Network Address Research Articles

Network intrusion detection with a novel hierarchy of distances between embeddings of hash IP addresses

Including high-dimensional categorical predictors in a machine learning model is a major challenge. This is particularly appropriate for the IP and Port addresses of network connections when they are considered as predictors (features) in machine learning models. These features are particularly important for network intrusion detection, as many attacks exploit information about IP/Port addresses. The sparsity and high dimensionality of these features make it difficult their inclusion into the models, being discarded as useful information in many cases. This work proposes to replace the original network addresses by new features based on a set of distances defined between different components of the source and destination IP and Port addresses. These distances incorporate information on the probability of co-occurrence of source and destination addresses. The distances are calculated using a dense, low-dimensional vector representation (embedding) of the different network address components. The embeddings are obtained with a neural network, which requires few computational resources, plus an additional hash function that collapses the extremely large range of IP and Port values, making the model implementation feasible. A self-supervised learning framework under a hierarchical model is used to train the encoding network.The novel features can be used to predict future co-occurrence of source and destination network addresses, and, when applied as features in a supervised model, they significantly increase the prediction performance of most classifiers for the detection of network intrusions. We demonstrate this prediction improvement over two modern network intrusion datasets: CICIDS2017 and CICDDoS2019.

An Effective Traceback Network Attack Procedure for Source Address Verification

The Internet is being extensively used in various fields to serve billions of users, which leads to the number of network security issues. Here, Internet Protocol Spoofing is considered the main threat for masquerade of the packet identity. An IP packet, which contains the header with the source IP address, lacks source verification. The invaders to spoof the network address of the packet use this vulnerability. To overcome this, verification of source is performed by marking the packets and tracing back to the source. Existing schemes make use of either packet marking or packet logging for trace back to the source with high computational and storage overhead. This paper proposed a scheme to minimize both the overheads by using a Combined IP Traceback procedure. Packet marking is done efficiently by using the 16-bit ID field of the packet header and packet logging is completed more effectively by using the hash table. The path reconstruction is done using the mark value in the packet, which traces back to the original source border router. The proposed method is empirically validated against the related ones.

Speech language therapists’ experiences with subjective well‐being in people with aphasia

Subjective well-being (SWB) and quality of life (QOL) are intricately related constructs. Recent research shows both constructs share some facets, but are distinct entities. It is unclear, both internationally and in the Netherlands, if and how SLTs address SWB in clinical practice. The current study was set up to explore Dutch SLTs' perceptions of SWB in relation to the management of people with aphasia. To describe how Dutch SLTs, working with people with aphasia in a private practice or a healthcare setting, address patient's SWB during diagnosis and treatment, and to identify barriers and facilitators they experience when addressing SWB. A qualitative research design with a phenomenological approach was used. SLTs from private practices and healthcare settings were invited to participate in individual interviews and a focus group. The data were analysed thematically using a combination of inductive and deductive methods. Eight SLTs participated in the study. The SLTs' experiences were captured in four themes that emerged from the data: (1) SWB is a multifaceted concept and depends on patient-specific factors: premorbid factors, life priorities and time post-stroke; (2) SLTs experience more responsibility for patients' SWB than their profession allows; (3) collaboration between SLTs and patients, patients' network and other healthcare professionals is required to address SWB during diagnosis and treatment; and (4) misinterpretations are inevitable when SLTs or the patients' network address patients' SWB. The results showed that SLTs feel responsible for addressing SWB in the management of people with aphasia. Their perception of the concept of SWB is similar to the definition used in the literature and is multifaceted. They feel responsible for the part of SWB that is related to communicative functioning, but less so for the more heuristic aspects of SWB. This is related to their experienced limitation of influence on SWB, which for some leaves them feeling out of depth and uncertain about boundaries between professionals. Addressing SWB in a multidisciplinary team is therefore considered important in order to adequately and fully capture someone's SWB and reduce to clinicians' experienced burden and responsibility. What this paper adds What is already known on this subject Recent studies suggest that quality of life measures may lack facets related to subjective well-being (SWB). Aphasia is likely to impact on SWB of a stroke survivor, but it is unclear if and how SWB is addressed by speech and language therapists in diagnosis, and treatment of Dutch PWA. What this study adds This study provides insight into the operationalization of SWB in Dutch clinical practice, including barriers SLTs experience when addressing SWB. Clinical implications of this study Monitoring and influencing SWB of people with aphasia is a complex process, that SLTs consider only possible in multi-disciplinary teams. Clear guidelines on roles and responsibilities between various disciplines involved are necessary to improve care for people with aphasia.

