IP Identification Research Articles

Efficient traffic-based IoT device identification using a feature selection approach with Lévy flight-based sine chaotic sub-swarm binary honey badger algorithm

Internet of Things (IoT) refers to the various devices connected to the Internet, enabling them to communicate and transmit data with each other. The rapid development of the IoT also brings security and other problems in cyberspace. In this case, device identification is a crucial tool for IoT security issues, which can detect and prevent cyber-attacks. However, device identification has some challenges on IoT traffic datasets, such as large-scale and high-dimensional sparse datasets, features prone to security vulnerabilities, and identification of IP and non-IP devices, which affects the performance of classifiers. Feature selection can be seen as an effective data preprocessing technique in IoT device identification, which may improve the performance of classification and reduce the computational complexity of IoT device identification. In this paper, we propose a traffic-based IoT device identification model using a novel wrapper feature selection approach based on an improved and efficient method, which we call Lévy flight-based sine chaotic sub-swarm binary honey badger algorithm (LS2-BHBA). Specifically, four improved factors are employed in LS2-BHBA to expand the search scope, balance the exploration and exploitation phases, and enhance the search capability. In addition, a binary mechanism is implemented to enhance the suitability of the proposed LS2-BHBA for feature selection in IoT device identification. The experimental results on several real IoT traffic datasets denote that LS2-BHBA can reduce the number of features to 10%, and the classification accuracy can reach 98%, which outperforms some classical and latest comparison algorithms in the feature selection of IoT device identification.

DC-FIPD: Fraudulent IP Identification Method Based on Homology Detection

DC-FIPD: Fraudulent IP Identification Method Based on Homology Detection

How Polynomial Regression Improves DeNATing

The ubiquity of Network Address Translation (NAT) and mobile hotspots that aggregate source IP addresses of connected devices to a single IP address makes it difficult for an observer in the Internet to learn anything about the internal network. The IP Identification header field of Domain Name System requests and the TCP Timestamp (TCP TS) header field of TCP SYN packets are the main features for counting devices in the internal network and association of packets to these devices, also known as DeNATing. This paper introduces a new method that relies on polynomial least-squares curve fitting for DeNATing. Evaluation of our model is performed on multiple real-world datasets containing Windows and Unix devices behind a router using NAT and a mobile hotspot. The proposed method outperforms other state-of-the-art methods for all of the used datasets on all types of devices. Successful DeNATing may help in cybersecurity, anti-fraud, and other use cases.

CRYPTOCURRENCY AS AN INSTRUMENT OF TERRORIST FINANCING

The purpose of the article is to explain the use of cryptocurrency as a terrorist financing tool. This article has emphasized the ways, which terrorists appraise for being a reliable fundraising means and their adoption. Methodology. For the purposes of the study, the methods of scientific abstraction, synthesis, observation, generalization, as well as the method of induction of literature and legal documents were used to determine the features of bitcoin, promoting and preventing its use for terrorism financing. Results. The development of the Internet and electronic devices has radically changed all spheres of human life, including criminal activity. Digitalization has led to the improvement of ordinary crimes and the emergence of new types of crime, which, in principle, cannot exist without special digital electronic devices. Among the first implementers of new technologies were terrorists, who took advantage of digitalization to increase profitability. Thus, terrorists have now significantly increased their attention to cryptocurrency as a digital means of payment, namely Bitcoin. Bitcoin has a number of features that have attracted the attention of criminals as a way to evade responsibility for a crime. In particular, decentralization avoids the need for confirmation by a central authority, and pseudo-anonymity provides a certain level of anonymity. In addition, terrorists are aware that Bitcoin's confidentiality is extremely fragile and needs to be enhanced. The paper analyzes several ways to enhance anonymity, such as software that anonymizes traffic and prevents IP identification, peer-to-peer mixers, centralized mixing services (tumbler), and other approaches. It is worth emphasizing that for the fight against crime, the main issue is the de-anonymization of the Bitcoin owner/user, which allows the identification of the criminal. Currently, law enforcement agencies use direct and indirect de-anonymization, proliferation analysis, quantitative analysis, time analysis, and transactional network analysis, among others, to achieve the above goal, which are discussed in detail in this article. In addition, agencies around the world investigated and uncovered terrorist groups and their financial facilitators. Specifically, on August 13, 2020, the U.S. Department of Justice's Office of Public Affairs announced "the largest cryptocurrency seizure in the context of terrorism in history." To investigate the agenda, the legal documents of those investigations that contain information about the terrorist fund-raising mechanism were examined and analyzed. The legal documents revealed that these investigations used the aforementioned de-anonymization approaches.

