IP Networks Research Articles

Detecting IoT Devices in the Internet

Distributed Denial-of-Service (DDoS) attacks launched from compromised Internet-of-Things (IoT) devices have shown how vulnerable the Internet is to large-scale DDoS attacks. To understand the risks of these attacks requires learning about these IoT devices: where are they? how many are there? how are they changing? This paper describes three new methods to find IoT devices on the Internet: server IP addresses in traffic, server names in DNS queries, and manufacturer information in TLS certificates. Our primary methods (IP addresses and DNS names) use knowledge of servers run by the manufacturers of these devices. Our third method uses TLS certificates obtained by active scanning. We have applied our algorithms to a number of observations. With our IP-based algorithm, we report detections from a university campus over 4 months and from traffic transiting an IXP over 10 days. We apply our DNS-based algorithm to traffic from 8 root DNS servers from 2013 to 2018 to study AS-level IoT deployment. We find substantial growth (about $3.5\times $ ) in AS penetration for 23 types of IoT devices and modest increase in device type density for ASes detected with these device types (at most 2 device types in 80% of these ASes in 2018). DNS also shows substantial growth in IoT deployment in residential households from 2013 to 2017. Our certificate-based algorithm finds 254k IP cameras and network video recorders from 199 countries around the world.

E2BaSeP: Efficient Bayes Based Security Protocol Against ARP Spoofing Attacks in SDN Architectures

Virtual networks, just like classical IP networks, usually face many external threats such as ARP spoofing attacks. These attacks come from Address Resolution Protocol (ARP) vulnerabilities. Indeed, the ARP protocol can allow a virtual machine to be identified by one or more IP-MAC pairs, thus facilitating users’ impersonation and forged IP-MAC pair insertion into the victims’ ARP caches. This type of attack is the beginning of more dangerous attacks such as man-in-the-middle and denial-of-service. Several solutions based on SDN (Software-Defined Network) technology, known for their suitable adaptation to large-scale networks, have been proposed. These solutions use a global ARP cache built into the controller which contains the virtual machines’ IP-MAC pairs, as attacker detection knowledge. The main drawbacks of these methods are the collection and unsecured storage of IP-MAC pairs into the global ARP cache and failure to consider IP address reallocation cases, as well as users’ connection and reconnection scenarios in the attacker detection process. To remedy these shortcomings, we propose an Efficient Bayes Based Security Protocol (E2BaSeP) which detects attackers using a Bayes-based algorithm. This solution works in both dynamically and statically addressing networks. Simulation results show that the E2BaSeP protocol provides effective protection for ARP caches and performs better than those observed in the literature.

Performance Evaluation of 2-Wavelength Cognitive Wireless Network for V2R and V2V Communication

In this paper, cognitive wireless network for V2R and V2V communication is introduced to exchange and share road sensing and state information between the vehicle and vehicle and roadside server system. In special, two-wavelengh wireless cognitive network method is developed and implemented to improve the network performance over the conventional single wireless network. In the system, 920MHz band is used as basic connection control link to transmit user ID, SSID, key, authentication, network IP address, etc., while 2.4GHz or 5.6GHz band is used as data link to transmit road state information. By combining those wireless links, both long distance and highspeed data transmission can be attained at the same time. The prototype system of road state information system is constructed to evaluate the network performance with various network and environmental conditions.

Automatic Port Scanner

In a computer network, an attack is an attempt to destroy or steal unauthorized information or make use of information as an asset. One of the attacks is a reconnaissance attack considered as the first step of a computer attack. This type of attack is mostly done by a black hat, an expert in the programmer, by scanning the internal network devices and gather vulnerability information. In this paper, shows the identification of open ports and services through the network and available IP on the network are possible to attack.

Graph theoretical approach for automated IP lifecycle management in telco networks

SummaryIP address management (IPAM) systems are commonly used in the telecommunication industry to serve resource management for large‐scaled IP networks. In resource management, IPAM provides network operators a live IP lifecycle support with an easier use on IP inventory while providing the scaling and high performance. Throughout the management of IP lifecycle, having up‐to‐date topology information plays a key role because of the rapidly changing usage of the IP addresses. Furthermore, if the usage information which corresponds to data taken from the real topology for a specific block does not match with the information in planned state, there arises an anomaly situation. And if this anomaly is not taken under control, especially for the large‐scaled networks, it causes a considerable increase in the operational cost (OPEX) of the internet service providers (ISPs). Thus, keeping track of this resource and checking the anomaly cases make a smooth functioning process through the lifecycle of an IP block in telecom applications. However, the techniques used in traditional IPAMs are mostly not covering track of IP usage. For this purpose, we propose an attribute‐based IP management module (KIP), which consists of three engines by covering the three active states of the IP lifecycle. In this way, KIP serves efficient IP management with minimum traversal time, anomaly rate, and planning time. Compared to previous methods, our method has addressed three additional challenges that significantly impact an effective IP lifecycle management by regarding device‐specific information, such as connectivity, anomaly situation, and planning.