Design of Remote Environmental Monitoring Network Based on Intelligent Sensor Network Address Allocation and Addressing

Based on the wireless sensor network, this paper combines node monitoring data with intelligent network address management. Users can view real‐time environmental data through a computer or mobile phone and can manually remotely manage the environmental adjustment equipment of the network address through the mobile phone. This article first discusses the research background of the subject, introduces the current domestic and foreign research status of WSN in environmental detection, and analyzes the reasons for choosing ZigBee network as the wireless transmission environment of the intelligent monitoring system. Secondly, the structure, layered model, and key technologies of wireless sensor networks are introduced, and it is pointed out that ZigBee technology, which has the characteristics of low power consumption, reliable communication, self‐organization of the network, strong self‐healing ability, and low cost, is very suitable for application in the environment. Then, it analyzes TI’s protocol stack Z‐Stack based on the ZigBee2006 standard and analyzes the network address assignment and addressing in Z‐Stack, the process and steps of node binding, the routing mechanism and routing maintenance, and channel configuration. The realization of other functions was discussed in depth. During the simulation experiment, in the hardware design of the intelligent monitoring system, the network node was divided into two parts: the core board and the backplane. The crystal oscillator, power supply, antenna, and I/O port circuits of the core board were designed, and the data acquisition, relay, and power supply of the backplane were designed. Finally, this paper studies the data security issues in the environmental monitoring network and proposes two solutions to control network access and data encryption. Experimental results show that in terms of low‐power design, the energy of the entire system is calculated to determine the factors that affect the power consumption of the system and methods such as increasing the node sleep time to ensure that the system can work for a long time.

A Novel Method for Resource Efficient Security Service Chain Embedding Oriented to Cloud Datacenter Networks

An important and promising application for the network function virtualization (NFV) technology is in network security, where can dynamically and flexibly accomplish the chaining virtualized security network functions (VSNFs), e.g., network address translation, antispam and packet filter firewall, etc., and thus inspect, monitor or filter traffic flows in the cloud datacenter networks. However, the traffic flows addressed by the VSNFs mainly depend on the security service requirements from mobile users, such as the network security level, end-to-end latency, and security resource, etc. Considering the dynamic nature of cloud datacenter networks, determining the embedding of VSNFs and routing security service paths that optimizes the security resource utilization is a challenging problem, particularly without violating the end-to-end delay constraints and security service requirements. This can also be called security service chain dynamic embedding problem (SSC-DMP). In this paper, we present an NFV-enabled framework for a system that achieves the SSC dynamic embedding in the cloud datacenter networks. We first formulate an integer linear programming (ILP) model to solve the SSC-DMP exactly in small-scale network topology. Then, in order to reduce the time complexity when applying the large-scale network topology, we propose an efficient SSC dynamic embedding solution that is based on the particle swarm optimization. Extensive simulation results show that the proposed algorithm could significantly outperform the current benchmarks at least 35.2% and 23.1% in terms of resource consumption and end-to-end delay, respectively.

Research on User Dynamic Selection Network Technology

Abstract As the world has entered the Internet era, more and more network operators have also developed one after another, which has been widely used in communities, schools, banks and other regions. Due to the uneven distribution of network providers in different regions, a certain network line is not running smoothly. In order to solve this problem, this paper puts forward a method that users can dynamically choose networks according to their preferences, and the problem can be solved by static routing and network address translation. At first, set the internal IP addresses of different users and the external IP addresses provided by internet providers on the ports on both sides of the user LAN router. During network address translation, a fixed one-to-one relationship established by the internal IP and the external IP is loaded into the routing table of the user LAN as a static route. Finally, users can actively and dynamically set the internal IP of the user LAN router in the router list in the user computer and realize the method that the user dynamically selects different interconnection networks.

ARP cache poisoning: detection, mitigation and prevention schemes

ARP is a network communication protocol employed for mapping a network address to a MAC address at the data link layer of the IP suite. However, the absence of authentication process in the ARP protocol allows vulnerabilities like ARP cache poisoning or ARP spoofing to take place. This allows malicious nodes to associate its MAC address with the IP address of host, and hence resulting in the exposure of network to several severe attacks like DoS, MITM, session hijacking and many more. There is no universally accepted benchmark scheme that reaches to the solution at fullest. This paper presents a comprehensive review of all those schemes along with their associated strengths and weaknesses. Also, a comparative evaluation of schemes is included in the paper for further insight into the development of improvised solutions to the above stated problem.

