizing network congestion at the router. ® 2024 Journal of Science and Technology - NTTU

Self-Sustainable IoT-Based Remote Sensing Powered by Energy Harvesting Using Stacked Piezoelectric Transducer and Thermoelectric Generator.

We propose a self-powered remote multi-sensing system for traffic sensing which is powered by the collective energy harvested from the mechanical vibration of the road caused by the passing vehicles and from the temperature gradient between the asphalt of the road and the soil underneath. A stacked piezoelectric transducer converts mechanical vibrations into electrical energy and a thermoelectric generator harvests the thermal energy from the thermal gradient. Electrical energy signals from the stacked piezoelectric transducer and the thermoelectric generators are converted into usable DC power to recharge the battery using AC-DC and DC-DC converters working simultaneously. The multi-sensing system comprises an embedded system with a microcontroller that acquires data from the sensors and sends the sensory data to an IoT transceiver which transmits the data as RF packets to an ethernet gateway. The gateway converts the RF packets into Internet Protocol (IP) packets and sends them to a remote server. Laboratory and road-testing results showed over 98% sensory data accuracy with the system functioning solely powered by the energy harvested from the alternative energy sources. The successful maximum transmission distance obtained between the IoT, and the gateway was approximately 1 mile, which is a considerable transmission distance achieved in an urban environment. Successful operation of the self-powered multi-sensing system under both laboratory and road conditions contributes considerably to the fields of energy harvesting and self-powered remote sensing systems. The energy flow chart and efficiency for the steps in the system were found to be mechanical power from vehicles to the energy harvester of 0.25%, stacked PZT transducer efficiency was found to be 37%, and for the TEGs the efficiency is 11%. AC-to-DC and DC-to-DC converters' efficiencies were found to be 90% and 11%. The wireless communication RF transceiver efficiency was found to be 62.5%.

Cuckoo filter based IP packet filtering using M-tree

Internet protocol (IP) packet filtering as a firewall (FW) technology is one of the most widely researched networks functions over the past two decades. IP packet filtering is the process of filtering incoming and outgoing network packets by matching several packet headers fields with thousands of predefined filters known as filter-set. With the development of modern network technologies such as software-defined networking (SDN) and the increase in attacks threatening network security, attention has become focused on IP packet filtering. With the growing size and number of filter-sets, it becomes a challenge to perform IP packet filtering at wire-speed. In this paper, a new method is proposed for IP packet filtering, where two data structures were combined to produce a new data structure suitable for IP packet filtering with high performance and support dynamic access to filters as well as support approximate membership query. Experimental results show that the proposed method has a high throughput of 10.8 mega packets per second (MPpS) with high filtering accuracy and low memory requirements to working on big filter-sets (up to 1 mega filters).

FUZZY MODEL FOR TIME SERIES FORECASTING

Abstract: In 2007, in Kazakhstan, there was a transition of TDM (Time Division Multiplexing) circuit-switched technologies to IP (Internet Protocol) packet technology, which created a modern infrastructure for the ICT (information communication technologies) sphere. The advent of the IoT (Internet of Things) concept has led to the growth of a functioning network at a faster rate. It is currently developing in the direction of a cognitive infocommunication network. Its evolutionary development is characterized by a change in the volume of transmitted information, types of its presentation, methods of transmission and storage, the number of sources and consumers, distribution among users, requirements for timeliness and reliability (quality) [1]. Types of traffic and their structure are changing, therefore data processing becomes more complicated. For this reason, the tasks of analyzing and predicting network traffic remain relevant.
 In this work, the prediction of the measured traffic on a real network is performed. The series under study shows the totality of packets transmitted over the backbone network for each second. Forecasting of a one-dimensional time series is carried out on the basis of fuzzy logic methods. This class of models is well suited for modeling nonlinear systems and time series forecasting. The use of fuzzy sets is based on the ability of fuzzy models to approximate functions, as well as on the readability of rules using linguistic variables. The results of the software algorithm of fuzzy inference models were obtained using the Python environment. Membership functions, predictive graphs were built and their evaluation was carried out. The numerical values of the root mean square error (MSE) are calculated. As a result, it was found that the Cheng fuzzy prediction model has higher forecast accuracy than the Chen forecasting method.

The evolution of wireless mobile networks and the future 5G mobile technology for sustainability.