Intellectual property rights in research and development collaboration/ contract agreements between research institutions, universities and firms: part 1 — European Union, US

Keywords: research and development contracts, research and development collaborationagreements, intellectual property rights, research organisations, universities
 The practice of regulating intellectualproperty relations in R&D cooperation agreements / R&D contracts between researchinstitutions, universities (academic institutions) and companies in the EU, USA, aswell as in the recommendations of international organizations is studied.It is noted the significant role given in the EU, the USA to the settlement of IP issuesin R&D agreements. It is shown, that the development of model agreements inthe United States is carried out mainly at the university level. In the EU it is significantthe role of the European Commission, national government bodies in the developmentof the agreements.The principal provisions of IP regime in the R&D agreements are noted, which include:identification of Background IP and New IP. Granting Background IP rightsusually on the basis of a non-exclusive royalty license. Consolidation of New IP rightsfor academic institutions. Granting New IP rights on royalty-based licences or paidtransfer of rights.It is noted the importance of possibility of restitution of IP property rights to academicinstitution if the company does not commercialize the granted IP. Also, of the assignmentof IP rights to academic institutions for research and training purposes incases of granting exclusive licenses and transferring property rights.The principles of distribution of intellectual property rights and use of research resultsin R&D agreements are determined, which should be applied in the practice ofconcluding corresponding agreements in Ukraine. Amendments to the Law ofUkraine “On Scientific and Scientific-Technical Activity” are proposed to provide forthe indication of the types of R&D agreements, as well as the principles of using IP inagreements.

Comprehensive Analysis of IoT Malware Evasion Techniques

Malware detection in Internet of Things (IoT) devices is a great challenge, as these devices lack certain characteristics such as homogeneity and security. Malware is malicious software that affects a system as it can steal sensitive information, slow its speed, cause frequent hangs, and disrupt operations. The most common malware types are adware, computer viruses, spyware, trojans, worms, rootkits, key loggers, botnets, and ransomware. Malware detection is critical for a system's security. Many security researchers have studied the IoT malware detection domain. Many studies proposed the static or dynamic analysis on IoT malware detection. This paper presents a survey of IoT malware evasion techniques, reviewing and discussing various researches. Malware uses a few common evasion techniques such as user interaction, environmental awareness, stegosploit, domain and IP identification, code obfuscation, code encryption, timing, and code compression. A comparative analysis was conducted pointing various advantages and disadvantages. This study provides guidelines on IoT malware evasion techniques.

A survey on subjecting electronic product code and non‐ID objects to IP identification

AbstractOver the last decade, both research on the Internet of Things (IoT) and real‐world IoT applications have grown exponentially. The IoT provides us with smarter cities, intelligent homes, and generally more comfortable lives. However, the introduction of these devices has led to several new challenges that must be addressed. One of the critical challenges facing interacting with IoT devices is to address billions of devices (things) around the world, including computers, tablets, smartphones, wearable devices, sensors, and embedded computers, and so on. This article provides a survey on subjecting Electronic Product Code and non‐ID objects to IP identification for IoT devices, including their advantages and disadvantages thereof. Different metrics are here proposed and used for evaluating these methods. In particular, the main methods are evaluated in terms of their: (i) computational overhead, (ii) scalability, (iii) adaptability, (iv) implementation cost, and (v) whether applicable to already ID‐based objects and presented in tabular format. Finally, the article proves that this field of research will still be ongoing, but any new technique must favorably offer the mentioned five evaluative parameters.

