IP Address Research Articles

Measuring and classifying IP usage scenarios: a continuous neural trees approach

Understanding user behavior via IP addresses is a crucial measure towards numerous pragmatic IP-based applications, including online content delivery, fraud prevention, marketing intelligence, and others. While profiling IP addresses through methods like IP geolocation and anomaly detection has been thoroughly studied, the function of an IP address—e.g., whether it pertains to a private enterprise network or a home broadband—remains underexplored. In this work, we initiate the first attempt to address the IP usage scenario classification problem. We collect data consisting of IP addresses from four large-scale regions. A novel continuous neural tree-based ensemble model is proposed to learn IP assignment rules and complex feature interactions. We conduct extensive experiments to evaluate our model in terms of classification accuracy and generalizability. Our results demonstrate that the proposed model is capable of efficiently uncovering significant higher-order feature interactions that enhance IP usage scenario classification, while also possessing the ability to generalize from the source region to the target one.

Initial Design of IoT-Based Earthquake Intensitymeter Using MMI Scale with Smartphone Display

This paper discusses the initial design of an earthquake intensitymeter measuring instrument using the IoT-based MMI scale. This research is motivated by the lack of instrumentation technology applied to the community for earthquake mitigation, which is related to the geographical location of Indonesia in earthquake-prone areas. The existing earthquake intensitymeter instrument still has shortcomings in terms of hardware and data acquisition. So this paper tries to provide a solution to the problem by using an MPU6050 accelerometer sensor that can measure PGA values simultaneously on three axes. This system is also equipped with an IoT-based intensitymeter for data acquisition that can be accessed via smartphone. In this system, the MPU6050 sensor is tested for characteristics first using the UC Berkeley Seismological Myshake application, and the average linearity test data obtained is 0.994. The data acquisition system is webserver-based so that every bit of data read every second will be sent to the webserver. The webserver is also equipped with a real-time measurement graph, and every smartphone device can access the data using the IP address of the webserver.

Developing a method for the detection and identification of rootstock blockchain network nodes

The object of this study is the protocol for detecting nodes in the Rootstock blockchain network and crawling tools. Node discovery protocols are the foundation of any decentralized peer-to-peer network. In blockchain systems, full nodes store and maintain a complete copy of all transactions performed in the network. However, they do not store information about all other nodes, such as their IDs or IP addresses. Each node usually maintains an incomplete list of nodes to which it connects to exchange blockchain data. In decentralized networks, nodes join and leave the network and their IP addresses can change, making it impractical to maintain a complete, up-to-date list of all nodes. Therefore, the only way to get a list of all nodes in the network is to poll each node sequentially. The developed method involves sending specially formed messages to nodes to obtain their neighbors. The graph search algorithm is used to traverse all received neighboring nodes. This allows one to consistently detect all network nodes. Identifying the desired sequence of messages requires a preliminary analysis of the node software RSKj in the part of node discovery protocol. Effectiveness of the proposed method was verified using the developed software and an experiment in the main network. 6 verification nodes were deployed in different physical locations and at different times. All test nodes were detected in less than 10 minutes. The developed method found 222 nodes that have 209 unique IP addresses. Results of this study show how to perform analysis of node discovery protocol. They provide the means to obtain information about the available nodes of the Rootstock blockchain system, enabling the analysis of both the blockchain network in general and individual node

Cloud computing security: a taxonomy, threat detection and mitigation techniques

ABSTRACT Cloud Computing is a rapidly growing emerging technology in the IT environment. Internet-based computing provides services like sharing resources e.g. network, storage, applications and software through the Internet. Cloud customers can access these services according to their need and pay only for those services which they utilize. Almost every industrial sector like banking, retail, education, healthcare, manufacturing and businesses is adopting cloud techniques within their enterprise either privately or in sharing with other enterprises. However, many security issues must be resolved because they are a barrier in adopting this fast-growing technology. This paper reviews various threats on cloud computing like distributed denial of service attack, spoofing attacks (e.g. ARP Spoofing, IP Spoofing, DNS Spoofing), man-in-the middle attack, data loss, data breach, reused IP address attack, malicious insiders, insecure interfaces & APIs etc. These security issues prevent users from adopting cloud services. This study presents various detection and prevention methods to address cloud security concerns. The effectiveness of each strategy is then analyzed based on its attributes, benefits and drawbacks. Deep learning and machine learning algorithms produce more precise findings for both known and unidentified attack patterns.