In this paper, our study focused on the framework of big data-driven and mobile optimization. We will study the significant points of 5G and previous mobile networks, and mostly we have a look at past mobile technologies. After that, we will focus on the future 5G Mobile Technology. We will make an essential reference to the architecture of the 5G Mobile Network. We will see the two OSI levels (network level and Internet Protocol (IP)). The purpose of IP is to ensure adequate control data (in IP header) for proper routing of IP packets belonging to specific application connections or sessions between client and server applications somewhere on the Internet. Also, we mention the primary points of 5G. The device-based architectures, the millimeter-wave, the massive multiple inputs - multiple outputs, the smarter devices, and the manual support for machine-to-machine communication.Finally, in this paper, we will see how much faster will be the future 5G mobile network and services can support. Those services, including experience at speeds of at least 1 Gbps or higher, 10 Gbps data transfer, zero secondary switches, enormous capacity, and reduce power consumption, are the areas of 5G network we see in this study.

Effectively Handling Network Congestion and Load Balancing in Software-Defined Networking

The concept of Software-Defined Networking (SDN) evolves to overcome the drawbacks of the traditional networks with Internet Protocol (I.P.) packets sending and packets handling. The SDN structure is one of the critical advantages of efficiently separating the data plane from the control plane to manage the network configurations and network management. Whenever there are multiple sending devices inside the SDN network, the OpenFlow switches are programmed to handle the limited number of requests for their interface. When the recommendations are exceeded from the specific threshold, the load on the switches also increases. This research article introduces a new approach named LBoBS to handle load balancing by adding the load balancing server to the SDN network. Besides, it is used to maximize SDN’s reliability and efficiency. It also works in coordination with the controller to effectively handle the load balancing policies. The load balancing server is implemented to manage the switches load effectively. Results are evaluated on the NS-3 simulator for packet delivery, bandwidth utilization, latency control, and packet decision ratios on the OpenFlow switches. It has been found that the proposed method improved SDN’s load balancing by 70% compared to the previous state-of-the-art methods.

Migrating From IP to NDN Using Dual-Channel Translation Gateway

The emergence of communication networks has resulted in a system of content-based networks. Therefore, a novel network design called Information-Centric Networking (ICN) promotes the efficient transfer of content objects, whereas Named-Data Networking (NDN) is one of the most promising candidates. While migration from Internet Protocol (IP) to NDN is inevitable, it is prohibitively expensive to replace all routers instantaneously with NDN routers during the transition period. Hence, we propose the dual-channel IP-to-NDN translation gateway to address this problem. The gateway promotes the semantics of the IP protocol to be equal to those of NDN at the network layer by utilizing two unique IP addresses as channels so that it can distinguish an IP packet as either an interest or a data packet. In addition, the proposed gateway uses a name binding mechanism to transmit packets between IP and NDN hosts seamlessly by conducting non-data-payload reading to preserve the privacy of users. Finally, the throughput performance of the dual-channel gateway is examined for two distinct binding strategies, namely static and dynamic prefix-name binding. We analyze the throughput by comparing a throughput-estimation model with an emulation testbed. Especially, we emphasize the relationship between the hit ratio, processing delay, and throughput. According to numerical evaluation, we show that the throughput-estimation model successfully predicts the throughput with an accuracy of about 90% and 85% in static and dynamic prefix-name binding schemes, respectively. Moreover, the results show that an increase in content popularity skewness, α, from 0.7 to 1.5 improved the throughput of the proposed gateway by about 70% when the cache size was 1% of the prefix name count in the static prefix-name binding. Alternatively, the throughput increased ten times when the content popularity skewness increased from 0.7 to 1.5 in the dynamic prefix-name binding.

Integrisani sistem za monitoring i upravljanje Data Centra napajanog iz obnovljivih izvora energije

By constructing bigger and bigger Data Centres (DCs), systems that make them become more complex. That leads to the requirement for the one common monitoring and management system that will monitor and manage functionalities for every individual element of the systems. In this paper, an overview of the systems that are implemented in tier 5 DC-s is given. Also, the roles of the systems are described. Special emphasis is on their own renewable energy sources (RES) and distribution switchgears that connect sources with Power System (PS) and DC. For quality monitoring of individual system elements parameter values and system in general, as well as the whole DC, it's necessary to design a unique database that contains information about defined parameter measurements. To make such database works, it is necessary to implement hardware that contains servers and data storage systems as the foundation on which a virtual platform is built. From all important elements of the systems, information is sent to centralized data base using a computer network. The system elements should contain network cards or controllers which role is to send measured values of the defined parameters to the main building in the format of Internet Protocol (IP) packets. In a suitable format, the data is displayed on the monitoring system. The same data are sent to the management system that manages the elements based on measured parameter values. This paper contains a proposition for the extension of existing monitoring and management system functionalities to the RES and distribution switchgear elements (DSE). Examples of practical usage of one non-commercial monitoring and management system are also given in the paper.