HiAuth: Hidden Authentication for Protecting Software Defined Networks

Software defined networking (SDN) enables network function programmability for ease of configuration and maintenance, and also allows network administrators to change traffic rules on the fly. However, denial of service (DoS) attacks pose security challenges on the centralized control plane of SDN. Although the transport layer security (TLS) can help secure the control plane, it is computationally intensive, complex to configure, and not mandatory in OpenFlow protocol. In this paper, we present a lightweight authentication solution, called hidden authentication (HiAuth), to protect the SDN controller by hiding the identities of the forwarding devices into the control packets via efficient bitwise operations. HiAuth is the first to incorporate information hiding techniques into OpenFlow to provide security against DoS attacks. HiAuth exploits the IP identification field of IPv4 and the transaction identification field of OpenFlow in two authentication schemes. The experimental results show that HiAuth can effectively mitigate intruder DoS attacks and provide high undetectability to attackers.

Internet Data Center IP Identification and Connection Relationship Analysis Based on Traffic Connection Behavior Analysis

Internet Data Center IP Identification and Connection Relationship Analysis Based on Traffic Connection Behavior Analysis

Variability in drift ice export from the Arctic Ocean to the North Icelandic Shelf over the last 8000 years: A multi-proxy evaluation

Abstract North Iceland represents a climatically sensitive region, in part, due to its location at the confluence of southward flowing and drift ice-laden polar waters from the Arctic Ocean delivered by the East Greenland Current, and the relatively warm and saline Irminger Current, a northerly flowing branch of the North Atlantic Current. Despite its pivotal location, there is a paucity of high resolution and long-term sea ice records for the region, with some disparities in certain previous investigations. Here, the identification of the biomarker IP 25 as a reliable proxy for drift ice for North Iceland has been confirmed by measuring its abundance in surface sediments from the region and comparison of outcomes with documentary records of sea ice and other proxy data. By analysing IP 25 in a well-dated marine sediment core from the North Icelandic Shelf (NIS) (MD99-2269), we also provide a high resolution (ca. 25 yr) record of drift sea ice for the region and complement this with a lower resolution record (ca. 100 yr) obtained from a second core site, located further east (JR51-GC35). Statistical treatment of equi-spaced time series reveals strong linear correlations between IP 25 and a further drift ice proxy (quartz) in each core. Thus, linear regression analysis between both proxies gave correlation coefficients (R 2 ) of 0.74 and 0.66 for MD99-2269 (25 yr) and JR51-GC35 (100 yr), respectively. Further, the individual proxies were well correlated between the two cores, with R = 0.91 and 0.77 for IP 25 and quartz, respectively. The IP 25 -based sea ice record for MD99-2269, combined with other new biomarker and foraminifera data, and previously published proxy data for primary productivity and sea surface temperature, suggest that the paleoceanographic evolution for the NIS over the last 8 ka can be classified into three main intervals. The early mid Holocene (ca 8–6.2 cal ka BP) was characterized by relatively low or absent drift ice, low primary productivity and relatively high SSTs. During the mid-Holocene (ca 6.2–3.3 cal ka BP), drift ice increased concomitant with decreasing SSTs, although primary productivity was somewhat enhanced during this interval. IP 25 first reached its mean value for the entire record at ca 5 cal ka BP, before increasing, continuously, ca 4.3 cal ka BP, broadly in line with the onset of Neoglaciation as seen in some other proxy records. Further increases in drift ice were evident during the late Holocene (ca 3.3 cal ka BP to present), culminating in maximum sea ice during the Little Ice Age. In addition, the IP 25 record from MD99-2269 shows some positive regime shifts from the general trend, especially at ca 3.8, 2.7, 1.5, 0.7 and 0.4 cal ka BP, that have analogs in some other paleoceanographic reconstructions influenced by the East Greenland Current. The abrupt increases in IP 25 at ca 1.5 and 0.7 cal ka BP are coincident with rapid cooling identified previously in an Icelandic lacustrine temperature record, suggesting significant coupling between the marine and terrestrial systems. The contribution of sea ice to the broader climate system is further evidenced through the identification of statistically significant periodicities (ca 1000 yr and ca 200–230 yr) in the drift ice proxy data that have counterparts in previous studies concerning atmospheric and oceanic variability and solar forcing mechanisms.

