IP Information Research Articles

Security analysis of the MAP-T IPv6 transition technology

Abstract In this paper, we focus on one of the most prominent IPv6 transition technologies, namely Mapping of Address and Port using Translation (MAP-T), and we give attention to Mapping of Address and Port with Encapsulation (MAP-E) as well. We emphasize the uniqueness of MAP-T and MAP-E, and we discuss the differences between those two technologies, including their topology, functionality, and security vulnerabilities. We apply a threat modeling technique, Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE), to assess potential vulnerabilities in the MAP-T infrastructure. Furthermore, we build a testbed for MAP-T using the open-source software, Jool, and we conduct testing on the translation process capabilities of Jool and its port allocation per subscriber. Finally, we present various attacking scenarios against the main routers of MAP-T, such as IP address spoofing, information disclosure, and source port exhaustion, and we propose mitigation methods for several attacks.

A Study on the Measuring Methods of Website Security Risk Rate

Traditionally, website security risks are measured using static analysis based on patterns and dynamic analysis by accessing websites with user devices. Recently, similarity hash-based website security risk analysis and machine learning-based website security risk analysis methods have been proposed. In this study, we propose a technique to measure website risk by collecting public information on the Internet. Publicly available DNS information, IP information, and website reputation information were used to measure security risk. Website reputation information includes global traffic rankings, malware distribution history, and HTTP access status. In this study, we collected public information on a total of 2000 websites, including 1000 legitimate domains and 1000 malicious domains, to assess their security risk. We evaluated 11 categories of public information collected by the Korea Internet & Security Agency, an international domain registrar. Through this study, public information about websites can be collected and used to measure website security risk.

Research on the Construction of University Cultural Brand IP Driven by Network Cloud Platform Technology

Abstract Campus culture brand IP, as the soft power in the construction of university brand culture, has become an important material carrier for the inheritance and dissemination of university brand culture. In the cloud platform technology, we are using an information diffusion model to explore the diffusion degree and influence of college culture brand IP information on the network platform. The dissemination process of cultural brand IP information is examined from the point of view of sharing information resources in colleges and universities. Construct a competitive information dissemination system based on the user nodes of online social networks and the interrelationship between users. Promote the dissemination and diffusion of university cultural brand IP information on online social networks using a data-driven approach. The results show that: k value is 0.12, the promotion effect of college culture brand IP is 2.59621e+04, and the relative risk index is 0.354264. Within 0-6 hours, the maximum number of IP views reaches 34,000 times, which indicates that the authority of the college platform and the information diffusion model can improve the diffusion of college culture brand IP.

Characterizing the Bitcoin network topology with Node‐Probe

AbstractIn blockchain networks, topology discovery is a prerequisite when investigating the network characteristics (e.g., performance and robustness), which can provide a deeper comprehension of the behavior of the nodes and topology dynamicity. In this paper, we conduct a longitudinal study on the Bitcoin topology by collecting network snapshots from 2018 to 2022 with Node‐Probe, our topology discovery technique that uses recursive scanning to find all reachable nodes in the Bitcoin network. Using Node‐Probe, we have collected 5‐week‐long snapshots (36‐day‐long snapshots) of the Bitcoin main network and analyzed the network properties, community structure, and topology dynamicity. We confirm that our approach achieves a precision of 99% with a recall of 98% in inferring the topology. Analytical results on community structure show that the Bitcoin network has more communities than what should be expected from a random network. Meanwhile, analytical results on dynamicity indicate that the topology stands firmly on heavy and long‐running nodes. Improving the propagation mechanism using master nodes could improve the propagation delay by proximity compared with the Bitcoin default protocol. Considering a K‐anonymity attack, any transaction from one of the autonomous systems containing only a single Bitcoin node can easily be linked to real users' IP information.

A new framework for APT attack detection based on network traffic

Advanced Persistent Threat (APT) attack detection and monitoring has attracted a lot of attention recently when this type of cyber-attacks is growing in both number and dangerous levels. In this paper, a new APT attack model, which is the combination of three different neural network layers including: Multi-layer Perceptron (MLP), Inference (I), and Graph Convolutional Networks (GCN) is proposed. The new model is named MIG for short. In this model, the MLP layer is in charge of aggregating and extracting properties of the IPs based on flow network in Network traffic, while the Inference layer is responsible for building IP information profiles by grouping and concatenating flow networks generated from the same IP. Finally, the GCN layer is used for analyzing and reconstructing IP features based on the behavior extraction process from IP information records. The APT attacks detection method based on network traffic using this MIG model is new, and has yet been proposed and applied anywhere. The novelty and uniqueness of this method is the combination of many different data mining techniques in order to calculate, extract and represent the relationship and the correlation between APT attack behaviors based on Network traffic. In MIG model, many meaningful anomalous properties and behaviors of APT attacks are synthesized and extracted, which help improve the performance of APT attack detection. The experimental results showed that the proposed method is meaningful in both theory and practice since the MIG model not only improves the ability to correctly detect APT attacks in network traffic but also minimizes false alarms.