Chasing spammers: Using the Internet protocol address for detection

AbstractThe proliferation of reviews evaluating different services on social networks and online platforms and their importance in consumer decision‐making has led some unscrupulous individuals to take advantage of the anonymity offered by the Internet to manipulate these reviews and influence customers' decisions. The main objectives of this study are: (1) to test whether spammers usually perform their misdemeanors from the same IP address; (2) to explore whether there are differences between stated sexes in this regard; (3) to detect the main motivations for posting fraudulent reviews; and (4) to determine the motivations for doing so from the same IP address. These objectives were achieved by means of a quasi‐experiment with a sample of 7,192,487 users, and a qualitative investigation in which 37 users who had falsified information were interviewed. The results show that spammers who tend to fake their identity do so from the same IP address and that they tend to be male. Four types of motivation are presented: revenge, entertainment, opportunity for profit, and self‐esteem; as well as a further three to explain the use of the same IP: convenience, limited resources, and complacency.

The characteristics and operations of "online pharmacies" investigated in relation to medicines popularised during the coronavirus pandemic: a cross-sectional study.

Aim: To explore the characteristics and operations of online pharmacies in relation to medications that gained widespread popularity and increased demand during the COVID-19 pandemic. Furthermore, to assess and compare practices between legitimate and "rogue" online pharmacies. Methods: Fifteen COVID-19-pandemic-related medications were investigated through a UK-based online search. We systematically assessed the credibility of 116 retrieved online pharmacies using the factors: operational location, range of medicines sold, prescription requirements for Prescription Only Medicines (POMs), information exchange, payment/delivery, user-friendliness, legitimacy. Descriptive analysis was conducted, and legitimacy status (legitimate vs. illegitimate/rogue) was tested against relevant safety indicators using a chi-square test. Results: Out of 116 "online pharmacies," 55 (47%) were confirmed as "rogue," 47 (41%) were verified as legitimate by the General Pharmaceutical Council (GPhC), and 14 (12%) were verified by other bodies but not by the GPhC. A total of 93 declared their "apparent" physical location of operation on the webpage of which 63 (67.7%, n = 93) declared a location that did not match their actual location according to the online pharmacy's server (through their IP address). All 15 medicines analysed were readily available for purchase. A high percentage of online pharmacies offered POMs to the public (93.1%, n = 116). Only 23 out of the 116 online pharmacies assessed required a prescription for providing POMs, with only four of these verified as legitimate by the GPhC register, while most of the legitimate pharmacies (44 out of 47) offered online consultations as an alternative option instead of a prescription. Controlled medicines were offered by 28 online pharmacies 27 of which were deemed as rogue. Rogue online pharmacies were significantly more likely to guarantee refunds for medication, not require prescriptions for POMs, and not require an online consultation to obtain POMs. Discussion: Findings reveal easy access to rogue online pharmacies, posing patient safety risks. We also found legitimate online pharmacies often offer online consultations without requiring prescriptions for POMs, raising concerns about inadequate safety checks. This emphasises the need for improved regulations for both types of online pharmacies, especially during public health crises.

Who's Got My Back? Measuring the Adoption of an Internet-wide BGP RTBH Service

Distributed Denial-of-Service (DDoS) attacks continue to threaten the availability of Internet-based services. While countermeasures exist to decrease the impact of these attacks, not all operators have the resources or knowledge to deploy them. Alternatively, anti-DDoS services such as DDoS clearing houses and blackholing have emerged. Unwanted Traffic Removal Service (UTRS), being one of the oldest community-based anti-DDoS services, has become a global free collaborative service that aims at mitigating major DDoS attacks through the Border Gateway Protocol (BGP). Once the BGP session with UTRS is established, UTRS members can advertise part of the prefixes belonging to their AS to UTRS. UTRS will forward them to all other participants, who, in turn, should start blocking traffic to the advertised IP addresses. In this paper, we develop and evaluate a methodology to automatically detect UTRS participation in the wild. To this end, we deploy a measurement infrastructure and devise a methodology to detect UTRS-based traffic blocking. Using this methodology, we conducted a longitudinal analysis of UTRS participants over ten weeks. Our results show that at any point in time, there were 562 participants, including multihomed, stub, transit, and IXP ASes. Moreover, we surveyed 245 network operators to understand why they would (not) join UTRS. Results show that threat and coping appraisal significantly influence the intention to participate in UTRS.