AIPISteg: An active IP identification based steganographic method

IP identification (IPID) is an IP header field which is designed to identify a packet in a communication session. The main purpose of IPID is to recover from IP fragmentation. To the best of our knowledge, most existing IPID based information hiding methods assume that the IPID number is a pseudo random number, which is found to be false. In this paper, we propose a steganographic method by exploiting the IPID field while considering the information from the user data field. First, we analyze the IPID distribution of various operating systems. Subsequently, we put forward a simple data embedding method, which is then refined to mimic the ordinary IPID traffic. Experiments are carried out and the results empirically prove that the proposed method is of high undetectability as compared to the existing IPID based steganographic methods.

Prevalence and Associated Risk Factors of Intestinal Parasitic Infection among Under five Children in University of Gondar Hospital, Gondar, Northwest Ethiopia

Background: Intestinal parasitic infection is a serious health problem in developing countries mainly in children, whichleads to child mortality and morbidity. Objective: To assess the prevalence and associated risk factors of intestinal parasitic infection among underfive children in UoG Hospital.Methodology: A cross-sectional study was conducted from May 2015 to June 2015, a total of 277 children were selected by using systematic random sampling technique. Direct wet mount and formol-ether concentration technique was used for identification of IP; also, an interview-based questioner was prepared to assess the socio-demographic status (of parents and children) and associated risk factors of those under five children. Result: A total of 277 children [(148 (53.4%) females and 129 (46.6%) males] aged 1 year to 5 years was examined for intestinal parasitic infections. The overall prevalence of this study was 25 (9.02%) when examined by wet mount and48 (17.3%) when examined by formol-ether concentration technique. Five (1.8 %) children were infected by multiple parasites in concentration technique. Both intestinal helminthes (84%, 81.1%) and protozoan parasites (16%, 18.9%) were detected in microscopic examination with wet mount and formol-ether concentration techniques respectively. Eight species of intestinal parasites were identified. Of those, the predominant were Ascaris lumbricoides (52%, 35.8%), Hymenolepis nana (20%, 24.5%) and cyst of Giardia lamblia (12%, 9.4%) when examined by wet mount and formol-ether concentration techniques respectively. The least prevalent were Strongyloides stercoralis (1.9%). There was statistically observed association for the prevalence of IP with age, hand washing habit of parents and shortening of fingernails habit of parents. Conclusion: The result of this study indicated that helminthic infection is more predominant than protozoan infection. Children who come from parents who had no hand washing habit and had no shortening fingernails habit were more affected by IP; therefore, Personal hygiene of parents of underfive children must be improved.

La interactividad de los dispositivos móviles geolocalizados, una nueva relación entre personas y cosas

Geolocation for interactive mobile devices, a new relationship between people and things. Abstract This paper analyzes mobile ICTs used by young people and the main characteristics of these teams, from a sample of 2000 students of intermediate education. One of the most interesting issue about this technology is the GPS positioning, which is independent of Internet or the IP identification. These technological possibilities has allowed us to make a software design for the interaction between the user and his geographical position, and it also enables automatic information downloading about the place, or other activity associated with a specific position.

Fragmentation Considered Vulnerable

We show that fragmented IPv4 and IPv6 traffic is vulnerable to effective interception and denial-of-service (DoS) attacks by an off-path attacker. Specifically, we demonstrate a weak attacker intercepting more than 80% of the data between peers and causing over 94% loss rate. We show that our attacks are practical through experimental validation on popular industrial and open-source products, with realistic network setups that involve NAT or tunneling and include concurrent legitimate traffic as well as packet losses. The interception attack requires a zombie agent behind the same NAT or tunnel-gateway as the victim destination; the DoS attack only requires a puppet agent, that is, a sandboxed applet or script running in web-browser context. The complexity of our attacks depends on the predictability of the IP Identification (ID) field which is typically implemented as one or multiple counters, as allowed and recommended by the IP specifications. The attacks are much simpler and more efficient for implementations, such as Windows, which use one ID counter for all destinations. Therefore, much of our focus is on presenting effective attacks for implementations, such as Linux, which use per-destination ID counters. We present practical defenses for the attacks presented in this article, the defenses can be deployed on network firewalls without changes to hosts or operating system kernel.