NAT++: An Efficient Micro-NAT Architecture for Solving IP-Spoofing Attacks in a Corporate Network

The Internet Protocol (IP) version 4 (IPv4) has several known vulnerabilities. One of the important vulnerabilities is that the protocol does not validate the correctness of the source address carried in an IP packet. Users with malicious intentions may take advantage of this vulnerability and launch various attacks against a target host or a network. These attacks are popularly known as IP Address Spoofing attacks. One of the classical IP-spoofing attacks that cost several million dollars worldwide is the DNS-amplification attack. Currently, the availability of solutions is limited, proprietary, expensive, and requires expertise. The Internet is subjected to several other forms of amplification attacks happening every day. Even though IP-Spoofing is one of the well-researched areas since 2005, there is no holistic solution available to solve this problem from the gross-root. Also, every solution assumes that the attackers are always from outside networks. In this paper, we provide an efficient and scalable solution to solve the IP-Spoofing problem that arises from malicious or compromised inside hosts. We use a modified form of Network Address Translation (NAT) to build our solution framework. We call our framework as NAT++. The proposed infrastructure is robust, crypto-free, and easy to implement. Our simulation results have shown that the proposed NAT++ infrastructure does not consume more than the resources required by a simple NAT.

Implementing Flash Event Discrimination in IP Traceback using Shark Smell Optimisation Algorithm

Denial of service attack and its variants are the largest ravaging network problems. They are used to cause damage to network by disrupting its services in order to harm a business or organization. Flash event is a network phenomenon that causes surge in normal network flow due to sudden increase in number of network users, To curtail the menace of the Denial of service attack it is pertinent to expose the perpetrator and take appropriate action against it. Internet protocol traceback is a network forensic tool that is used to identify source of an Internet protocol packet. Most of presently available Internet protocol traceback tools that are based on bio-inspired algorithm employ flow-based search method for tracing source of a Denial of service attack without facility to differentiate flash event from the attack. Surge in network due to flash event can mislead such a traceback tool that uses flow-based search. This work present a solution that uses hop-by-hop search with an incorporated discrimination policy implemented by shark smell optimization algorithm to differentiate the attack traffic from other traffics. It was tested on performance and convergence against an existing bio-inspired traceback tool that uses flow-base method and yielded outstanding results in all the tests

A Comparative Analysis of Deep Learning Approaches for Network Intrusion Detection Systems (N-IDSs)

Recently, due to the advance and impressive results of deep learning techniques in the fields of image recognition, natural language processing and speech recognition for various long-standing artificial intelligence (AI) tasks, there has been a great interest in applying towards security tasks too. This article focuses on applying these deep taxonomy techniques to network intrusion detection system (N-IDS) with the aim to enhance the performance in classifying the network connections as either good or bad. To substantiate this to NIDS, this article models network traffic as a time series data, specifically transmission control protocol / internet protocol (TCP/IP) packets in a predefined time-window with a supervised deep learning methods such as recurrent neural network (RNN), identity matrix of initialized values typically termed as identity recurrent neural network (IRNN), long short-term memory (LSTM), clock-work RNN (CWRNN) and gated recurrent unit (GRU), utilizing connection records of KDDCup-99 challenge data set. The main interest is given to evaluate the performance of RNN over newly introduced method such as LSTM and IRNN to alleviate the vanishing and exploding gradient problem in memorizing the long-term dependencies. The efficient network architecture for all deep models is chosen based on comparing the performance of various network topologies and network parameters. The experiments of such chosen efficient configurations of deep models were run up to 1,000 epochs by varying learning-rates between 0.01-05. The observed results of IRNN are relatively close to the performance of LSTM on KDDCup-99 NIDS data set. In addition to KDDCup-99, the effectiveness of deep model architectures are evaluated on refined version of KDDCup-99: NSL-KDD and most recent one, UNSW-NB15 NIDS datasets.

