IP Packet Size Research Articles

Systematic Review of Graphical Visual Methods in Honeypot Attack Data Analysis

Mitigating increasing cyberattack incidents may require strategies such as reinforcing organizations’ networks with Honeypots and effectively analyzing attack traffic for detection of zero-day attacks and vulnerabilities. To effectively detect and mitigate cyberattacks, both computerized and visual analyses are typically required. However, most security analysts are not adequately trained in visualization principles and/or methods, which is required for effective visual perception of useful attack information hidden in attack data. Additionally, Honeypot has proven useful in cyberattack research, but no studies have comprehensively investigated visualization practices in the field. In this paper, we reviewed visualization practices and methods commonly used in the discovery and communication of attack patterns based on Honeypot network traffic data. Using the PRISMA methodology, we identified and screened 218 papers and evaluated only 37 papers having a high impact. Most Honeypot papers conducted summary statistics of Honeypot data based on static data metrics such as IP address, port, and packet size. They visually analyzed Honeypot attack data using simple graphical methods (such as line, bar, and pie charts) that tend to hide useful attack information. Furthermore, only a few papers conducted extended attack analysis, and commonly visualized attack data using scatter and linear plots. Papers rarely included simple yet sophisticated graphical methods, such as box plots and histograms, which allow for critical evaluation of analysis results. While a significant number of automated visualization tools have incorporated visualization standards by default, the construction of effective and expressive graphical methods for easy pattern discovery and explainable insights still requires applied knowledge and skill of visualization principles and tools, and occasionally, an interdisciplinary collaboration with peers. We, therefore, suggest the need, going forward, for non-classical graphical methods for visualizing attack patterns and communicating analysis results. We also recommend training investigators in visualization principles and standards for effective visual perception and presentation.

Adjusting Packet Size to Mitigate TCP Incast in Data Center Networks with COTS Switches

In data center networks, a large number of concurrent TCP connections suffer the TCP Incast throughput collapse due to packet drops in shallow-buffered Ethernet switches. In this work, we first reveal theoretically and empirically that controlling the IP packet size is much more effective in avoiding Incast than cutting congestion window under severe congestion. We further design a general supporting scheme Packet Slicing, which adjusts the IP packet on widely used commodity switches. The design uses standard ICMP signaling, which makes no modification on TCP protocols and can be transparently utilized by various TCP protocols. To alleviate the impact of micro-burst caused by high flow concurrency, we utilize the TCP Pacing scheme to disperse packets over the round trip time, helping Packet Slicing to support more concurrent TCP flows. We integrate Packet Slicing with three state-of-the-art data center TCP protocols on NS2 simulation and a physical testbed. The experimental results show that Packet Slicing broadly improves the goodput of different data center TCP protocols by average 26x, while having almost no effect on the I/O performance of switches and end hosts.

Dynamic OBS offset allocation in WDM networks

An investigation is carried out into the traffic characteristics of an OC-192 link (9953 Mbps), based on the IP packet size distribution, traffic burstiness and self-similarity. The Generalised Exponential (GE) distribution is employed as a suitable model of interarrival times of bursty traffic flows of IP packets whilst self-similar traffic is generated for each wavelength of each source node in the optical network. In this context, a novel optical burst switching (OBS) allocation protocol is proposed, based on the offset values of adapting source–destination pairs, using preferred wavelengths specific to each destination node. Different traffic demands amongst the nodes of the optical network are taken into account and a dynamic updating of the offset is adopted based on the occurrence of blocked bursts and successful transmissions. Numerical evaluation results based on simulation are devised and favourable comparisons are carried out between the proposed OBS protocol and the Just Enough Time (JET) protocol, based on the performance metrics of mean queue length, blocking and throughput.