Blockchain technology in Named Data Networks: A detailed survey

With massive new applications and online services, the future design of the Internet will have new requirements and implications, such as compatible mobility, scalability, reliability and security. The Named Data Networking (NDN) is the most promising future internet architecture paradigm which focuses on content driven communication. Unlike traditional IP networks, named content-based data networks (NDNs) can quickly retrieve and deliver content. Blockchain technology has been widely used for decentralized payments, asset management, healthcare and cloud computing etc. Blockchain provides a decentralized and distributed solution to maintain consistent and reliable records in unreliable networks without the need of a centralized authority. However, blockchain technology over IP has still some serious problems such as lack of efficiency for hierarchical access. The use of blockchain technology over NDN has solved these problems providing a decentralized system and simplifying the architecture. In this paper, we present a detailed and comprehensive survey on the use of blockchain technology in NDN for the very first time. Finally, some research challenges and key issues have been discussed.

A New Bit Repair Fast Reroute Mechanism for Smart Sensors IoT Network Infrastructure.

Today’s IP networks are experiencing a high increase in used and connected Internet of Things (IoT) devices and related deployed critical services. This puts increased demands on the reliability of underlayer transport networks. Therefore, modern networks must meet specific qualitative and quantitative parameters to satisfy customer service demands in line with the most common requirements of network fault tolerance and minimal packet loss. After a router or link failure within the transport network, the network convergence process begins. This process can take an unpredictable amount of time, usually depending on the size, the design of the network and the routing protocol used. Several solutions have been developed to address these issues, where one of which is the group of so-called Fast ReRoute (FRR) mechanisms. A general feature of these mechanisms is the fact that the resilience to network connectivity failures is addressed by calculating a pre-prepared alternative path. The path serves as a backup in the event of a network failure. This paper presents a new Bit Repair (B-REP) FRR mechanism that uses a special BIER header field (Bit-String) to explicitly indicate an alternative path used to route the packet. B-REP calculates an alternative path in advance as a majority of existing FRR solutions. The advantage of B-REP is the ability to define an alternative hop-by-hop path with full repair coverage throughout the network, where, unlike other solutions, we propose the use of a standardized solution for this purpose. The area of the B-REP application is communication networks working on the principle of packet switching, which use some link-state routing protocol. Therefore, B-REP can be successfully used in the IoT solutions especially in the field of ensuring communication from sensors in order to guarantee a minimum packet loss during data transmission.

IOT Supported Security Considerations for Network

The current IP and other networks such as Power Smart Grids are fast evolving, thus resulting in diverse connectivity methodologies. This has led to the emergence of "the Internet of Things” (IoT) methodologywhose goal is to transform the current IP and related networks to Device-to-Device (D-2-D) basis. It will seamlessly interconnect the globe via intelligent devices and sensors of varying types, this resulting in voluminousgeneration and exchange of data in excess of 20 billion Internet-connected objects and sensors (things) by 2022.The resultant structure will benefit mankind by helping us make tough decisions as well as be provisioned ofbeneficial services. In this paper, we overview both IoT enabled network architecture as well as security forassociated objects and devices. We commence with a description of a generalized IoT enabled network's security architecture as well as how the various elements constituting them interact. We then describe an approachthat allows the protection of both constrained and unconstrained IoT devices through robust encryption as wellas authentication so that both can equally leverage from the same security framework, but still maintaining lowcomputational loads, by avoiding excessive computational operations.

An Incrementally Deployable IP-Compatible-Information-Centric Networking Hierarchical Cache System

The major advantage of information-centric networking (ICN) lies in in-network caching. Ubiquitous cache nodes reduce the user’s download latency of content and the drain of network bandwidth, which enables efficient content distribution. Due to the huge cost of updating an entire network infrastructure, it is realistic for ICN to be integrated into an IP network, which poses new challenges to design a cache system and corresponding content router. In this paper, we firstly observed that the behavior pattern of data requests based on a name resolution system (NRS) makes an ICN cache system implicitly form a hierarchical and nested structure. We propose a complete design and an analytical model to characterize an uncooperative hierarchical ICN caching system compatible with IP. Secondly, to facilitate the incremental deployment of an ICN cache system in an IP network, we designed and implemented a cache-supported router with multi-terabyte cache capabilities. Finally, the simulation and measurement results show the accuracy of proposed analytical model, the significant gains on hit ratio, and the access latency of the hierarchical ICN cache system compared with a flat cache system based on naming routing, as well as the high performance of the implemented ICN router.