Feasibility of LTE-Based GEO Satellite Mobile Communication Systems to Support VoIP for Handheld Terminals

To facilitate the integration of terrestrial and satellite mobile communication systems in the future, the new generation of satellite mobile communication system should be Long-term evolution (LTE)-based. In LTE, voice is carried by Internet protocol (IP) packets (voice over IP, VoIP). The feasibility of LTE-based Geosynchronous earth orbit (GEO) satellite mobile communication systems for VoIP is discussed. Detailed link budgets are created for typical handheld terminals. The effectiveness of Physical resource block (PRB) bundling and Transmission time interval (TTI) bundling for the capacity improvement of downlink and uplink are evaluated, and further uplink improvement for low level terminals by Narrowband resource block (NRB) scheme is also studied. The analysis results show that the downlink VoIP transmission is mainly power limited, and optimization of PRB or TTI bundling can maximize the capacity. For uplink, only highlevel terminals can support VoIP under the normal LTE frame structure, and TTI bundling and Resource block (RB) block techniques can help the low-level terminals support VoIP transmission.

Towards a standard SDN-based IPsec management framework

The Software-defined Network (SDN) paradigm enables an efficient management of future networks by decoupling the control plane from the data plane. Specifically, network resources (e.g. switches or routers) only perform Internet Protocol (IP) packet forwarding in the data plane based on rules dictated by SDN controllers that implement the control plane.Despite the applicability of SDNs to manage network security is a hot topic, managing security associations using SDNs to protect data plane communications is not well covered in the literature.In this sense, the IP Security (IPsec) protocol is the standard to protect IP traffic at network level and it is foreseen a key element in the forthcoming 5G networks or Software-Defined WAN (SD-WAN). Traditionally, the IPsec operation is assisted by a key management protocol, such as the Internet Key Exchange (IKEv2), responsible for establishing IPsec Security Associations (IPsec SAs). Yet, manual configuration of IKEv2 is still required, which does not scale when the number of IPsec entities is high.In this paper we propose a solution to manage IPsec SAs using SDNs avoiding manual configuration in the network resources and enabling a reduced involvement of network administrators. We present two different cases, IKE case and IKE-less case, balancing between the participation of the SDN controller in the IPsec management and the complexity of the network resource. We provide a comprehensive explanation and deep analysis of the solution, which is undergoing standardization at the Internet Engineering Task Force (IETF), describing the interfaces, the operation and security aspects. Finally, we include a simple but significative performance analysis of both cases and a proof-of-concept implementation of the proposal.

Experience-Centric Mobile Video Scheduling Through Machine Learning

Providing a high quality video streaming experience in a mobile data network via the ubiquitous HTTP Adaptive Streaming (HAS) protocol is challenging. This is largely because HAS traffic arrives as regular Internet Protocol (IP) packets, indistinguishable from those of other data services. This paper presents real-time network-based Machine Learning (ML) classifiers incurring low overhead and capable of (a) detecting the service type of different flows including HAS, and (b)detecting the player status for users with HAS flows. We utilize random forests , an ensemble classifier, relying only upon standard unencrypted packet headers. By applying the ML classifier outputs to derive scheduling metrics, we show how existing LTE base-station schedulers can improve video Quality-of-Experience (QoE) while incurring minimal overhead. For a simulated LTE cellular network, we present quantitative performance results that include misclassification errors. Our classification and scheduling framework is shown to provide an improved video QoE with tolerable impact on other non-video best effort services. These design insights can be applied to optimize video delivery in current and future wireless networks.

Analysis of Impact of Differentiated Services (DiffServ) on the Quality of Services (QoS) Parameters of Major Services of Internet

Objectives: Differentiated Services are implemented by marking in the Internet Protocol (IP) packet header and treat them differently on the basis of the requirements of the services to which a packet belongs. Objective of this study is to determine the impact of Differentiated Services on the different parameters of Quality of Services (QoS) of major services of the Internet. This study aims to investigate the impact of Differentiated Services on Quality of Services (QoS) of different services of internet. Method: In order to determine the impact of the Differentiated Services on the Quality of Services parameters of the different services like Electronic-Mail, web browsing, IP telephony are selected for assessing the impact on Response time, waiting time, end to end delays and jitter. For this purpose, network simulator is used. Findings: It is observed that Differentiated Services is very successful for the implementation of Quality of Services of the Internet for various services of the Internet. It is observed that Differentiated Services has substantial impact on the response time, waiting time, end to end delays, packet delays and jitter. These are the major parameters to measure the Quality of Service of different services of the Internet. Application: This finding would be helpful to design the comprehensive Quality of Services framework in future and would be helpful for appropriate decisions for the researcher and technology development organization to make future Internet services to operate at acceptable level.