ADAPT: Attack detection and prevention via deep learning techniques

Cloud computing is a new technology that provides services to customers anywhere, anytime, under varying conditions and managed by a third-party cloud provider. Even though cloud computing has progressed a lot, some attacks still happen. The recent anomalous and signature attacks use clever strategies such as low-rate attacks and attacking as an authenticated user. In this paper, a novel Attack Detection and Prevention (ADAPT) method is proposed to overcome this issue. The proposed system consists of three stages. An Intrusion Detection System is initially used to check whether there is an attack or not by comparing the IP address in the Blacklist IP Database. If an attack occurs, the IP address will be added to the Blacklist IP database and blocked. The second stage uses Bi-directional LSTM and Bi-directional GRU to check the anomalous and signature attack. In the third stage, classified output is sent to reinforcement learning, if any attack occurs the IP address is added to the blacklist IP database otherwise the packets are forwarded to the user. The proposed ADAPT technique achieves a higher accuracy range than existing techniques.

The Design And Implementation Of Computer Network Monitoring And Security System Using Linux Ubuntu Server

One system that can carry out network monitoring is using ntopng tool or application. Linux Ubuntu Server is an open source operating system, this operating system is very good for use as a server because it does not require high hardware specifications and can also be obtained for free because it is open source. Ntopng in carrying out network monitoring is very well applied at SMK S 1 Pembangunan of Bengkulu City, this is because at SMK S 1 Pembangunan of Bengkulu City, the computer network in the computer and visual laboratory is used by students, both for learning and teaching activities as well as the media used by students to fill their free time. When monitoring the network, Ntopng can do this based on the IP address of the device connected to the network

Optimizing Secure Communication in Distributed Corporate Networks through PPTP and IPSec VPN Protocols

In today’s industry, company’s activities are scattered in several locations and need internet for communication purposes. However, it will be dangerous if third-parties have access to their information. One of the solutions for securing information exchange is by using Virtual Private Network (VPN). The VPN protocols that will be used are Point-to-Point Tunneling Protocol (PPTP) with the help of Internet Protocol Security (IPSec). These protocols are simulated in VirtualBox that has been previously installed with two Mikrotik routers and two Windows 7 operating systems. The PPTP and IPSec protocols are configured in both routers through Winbox software. For the computers, the IP addresses are configured along with iPerf software for bandwidth analysis. In this VPN simulation, both computers can communicate with each other and have no problem in accessing the internet. In PPTP’s network, the average bandwidth is 1.293 Mbits/sec. Meanwhile, in PPTP with IPSec’s network, the average bandwidth is 0.853 Mbits/sec. There is a slight difference considering that in PPTP, the data packets are only encapsulated. On the other hand, the data packets in IPSec protocol are both encapsulated and encrypted.

Pengujian High Availability pada Asynchronous DNS Berbasis Restknot menggunakan Algoritma Round Robin

The existence of the Domain Name System (DNS) through the role of the DNS Record, functions to translate domain addresses into IP addresses. High availability is an absolute condition so that the service from the DNS Server is still available and running well. To make this happen, it is necessary to have an asynchronous API on the DNS server and data management on the DNS record. This research designs and implements RESTKnot as an asynchronous API on DNS Server for DNS record management, accompanied by high availability testing using Load Balancing techniques and the Round Robin (RR) algorithm. The test results show that RESTKnot can help the DNS record management process dynamically, where DNS records can be made through the RESTKnot API and RESTKnot CLI, to be sent to the RESTKnot agent and executed by Knot DNS. The test results also show that RESTKnot can realize high availability through a ten-time system access test scenario, where heavy traffic on the first web server can be immediately diverted to the second web server to achieve high availability.

Deep-MAD: Deep learning based multiple attack detection for secure device- to-device communication in FOG environment1

An exponential growth of users demands ubiquitous connectivity, which requires the integration of new technology. Therefore, Device to Device (D2D) communication has been considered a promising technology that utilizes effective and efficient communication. Even though numerous studies have been conducted for establishing secure D2D communication, however, existing techniques face challenges like privacy, security threats, and poor generality. To overcome these issues a novel Deep-MAD model is proposed to preserve data privacy along with its access control in the D2D network and multiple attack detection in a fog environment. A Fully Homomorphic Elliptic Curve Cryptography (FHECC) is introduced to transmit data securely in a D2D network. The data owner uses FHECC algorithm to encrypt the plain text into cipher text before storing it on the fog. Whenever the user requests data from the fog, the fog service provider confirm the user’s access control. Furthermore, the deep learning-based Bi-LSTM is used to differentiate the device as an authorized or unauthorized user. If the IP address is genuine then the inverse FHECC is used to decrypt the data for authorized users. Otherwise, the particular device is blocked and it is sent for further verification for classifying the types of attacks. The effectiveness of the proposed strategy is examined using several parameters, such as computational complexity, scalability, accuracy, and Execution time. The proposed technique improves the overall computational overhead of 31.77, 9.34, and 4.67 better than AKA protocol, lightweight cipher, and FHEEP respectively.