Effective and efficient top-k query processing over incomplete data streams

Nowadays, efficient and effective stream processing has become increasingly important in many real-world applications such as sensor data monitoring, network intrusion detection, IP network traffic analysis, and so on. In practice, stream data often encounter the problem of having some data attributes missing, due to reasons such as packet losses, network congestion/failure, and so on. In such a scenario, it is rather important, yet challenging, to accurately and efficiently monitor top-k objects over incomplete data stream, which may potentially indicate some dangerous and critical security events (e.g., fire, network intrusion, or denial-of-service attack). In this paper, we formally define the problem of top-k query over incomplete data stream (Topk-iDS), which continuously detects top-k objects with the highest ranking scores over an incomplete data stream. Due to unique characteristics such as incompleteness and stream processing, we propose a cost-model-based data imputation approach, design effective pruning strategies to reduce the Topk-iDS search space, and carefully devise dynamically updated data synopses to facilitate Topk-iDS query processing. We also propose an efficient algorithm to perform the data imputation and incremental Topk-iDS computation at the same time. Finally, through extensive experiments, we evaluate the efficiency and effectiveness of our proposed Topk-iDS query answering approach over both real and synthetic data sets..

Integrating IP Mobility Management Protocols and MANET: A Survey

The Mobile ad hoc Network (MANET) is a collection of mobile devices that forms a self-created, self-administered, and self-organized network. It is an infrastructureless network that does not require an existing infrastructure to operate. MANET suits scenarios where a temporary network is needed, such as emergency rescue, the military field, and disaster areas. MANET is an isolated network, and communication is restricted to the participating nodes’ transmission coverage. In order to increase its connectivity and its application scope, however, MANET requires integration with other networks, forming a hybrid MANET. The integration of MANET and IP networks raises many challenges and issues. Mobility management is one of the main challenges. Traditional mobility management protocols provide seamless mobility in a single hop infrastructure network. Consequently, mobile nodes can maintain their global connectivity without interrupting the ongoing sessions. Mobility management becomes more challenging in a network that relies on multi-hop communication, such as MANET. This paper presents a survey of the use of mobility management systems when integrating MANET with the internet, with the objective of serving as a handy reference in this field of research. It presents, analyzes, and discusses existing mobility management solutions for integrated MANET networks. It also investigates their shortcomings and provides a comparative study of the surveyed proposals.

Dynamic Security Metrics for Software-Defined Network-based Moving Target Defense

We propose a suite of dynamic security metrics that timely, dynamically, and adaptively assess the effectiveness of the software-defined network (SDN)-based moving target defense (MTD) techniques. The security metrics are developed to measure the dynamics of a network and a host state's information (e.g., IP address, port, software stacks, vulnerabilities, or network topology) introduced by various types of MTD techniques shuffling them. The key aspect of our proposed metrics is to capture variability that keeps track of changing patterns of the network and the host states upon every MTD triggering event. In this work, we propose the following security metrics capturing the variability based on the changes made by the MTD: (1) Network and host address-based metrics measuring variability of the network and host addresses based on a degree of uncertainty and unpredictability on the assigned IP address to the hosts in a network; (2) Attack path-based metrics measuring variability of attack paths using graphical models estimated based on the network state transitions from one topology to another topology upon triggering a network topology and/or IP shuffling MTD; and (3) Attack stage-based success metrics measuring the chances of discovering a vulnerable target host's information, exploiting the target host's vulnerability, and compromising the target host. Via extensive simulation study, we investigated the key parameters that can significantly affect the MTD performance based on the proposed security metrics. Our simulation results show that the metrics are viable to measure the effectiveness of deploying the MTD techniques.