Detecting IP Based Attack On Cloud Server Using Passive IP Traceback

Abstract In computer network security, IP address spoofing plays a major role in the creation of Internet Protocol (IP) packets with a fake or forged source IP address and this may lead to major attacks to cloud centre. When the identities of user information are forged by spoofing or masquerade as another computing system. Whether the basic protocol for sending data in the Internet communication are based on the Internet Protocol (“IP”). In network communication header of each IP packet consist of source and destination address of the packet. The source address contains where the packet was sent origin address. In that IP spoofing can be performed by forging the original header from sender it act like packet is sent from origin with different address, an attacker can make it appear that the packet was sent by a different machine. So that the IP Spoofing attack can be placed to further attacks comes into place of impersonating system. This can avoided by a novel solution, named Passive IP Trace back (PIT), to avoid the challenges in operation. To capture the origins of IP spoofing traffic is difficult to locate. As long as the real locations of spoofing are not identified, they cannot be determined from launching further attacks. Identifying the origins of spoofing traffic can help build a reputation system for network place, which would be helpful to push the corresponding ISPs to verify IP source address.

Evaluation of Recurrent Neural Network and its Variants for Intrusion Detection System (IDS)

This article describes how sequential data modeling is a relevant task in Cybersecurity. Sequences are attributed temporal characteristics either explicitly or implicitly. Recurrent neural networks (RNNs) are a subset of artificial neural networks (ANNs) which have appeared as a powerful, principle approach to learn dynamic temporal behaviors in an arbitrary length of large-scale sequence data. Furthermore, stacked recurrent neural networks (S-RNNs) have the potential to learn complex temporal behaviors quickly, including sparse representations. To leverage this, the authors model network traffic as a time series, particularly transmission control protocol / internet protocol (TCP/IP) packets in a predefined time range with a supervised learning method, using millions of known good and bad network connections. To find out the best architecture, the authors complete a comprehensive review of various RNN architectures with its network parameters and network structures. Ideally, as a test bed, they use the existing benchmark Defense Advanced Research Projects Agency / Knowledge Discovery and Data Mining (DARPA) / (KDD) Cup ‘99' intrusion detection (ID) contest data set to show the efficacy of these various RNN architectures. All the experiments of deep learning architectures are run up to 1000 epochs with a learning rate in the range [0.01-0.5] on a GPU-enabled TensorFlow and experiments of traditional machine learning algorithms are done using Scikit-learn. Experiments of families of RNN architecture achieved a low false positive rate in comparison to the traditional machine learning classifiers. The primary reason is that RNN architectures are able to store information for long-term dependencies over time-lags and to adjust with successive connection sequence information. In addition, the effectiveness of RNN architectures are shown for the UNSW-NB15 data set.

Improving the Reliability of Optimised Link State Routing in a Smart Grid Neighbour Area Network based Wireless Mesh Network Using Multiple Metrics

Reliable communication is the backbone of advanced metering infrastructure (AMI). Within the AMI, the neighbourhood area network (NAN) transports a multitude of traffic, each with unique requirements. In order to deliver an acceptable level of reliability and latency, the underlying network, such as the wireless mesh network(WMN), must provide or guarantee the quality-of-service (QoS) level required by the respective application traffic. Existing WMN routing protocols, such as optimised link state routing (OLSR), typically utilise a single metric and do not consider the requirements of individual traffic; hence, packets are delivered on a best-effort basis. This paper presents a QoS-aware WMN routing technique that employs multiple metrics in OLSR optimal path selection for AMI applications. The problems arising from this approach are non deterministic polynomial time (NP)-complete in nature, which were solved through the combined use of the analytical hierarchy process (AHP) algorithm and pruning techniques. For smart meters transmitting Internet Protocol (IP) packets of varying sizes at different intervals, the proposed technique considers the constraints of NAN and the applications’ traffic characteristics. The technique was developed by combining multiple OLSR path selection metrics with the AHP algorithminns-2. Compared with the conventional link metric in OLSR, the results show improvements of about 23% and 45% in latency and Packet Delivery Ratio (PDR), respectively, in a 25-node grid NAN.