Exploring a novel framework for DoS/DDoS attack detection and simulation in contemporary networks

Currently, the internet serves as the predominant means of communication and is utilized by a vast number of individuals worldwide. Simultaneously, the commercial aspect of the internet is contributing to a rise in susceptibility to cybercrimes, leading to a significant surge in the occurrence of distributed Denial of Service (DDoS) assaults over the last decade. DoS/DDoS assaults primarily target network resources such as network bandwidth, CPU time, memory consumption, web servers, and network switches. Network security is an essential and crucial problem in the modern interconnected society. Numerous studies have been undertaken by multiple researchers thus far in order to identify this attack. However, there is still room for improvement in past investigations. This paper presents a novel approach for detecting and simulating DoS/DDoS attacks in modern networking environments, introducing a new paradigm. It is done in a controlled environment. The primary focus of this work is to simulate an attacker's perspective of a DoS/DDoS attack by repeatedly sending huge SYN flood packets to a specific target or network server using the hping3 tool. On the server side, the proposed attacker detector script continuously monitors incoming network connections on the network server using the netstat command. It identifies potential DoS/DDoS attacks by analyzing the connection count and comparing connections count with an assumed threshold. This experiment results in 61% CPU usage and 7.1% memory consumption while a DDoS attack triggers on the target server. Additionally, the proposed script performs statistical analysis and displays warning messages on the console when suspicious activity is detected on the network server. Wireshark is also utilized in this work to detect anomalous network traffic patterns in order to identify distributed denial-ofservice (DDoS) attacks that are targeting a network server. Additionally, it offers the capability to block the IP address of the attacker if the configuration allows for it. This proposed approach efficiently identifies DDoS activity in real-time network traffic, further helping to improve network security.

Unsafe at any Bandwidth: Towards Understanding Risk Factors for Ransomware in Higher Education

United States higher education institutions host an assortment of services that are accessible via public IP addresses. The wide variety of network services and the important personal and institutional data stored on such services make higher education institutions particularly desirable targets for attackers. This study analyses the vulnerabilities found through Shodan scans on these networks, in conjunction with institutional characteristics data taken from the National Center for Education Statistics (NCES), to examine correlations between an institution’s characteristics and the vulnerabilities found on its networks. By exploring this data, the study aims to bring awareness to the current state of higher education institution network security and determine vulnerability trends between certain institutions. Our analysis reveals that most institutions have many medium impacts but highly exploitable vulnerabilities, with most being on Apache HTTP servers. We also present that the most significant indicators of an institution’s vulnerability are its enrolment and yearly total expenses. We investigate how smaller institutions have lower numbers of vulnerabilities, but their vulnerabilities have the potential for higher impact. We conclude that there is a significant chance of ransomware risk in US higher educational institutions.

Construction of network access Layer security protection System based on zero trust architecture

In order to further solve the problem of weak attack defense existing in the traditional network architecture, improve the shortcomings of network architecture in processing capacity, hardware expansion, security protection and other aspects, and better cope with the security challenges under the new network architecture, this article aims to provide more secure computer information exchange and sharing services for enterprises. A network access layer security protection system based on zero trust architecture is constructed. At the same time, the zero-trust architecture evaluation algorithm based on fuzzy theory is used to construct the security protection model. System tests show that more than 100 hosts on the enterprise access layer network use switches that support SNMP, and the security protection system at the network access layer processes more than 1500 attacks. In addition, malicious IP address changes are effectively prevented and the security protection level is greatly improved.

An FPGA Implementation of Health Monitoring System using IOT

Abstract: The objective of this study is to establish a highly efficient health monitoring system that focuses on key parameters such as heart rate and temperature. To achieve this, the proposed system utilizes FPGA technology for rapid information processing. Health data, collected through a Pulse sensor and Temperature sensor, is transmitted using an ADC. The system continuously monitors the heart rate and temperature of the patient's body. For instance, the heart rate is measured using a Pulse sensor, while the Temperature sensor detects the body temperature. The encoded serial data is then transmitted through a transmitting module, which is connected to a patient's location. The receiver unit can be an LCD display at the patient's place, or it can be a laptop, desktop, or mobile phone connected to the internet. The receiver can be either a doctor or a person close to the patient. A transmitter unit near the patient sends the data through an FPGA and a Wi-Fi module, which is connected to it, receives and updates the data on a server. The data is continuously displayed on a user interface visible on a PC or laptop using the IP address. This allows doctors or responsible individuals to observe and monitor multiple patients simultaneously. The system also continuously monitors the patient's data, displaying it near the patient and updating it on the server. By using the IP address of a specific patient, doctors can easily assess the patient's condition. The receiver, an LCD display at the patient's location, and another connected device (laptop, desktop, or mobile phone) constantly update and display the data. The system enables remote monitoring and real-time observation by doctors or caregivers. The research highlights the accessibility of FPGA-based design resources