Clonal selection algorithm for energy minimization in software defined networks

With the advancements of Information and Communication Technologies (ICT), large scale distributed computing and massive data center infrastructures are becoming more common these days. Such trends have drastically put a lot of load on the volumes of data transferred over networks, thus necessitating close to capacity link utilizations flexible forwarding decision-making. Software-defined networking (SDN), with its inherent segregation of control and data planes, provides flexible decision making that can leverage the global network information available to the SDN controller for dynamic and accurate solutions. However, contemporary researchers have focused on the flexibility and security aspects of SDN, widely ignoring energy consumption strategies in next-generation IP networks, which otherwise is a crucial driver in any research field. The scanty existing energy minimization strategies are mostly based on aggregate traffic, which leads to imbalanced utilization of links and affects the quality of service (QoS) adversely. In this paper, we leverage SDN’s key benefits for reducing energy network consumption while realizing dynamic load balance with a few QoS constraints. To this end, a multiobjective optimization problem (MOOP) is formulated that attempts to minimize power consumption and link utilization. With different capacities of switches and links, finding optimal configurations and deciding best paths, even for relatively small networks, become computationally challenging and is, in fact, an NP-hard problem. In this paper, we propose to employ the Clonal Selection Algorithm (CSA), a discrete, metaheuristic solution to find out optimal solutions for this MOOP, namely a Clonal Selection based Energy Minimization (CSEM). Simulations have been carried out for testing the efficacy of the proposed CSEM using real-life network topologies and link-traffic data. The results obtained by the proposed CSEM prove to be efficacious, and the same have also been validated with three different benchmark functions to test the suitability of SDN for CSA.

Flow aggregation for large-scale SDNs with scattered address space allocation

Software-Defined Networking (SDN) has obtained a lot of attention in the last decade and has played a significant role in the development of next-generation networks (NGN). IP networks can also benefit from the SDN evolution to fulfill the data traffic booming. However, the transition of the traditional networking model to SDN architectures poses scalability issues due to the possible flow entry explosion in SDN switches. The limited size of flow-table of SDN switches is not sufficient to handle thousands upon thousands of flows in a large-scale IP network. On the other hand, the interleaved allocation of non-contiguous IP addresses also leads to inefficient routing aggregation and reduces the feasibility of the serious implementation of SDN severely. Therefore, we propose an aggressive flow aggregation scheme—Destination Address Translation and Source-Port Translation on Demand (DATSPToD), which is based on the modified address and port rewriting. DATSPToD enables the aggregation of flow entries in SDNs by translating the destination addresses of multiple same-destination flows with different-source into one flow entry, thus significantly reducing the volume of flow-table occupancy of core-layer SDN switches, even in freely scattered IP address space environments. Simulation results show that DATSPToD outperforms non-aggregation and both wildcard aggregation schemes for a significant reduction of the flow-table occupancy under varied traffic patterns and topologies, especially in large-scale SDNs such as the Internet during the SDN migration period. Compared to the competed schemes under varied traffic patterns and topologies, the simulation results of the DATSPToD could significantly reduce flow-table occupancies by at least1 13%, and by up to 52%. The table-miss rates could be reduced from 11% to 66%.

Geographical addressing strategy for space‐ground integrated network

SummaryTo provide a connection between low earth orbit (LEO) satellite network and terrestrial Internet, a geographical addressing strategy for LEO network is proposed in this paper. When the IP geo‐subnet is divided based on location, the terrestrial users inside and satellite routers above each subnet could be allocated and maintain IP addresses under the regulation of IP network. The addressing strategy is implemented in the first hop and last hop of packet transmission. This paper proves that the application of geo‐subnets could effectively reduce the route table size and generation time in large‐scale space‐ground integrated network as well as maintain the stability of route table when the user condition alters. The performance loss of abnormal addressing caused by the change of satellite coverage would decrease with the reduction of geo‐subnet area. However, the decrease rate would decline during the subnet subdivision and therefore has limited optimization for abnormal addressing. The routing broadcast strategy proposed in this paper could effectively reduce the system packet loss brought by abnormal user at the same geo‐subnet division. Simulation confirms that the geographical addressing strategy combined with routing broadcast optimization in this paper could achieve more than 90% network throughput while reducing 76% of the routing cost.

P4-based implementation of BIER and BIER-FRR for scalable and resilient multicast

Bit Indexed Explicit Replication (BIER) is a novel IP multicast (IPMC) forwarding paradigm proposed by the IETF. It offers a transport layer for other IPMC traffic, keeps core routers unaware of IPMC groups, and utilizes a routing underlay, e.g., an IP network, for its forwarding decisions. With BIER, core networks do not require dynamic signaling and support a large number of IPMC groups with large churn rates. The contribution of this work is threefold. First, we propose a novel fast reroute (FRR) mechanism for BIER (BIER-FRR) so that IPMC traffic can be rerouted as soon as the routing underlay is able to carry traffic again after a failure. In particular, BIER-FRR enables BIER to profit from FRR mechanisms in the routing underlay. Second, we describe a prototype for BIER and BIER-FRR within an IP network with IP fast reroute (IP-FRR). It is based on the programmable data plane technology P4. Third, we propose a controller hierarchy with local controllers for local tasks, in particular to enable IP-FRR and BIER-FRR. The prototype demonstrates that BIER-FRR reduces the protection time for BIER traffic to the protection time for unicast traffic in the routing underlay.