이동형 DVB-S2 기반 상위 계층 부호화 방식 성능 분석

차세대 위성 통신은 이동체에 대한 위성 방송 및 인터넷 서비스를 지속적으로 제공하기 위해 기존의 DVB-S2 표준화에 DVB-H와 DVB-T를 결합한 새로운 DVB-S2M 표준화에 대한 연구가 진행되고 있다. 특히 터널 등에 의해 발생하는 deep fading을 극복하기 위한 방안에 대해 연구가 활발히 진행되고 있으며, 이러한 deep fading 극복을 위해 physical layer 부호화 방식과 upper layer 부호화 방식을 결합한 cross layer 부호화 방식을 사용하고 있다. 본 논문에서는 DVB-S2 short frame 부호화 방식을 physical layer 부호화 방식으로 고정 시키고, upper layer 부호화 방식과 이동체의 속도, 데이터 전송 속도, packet site 등을 변화시켜가면서 시뮬레이션하여 최적의 upper layer 부호화 방식을 제안하였다. Recently, it is studied actively that DVB-S2 for mobility standard(DVB-S2M) is combined with DVB-H, DVB-T and conventional DVB-S2 standard for continuous satellite broadcasting and internet service. Especially, overcoming deep fading by tunnel is main subject. For overcoming deep fading, DVB-S2M proposed cross layer system is consist of upper layer and physical layer. Thus, this paper proposed optimal upper layer coding system fixing the physical layer coding under the simulation results by coding methods, train speed, data rate, interleaver size and IP packet size.

IP Packet Size Entropy-Based Scheme for Detection of DoS/DDoS Attacks

Denial of service (DoS) attacks have become one of the most serious threats to the Internet. Enabling detection of attacks in network traffic is an important and challenging task. However, most existing volume-based schemes can not detect short-term attacks that have a minor effect on traffic volume. On the other hand, feature-based schemes are not suitable for real-time detection because of their complicated calculations. In this paper, we develop an IP packet size entropy (IPSE)-based DoS/DDoS detection scheme in which the entropy is markedly changed when traffic is affected by an attack. Through our analysis, we find that the IPSE-based scheme is capable of detecting not only long-term attacks but also short-term attacks that are beyond the volume-based schemes' ability to detect. Moreover, we test our proposal using two typical Internet traffic data sets from DARPA and SINET, and the test results show that the IPSE-based detection scheme can provide detection of DoS/DDoS attacks not only in a local area network (DARPA) and but also in academic backbone network (SINET).

IP Over Terrestrial ATSC DTV Channels: Performance Evaluations on Data Transmission Throughput

The throughput of IP (UDP and TCP) data transmission over terrestrial ATSC DTV channels was evaluated. A testbed was developed for this purpose. Various issues affecting the throughput of IP data transmission over DTV channels were analyzed, such as channel noise, traffic load, IP packet size and return link capacity. Results obtained from these tests offer valuable information for broadcasters who plan to implement datacasting services over ATSC DTV systems.

Internet traffic measurement and analysis in a high speed network environment: Workload and flow characteristics

A study on Internet traffic characterization is essential in designing the next generation Internet. In this paper we characterize the aggregated Internet traffic based on the traffic logs captured from a high speed Internet access network environment. First, we constructed an Internet traffic measurement and analysis system in high-speed Internet access network environment. Then, we analyzed the captured traffic in two ways. First, we analyze general Internet traffic characteristics. In this analysis, we present general workload characteristics of Internet traffic at each communication protocol layers. We also scrutinize how the behavior of upper layer protocols affects the characteristic of IP packet size. To be more precise in characterizing the aggregated Internet traffic, we analyze the captured traffic according to Internet flow model and show its general characteristics and derive analytic models describing the random variables associated with Internet flow size. In this analysis, we found that Internet flow consists of few packets, especially over 45% flows are composed of only one packet and its size is small and last only a few milliseconds. Even if Internet flows are small in size, most of Internet traffic is carried by small number of long-lived flows or big-sized flows. We also found that Internet flow size follows log-normal distribution which shows burstiness over a wide range of time scales. This is a sharp contrast to commonly made modeling choices that exponential assumptions dominate and show only short-range dependence and it has very close relationship with the self-similarity of the aggregated traffic.