Contribution of Journal of Intellectual Property Rights (JIPR) in IPR Research: A View through the Articles Published in the First Decade of Twenty-First Century (2000–2004) — II

This Paper seeks to review the articles published in the Journal of Intellectual Property Rights (JIPR) in the first half of the first decade of the twenty-first century from Volume 5(1) (2000) to Volume 9(6) (2004). During this period, a total of seven post-independent IP legislations were enacted in the country. This Paper reviews the articles published in JIPR year-wise. Paper attempts to identify: (i) total number of issues published; (ii) total number of articles published; (iii) total number of contributions made by the Indian and foreign scholars; (iv) total number of sole and joint publications; (v) publishing style of JIPR; and (vi) area of IP covered in each volume. Dissemination of information is a necessary condition for creation of new knowledge. JIPR through an open-access platform has provided an opportunity to the IP scholars to publish their writings addressing the gaps in the areas of IP. In the end, Paper develops an argument that JIPR has significantly contributed in the development of IP by disseminating IP information and knowledge, and also in creating IP knowledge and awareness.

AN INTEGRATED CARE MODEL BASED ON HOSPITAL AND HOME DURING THE COVID-19 PANDEMIC: TELEHEALTH

Objective: In this study, we aimed to present the details of a successfully implemented telehealth model in a university hospital during the COVID-19 pandemic. Materials and Methods: Istanbul Faculty of Medicine (IFM) is a university hospital where the first confirmed case of COVID-19 in Turkey was detected. In IFM, patients who were diagnosed with COVID-19 and received outpatient or inpatient treatment were followed up by telehealth for 21-28 days after leaving the hospital. The distinguishing features of this service are the provision of remote outpatient clinical monitoring personally by physicians and the use of web-based IP information technologies. Results: Between March 15 and July 1, 2020, 1,042 individuals were followed up at least once, 860 patients for 21 days or more by the 26 physicians providing the telehealth service. A total of 11,736 calls were made by the physicians and 7,342 of those calls were answered and a total of 1,086 calls were made by patients. The median number of calls per patient was 4 (1-23). The median duration of the completed calls was 2.8 min (<1–50 min). During these follow-ups patients were informed about the importance of isolation. Most of the patients expressed their satisfaction with these follow-ups by thanking the calling physician. Conclusion: In a pandemic such as COVID-19, telehealth services may increase adherence to treatment and isolation precautions among patients with diseases that require follow-up without hospitalization after diagnosis. Telehealth will facilitate early recognition of symptoms that may require hospitalization, ensuring these patients receive the care they need. Therefore, this approach should be widely adopted.

Video Surveillance System with Two Channels and Information Transmission

CCTV with recognition is widely used today. They are designed to provide information about the current state of a protected object (process) by collecting, processing, archiving, storing, displaying and analyzing this information. Modern video surveillance systems seek the outside world through the exchange of data via the Internet and allow not so much to observe the object and record the information received, but lately can process it with the use of image recognition algorithms and automatically affect the object management systems.The purpose of this work is to analyze the features of construction and operation of video surveillance systems, to consider various options for data transfer and the implementation of face recognition. Offer advanced CCTV options, such as additional face identification and emergency communications features.New CCTV systems are being built using IP cameras and related software. Smartphones and tablets, laptops, traditional computers and cloud technologies are also widely used as video viewing devices. Video surveillance is an important part of the security system, where IP cameras, recognition features and information transmission modules are now widely used in security systems.It is advisable to use an IP camera when there is constant Wi-Fi, which allows the information to be transmitted continuously. Surveillance cameras and human identification are important in that they can collect and store individuals' faces.The diversity of people's faces is enormous, which is why the system has a low probability of recognition. The requirements for the design and construction of such systems are incredibly high.Considering all the advantages and disadvantages of different types of data transmission modules, it follows that GSM is the best option for transmitting notifications, as its range is almost limitless. And the video stream can be transmitted both via GSM and via Wi-Fi.As a result of the analysis of modern autonomous CCTV systems, a variant of the system with additional functions is proposed. The system has two communication channels for better communication and identification.This system can be used in offices, establishments, and in ordinary homes. The proposed security system is available in facilities where an admission system is required. The system works as follows. For example, the room has a CCTV system and access is available to only three people. Their faces are already recorded in memory. When a person approaches the camera, the system identifies it and aligns it with the already stored information about the persons it has access to. If there is no match, a message is sent via the GSM module about the penetration of the object and a link to the IP address of the embedded server from which the video is broadcast from the premises.