LoRaWAN Gateway Placement Model for Dynamic Internet of Things Scenarios.

Extended Range Wide Area Network (LoRaWAN) has recently gained a lot of attention from the industrial and research community for dynamic Internet of Things (IoT) applications. IoT devices broadcast messages for neighbor gateways that deliver the message to the application server through an IP network. Hence, it is required to deploy LoRaWAN gateways, i.e., network planning, and optimization, in an environment while considering Operational Expenditure (OPEX) and Capital Expenditure (CAPEX) along with Quality of Service (QoS) requirements. In this article, we introduced a LoRaWAN gateway placement model for dynamic IoT applications called DPLACE. It divides the IoT devices into groups with some degree of similarity between them to allow for the placement of LoRaWAN gateways that can serve these devices in the best possible way. Specifically, DPLACE computes the number of LoRaWAN gateways based on the Gap statistics method. Afterward, DPLACE uses K-Means and Fuzzy C-means algorithms to calculate the LoRaWAN gateway placement. The simulations’ results proved the benefits of DPLACE compared to state-of-the-art LoRaWAN gateway placement models in terms of OPEX, CAPEX, and QoS.

High Availability Aspects of SDN-IP Reactive Routing

SDN (Software-Defined Network) is a new paradigm in the world of networks that separates the control plane from the data plane. Over the past few years, SDN network deployment has been difficult because it was isolated from the current IP network. SDN-IP is an ONOS (Open Network Operating System) application used to connect SDN networks to external networks using the standard Border Gateway Protocol. The SDN device will create a path with OpenFlow after receiving a route from an external peering network with BGP speakers on the SDN network. SDN-IP Reactive Routing will calculate and create paths for traffic when receiving ipv4 or ipv6 packets. Therefore, with SDN-IP Reactive, Routing can make host communication between two SDN Network or SDN Network with the internet network. As a core network that connects autonomous systems to internet network, SDN-IP networks need to pay attention to aspects of redundancy. In this research, SDN-IP Architecture use many OpenFlow Switches that are connected to an external BGP are not sufficiently controlled by one controller because if the controller is down, the forwarding plane will be lost. Multiple controllers and multiple links are required to ensure the system continues to run when the controller or link is broken. The purpose of this research is to analyze the High Availability aspects of SDN-IP Reactive Routing. This is done by making multiple onos controllers in one onos cluster system. The testing process is carried out on aspects of BGP speakers, ONOS controller and links between components.

A Novel Neural Network based Model Predictive Controller for Congestion Prevention in IP Networks

A Novel Neural Network based Model Predictive Controller for Congestion Prevention in IP Networks

Improved Merkle Hash Tree-Based One-Time Signature Scheme for Capability-Enhanced Security Enforcing Architecture for Named Data Networking

The concept of network caching is determined to be the potential requirement of named data networks (NDN) for enhancing the capabilities of the traditional IP networking. It is responsible for location independent data accesses and optimal bandwidth utilization in multi-path data dissemination. However, the network caching process in NDN introduces security challenges such as content cache poisoning, malicious injection or flooding of the packets and violation in accessing content packets. In this paper, an Improved Merkle Hash Tree-based one-time signature scheme for capability-enhanced security enforcing architecture (IMHT-OTSS-CSEA) is proposed for provisioning data authenticity in a distributed manner for leveraging the capabilities to inform the access privileges of the packets during the process of data dissemination. It is proposed for permitting the routers to verify the forwarded packets’ authenticity in NDN. It is capable in handling the issues that emerge from unsolicited packets during a flooding-based denial of service attacks by supporting the indispensable verification process in routers that confirms the timeliness of packets. The simulation experiments conducted using the open source CCNs platform and Planetlab confirmed a significant mean reduction in delay of 14.61%, superior to the benchmarked schemes. It is identified to minimize the delay incurred in generating bit vectors by a average margin of 13.06%, excellent to the baseline approaches. It also confirmed a mean increase in the true positive rate of 5.42%, a mean increase in the precision rate of 6.04%, decrease in false positive rate of 6.82% and increase in F-measure of 5.62% compared to the baseline approaches in the context of detecting content cache pollution attack respectively.