Image Morphing Concept for Secure Transmission of Image Data Contents over Internet

Problem statement: Morphing of images has evolved and become a challenging field in information hiding and data security. The objective of this study is to secure the image data over internet while transmitting using the concept of image morphing Approach: To address this issue, the study proposed the new approach for image data security using the concept of image morphing. The morphing algorithm produces the stego keys. These stego keys are securely transmitted over Internet using TCP/IP. The stego keys are transmitted through TCP/IP’s identification field. The proposed method suggests how to transmit stego keys through identification field of IP. Results: Exterior sample points were manually identified and its inner values were interpolated using a triangular mesh. The complexity of Beier and Neely algorithm is O (n, p, w). Where n is the number of feature lines p is no of pixels in the image w is the amount of computation required for one pair feature line. By our approach the complexity is O (n,k),where n is the number of pixels and k is the number of triangles. Computations required are less, thus effect in increasing the performance of algorithm. The stego keys are identified during morphing process. As complexity reduces the speed of stego keys identification increases. Conclusion: The result showed that the proposed approach is efficient in terms of complexity and speed to generate the morph. The solution proposed for image data security over Internet is highly secure because the keys were transferred through IP identification field. The randomness in the identification field value makes this scheme no detectable.

A framework and source model for design and evaluation of Robust Header Compression

Robust Header Compression (ROHC) is a specification being developed by the Internet Engineering Task Force (IETF) for compressing protocol headers robustly over wireless channels to improve bandwidth efficiency. Traditionally, header compression schemes are designed based on qualitative descriptions of source headers. This is inadequate because qualitative descriptions do not precisely describe the effect of different source and deployment scenarios, and it is difficult to perform optimization using this methodology. In addition, due to the use of qualitative descriptions, most studies on header compression performance do not take into account the tradeoff between performance metrics such as robustness and compression efficiency. In this paper, we present a modeling framework for header compression. For the first time, a source model is developed to study header compression. Modeling the way packets are generated from a source with multiple concurrent flows, the source model captures the real-world behavior of the IP Identification header field. By varying the parameters in the source and channel models of our framework, different source and deployment scenarios can be modeled. We use the framework to define and establish the relationship between performance metrics, offering new perspectives to their current definitions. We then introduce the objective of scheme design and the notion of optimal schemes. Based on this new paradigm, we present a novel way to study the tradeoff dependencies between performance metrics. We demonstrate how a scheme can be designed to optimize tradeoffs based on the desired level of performance.

Deterministic packet marking for max-min flow control

This letter proposes a deterministic packet marking scheme that estimates the maximum link price on a communication path. The proposed scheme is simple and IP-compatible because it uses two-bit explicit congestion notification (ECN) field and IP identification (IPid) field in the standard IP header for the estimation. Through simulations using real IP packet traces, we show that our scheme indeed works as designed with small estimation errors, and thus enables existing max-min flow control algorithms to serve their purpose without the need of separate out-of-band control packets to carry link prices.

Identification of the ‘estrogen-induced protein’ in uterus and brain of untreated immature rats

The appearance of a specific estrogen-induced protein (IP) in the rat uterus [l] represents one of the earliest effects of estrogen on uterine macromolecular synthesis [2]. This effect can be reproducibly demonstrated following in vitro as well as in vivo estrogen treatment (3-S], making IP the most convenient marker protein available for studying the mechanism of action of estrogen in the rat uterus. IP has been routinely detected using a doubleisotope ratio method [6]. This method is convenient, but it cannot yield information on content or rate of synthesis of IP in non-treated organs, or in organs in which IP may be present but not susceptible to induction by estrogen. We have reported initial results, on the time course and age dependence of IP induction [7], using ~uoro~aphy of ~35S]met~on~e-labelled proteins separated by sodium dodecyl sulfate polyac~l~ide gel electrophoresis [S]. We describe here the characterization of IP by partial protease digestion, which enables the identification of IP as a major constitutive protein in uterus,pituitary, hypothalamus and cerebral cortex of immature rats. (A short report of some of these findings was presented [9] .)