A Forensics Analysis of ICMP Flooded DDoS Attack using WireShark

The usage of Denial of Service (DoS) and Distributed Denial of Service (DDoS) packets by the assailant may change and dependent on various sorts of administrations and protocols. A flooding DDoS attack depends on an immense volume of assault traffic which is named as a Flooding based DDoS packet. Flooding-based DDoS packet endeavors to block the injured individual's system transfer speed with genuine-looking however undesirable IP information. Because of which Legitimate IP packets can’t arrive at the unfortunate casualty in view of the absence of data transfer capacity asset. Internet Control Message Protocol (ICMP) Flood started by sending countless ICMP packets to a remote host. Thus, the deceived framework's assets will be devoured by taking care of the assaulting packets, which in the long run makes the framework be inaccessible by different customers. In this paper, we distinguish of ICMP Flood DDoS packet by utilizing WireShark.

Selective diary of IP information and information management related conferences, meetings, exhibitions and courses

Selective diary of IP information and information management related conferences, meetings, exhibitions and courses

Selective diary of IP information and information management related conferences, meetings, exhibitions and courses

Selective diary of IP information and information management related conferences, meetings, exhibitions and courses

From Feature Engineering and Topics Models to Enhanced Prediction Rates in Phishing Detection

Phishing is a type of fraud attempt in which the attacker, usually by e-mail, pretends to be a trusted person or entity in order to obtain sensitive information from a target. Most recent phishing detection researches have focused on obtaining highly distinctive features from the metadata and text of these e-mails. The obtained attributes are then used to feed classification algorithms in order to determine whether they are phishing or legitimate messages. In this paper, it is proposed an approach based on machine learning to detect phishing e-mail attacks. The methods that compose this approach are performed through a feature engineering process based on natural language processing, lemmatization, topics modeling, improved learning techniques for resampling and cross-validation, and hyperparameters configuration. The first proposed method uses all the features obtained from the Document-Term Matrix (DTM) in the classification algorithms. The second one uses Latent Dirichlet Allocation (LDA) as a operation to deal with the problems of the “curse of dimensionality”, the sparsity, and the text context portion included in the obtained representation. The proposed approach reached marks with an F1-measure of 99.95% success rate using the XGBoost algorithm. It outperforms state-of-the-art phishing detection researches for an accredited data set, in applications based only on the body of the e-mails, without using other e-mail features such as its header, IP information or number of links in the text.

APT attack detection based on flow network analysis techniques using deep learning

Advanced Persistent Threat (APT) attacks are a form of malicious, intentionally and clearly targeted attack. This attack technique is growing in both the number of recorded attacks and the extent of its dangers to organizations, businesses and governments. Therefore, the task of detecting and warning APT attacks in the real system is very necessary today. One of the most effective approaches to APT attack detection is to apply machine learning or deep learning to analyze network traffic. There have been a number of studies and recommendations to analyze network traffic into network flows and then combine with some classification or clustering methods to look for signs of APT attacks. In particular, recent studies often apply machine learning algorithms to spot the present of APT attacks based on network flow. In this paper, a new method based on deep learning to detect APT attacks using network flow is proposed. Accordingly, in our research, network traffic is analyzed into IP-based network flows, then the IP information is reconstructed from flow, and finally deep learning models are used to extract features for detecting APT attack IPs from other IPs. Additionally, a combined deep learning model using Bidirectional Long Short-Term Memory (BiLSTM) and Graph Convolutional Networks (GCN) is introduced. The new detection model is evaluated and compared with some traditional machine learning models, i.e. Multi-layer perceptron (MLP) and single GCN models, in the experiments. Experimental results show that BiLSTM-GCN model has the best performance in all evaluation scores. This not only shows that deep learning application on flow network analysis to detect APT attacks is a good decision but also suggests a new direction for network intrusion detection techniques based on deep learning.

Aiming to be an IP Information Scientist as an IP strategist

Aiming to be an IP Information Scientist as an IP strategist

Introduction of research cases of “Meeting to study the use of AI for IP information research”

Introduction of research cases of “Meeting to study the use of AI for IP information research”

Selective diary of IP information related conferences, meetings, exhibitions and courses

Selective diary of IP information related conferences, meetings, exhibitions and courses

IMPLEMENTATION OF THE WEB BASED PLATFORMS FOR COLLECTING AND FOOTPRINTING IP INFORMATION OF HOSTS IN THE COMPUTER NETWORK AND SYSTEMS

In this paper implementation of the web based platforms for collecting and footprinting IP information of hosts in the computer network and systems is conducted.

Selective diary of IP information related conferences, meetings, exhibitions and courses

Selective diary of IP information related conferences, meetings, exhibitions and courses

Method for Improving Skills and Studying for IP Information Professionals

Method for Improving Skills and Studying for IP Information Professionals

Selective diary of IP information related conferences, meetings, exhibitions and courses

Selective diary of IP information related conferences, meetings, exhibitions and courses