Designing A Computer Network Monitoring System With Sms Notifications Using The Dude

One system that can perform network monitoring with SMS notifications is using The Dude. This network monitoring system with SMS Notification aims to make network admins aware of network conditions wherever they are. In monitoring the network the dude can do based on the ip address entered, the dude is open source, which is one of the software or tools built into Mikrotik, in the process of installing the dude does not require large storage space. In monitoring the network the dude will display a green indicator, which is on and red, which is off, to monitor the network the dude does it based on the IP Address per each device connected to the network. The Dude can perform network monitoring on the SMA N 6 Bengkulu Selatan computer network in the form of notification of devices on or off. The results of the monitoring will be sent in the form of notifications to the admin cellphone in the form of SMS, in sending SMS notifications, the dude takes +/- 2 minutes, the time for sending SMS notifications is calculated based on the condition of the device on or off until the notification is received or received on the cellphone.

Implementation of Snort as a Wireless Network Security Detection Tool Using Linux Ubuntu

Implementation of snort as a wireless network security detection tool using linux ubuntu by adding a server that is used to observe activities on a wireless network, if there is an activity that is considered dangerous by the client, the information will be stored in the snort log and database. The web-based front-end uses BASE (Basic Analysis and Security Engine) which can be accessed through a browser with the url : IPaddressServer/base/. The information provided is related to attacks detected by snort that have been stored in the database. The information is in the form of source and destination IP addresses, the type of attack that occurred. Based on the tests carried out, it was found that the implementation of snort as a wireless network security detection tool using linux ubuntu can help detect attacks that occur on the network and provide information related to these attacks.

RETROFITTING OUTDATED PYRANOMETER FOR IoT INTEGRATION TOWARDS A CIRCULAR ECONOMY MODEL

An innovative way of applying the circular economy concept in the obsolete research equipment domain is by repairing and upgrading critical subcomponents of the initial equipment, for reuse purposes. Thus, a large percentage of environmental waste is reduced, resulting from the whole process of manufacturing a brand new modern one, along with the implied purchasing costs, while serving its intended purpose simultaneously. The whole re-engineering process produces increased overall cost efficiency, by massively reducing the raw material requirements, the electrical energy consumption for design and manufacture, and the resulting waste material. In this respect, the article addresses the inherent issues in retrofitting an old model analog signal pyranometer, designed in the ‘90s. The upgrade initiative aims to massively increase the digital processing speed, the quality, and the quantity of the data acquisition, while also providing an integrated local storage solution and wireless access through a designated IP address using a web interface, for data interrogation in real-time. All these are done at low costs, with market-available materials, to avoid any high expenses related to acquiring new ones.

CYBERSECURITY: RESEARCH ON METHODS FOR DETECTING DDOS ATTACKS

This article describes the problem of DDoS attacks, analyzing their nature and consequences. The paper covers common DDoS attack types, such as SYN flood, ICMP flood, UDP flood. Existing methods for detecting attacks from literature are reviewed, including machine learning approaches, including artificial neural networks, support vector machines and decision trees. The paper introduces a decision tree-based machine learning model for the detection of DDoS attacks. The model is trained and tested on a publicly available dataset. The dataset consists of 1,04,345 rows of data, where every row includes 23 features, such as source IP, destination IP, port number, number of bytes transferred from the switch port, etc. A similar set of characteristics can be obtained on a real network hardware using simple calculations, which makes it possible to approximate the model evaluation to real operating conditions. SYN flood, ICMP flood and UDP flood attack types are present in the data, as well as legitimate traffic. To avoid overfitting, only some columns were used, and columns such as IP addresses were discarded. The field “label” in each row of the dataset contains either 0 or 1 where 0 corresponds to legitimate traffic and 1 to malicious one. The problem of DDoS attack detection is therefore formally reduced to the task of binary classification of each row from the dataset. The constructed model achieves an average classification accuracy of 0.94 with a standard deviation at the level of 0.06 in detecting the above mentioned types of attacks. To objectively assess the effectiveness of the model and avoid distortion of the results, stratified 5-fold cross-validation was used. The developed model can be applied in the real world network hardware to filter malicious packets or as a tool for warning the administrator about an attack. This research advances cybersecurity by enhancing DDoS attack detection.