Research on ISPs Selection Technology Based on Network Quality Monitoring

Abstract With the development of the network era, ISP have become more than one. Users can choose ISP according to personal preference when buying broadband, to provide users with the right to choose. However, with the improvement of network speed and bandwidth, people still feel the network congestion during peak hours. In this paper, users can choose different ISPs dynamically based on network quality monitoring. In this paper, the HTTP protocol of the application layer is used to accurately measure the real Internet situation of users, and the PC is used to actively send data to two network links at the same time, and finally the feedback parameter information can be obtained. According to this protocol, the real loading time of data can be accurately measured and the optimal ISP link can be selected. Then, a one-to-one relationship between the client address and different ISPs is established, and this relationship is saved in the routing table. Users will dynamically choose different ISPs by using the network address translation.

Virtual IP-based Secure Gatekeeper System for Internet of Things.

The advantage of using the Network Address Translation device is that the internal IP address, which makes the IP address space of Internet of Things (IoT) devices expanded, is invisible from the outside and safe from external attacks. However, the use of these private IPv4 addresses poses traversal problems, especially for the mobile IoTs to operate peer-to-peer applications. An alternative solution is to use IPv6 technologies for future IoT devices. However, IPv6 package, including IPSec, is too complex to apply to the IoT device because it is a technology developed for the user terminal with enough computing power. This paper proposes a gatekeeper to enable the real IP addresses of IoTs inside the same subnetwork to be not explicitly addressable and visible from outside of the gatekeeper. Each IoT device publishes its virtual IP address via the Registrar Server or Domain Name System (DNS) with which the gatekeeper shares the address mapping information. While the gatekeeper maintains the mapping information for the local IoT devices, the registration server or DNS has global address mapping information so that any peer can reach the mapping information. All incoming and outgoing packets must pass through the gatekeeper responsible for the address conversion and security checks for them from the entrance. This paper aims to apply our gatekeeper system to a platform of self-driving cars that allows surrounding IoT cameras and autonomous vehicles to communicate with each other securely, safely, and rapidly. So, this paper finally analyzes improvement effects on latency to show that our gatekeeper system guarantees the latency goal of 20 ms under the environment of 5G links.

String Matching untuk Mendeteksi Serangan Sniffing (ARP Spoofing) pada IDS Snort

Sniffing technique (ARP Spoofing) is an attack that sends fake ARP packets or ARP packets that have been modified according to the network address attacker's to poison the victim's ARP cache table. ARP spoofing attack is a dangerous attack because it can monitor the activities of victims in searching the browser and can steal social logins, office and other accounts. This attack supports the occurrence of other computer network attacks such as Denial of service, Man in the middle attack, host impersonating and others. Sniffing attacks are generally found in places that provide public Wi-Fi such as campus, libraries, cafes, and others. IDS Snort can detect sniffing attacks (Arp Spoofing). String Matching Method KMP algorithm is applied to detect attacks on snort logging files to provide alerts (messages) to users. Tests carried out are black box testing to test application functionality, and accuracy testing. All application functionality was successful, and testing the accuracy of the match between manual calculations for string matching and accurate application.

NAT++: An Efficient Micro-NAT Architecture for Solving IP-Spoofing Attacks in a Corporate Network

The Internet Protocol (IP) version 4 (IPv4) has several known vulnerabilities. One of the important vulnerabilities is that the protocol does not validate the correctness of the source address carried in an IP packet. Users with malicious intentions may take advantage of this vulnerability and launch various attacks against a target host or a network. These attacks are popularly known as IP Address Spoofing attacks. One of the classical IP-spoofing attacks that cost several million dollars worldwide is the DNS-amplification attack. Currently, the availability of solutions is limited, proprietary, expensive, and requires expertise. The Internet is subjected to several other forms of amplification attacks happening every day. Even though IP-Spoofing is one of the well-researched areas since 2005, there is no holistic solution available to solve this problem from the gross-root. Also, every solution assumes that the attackers are always from outside networks. In this paper, we provide an efficient and scalable solution to solve the IP-Spoofing problem that arises from malicious or compromised inside hosts. We use a modified form of Network Address Translation (NAT) to build our solution framework. We call our framework as NAT++. The proposed infrastructure is robust, crypto-free, and easy to implement. Our simulation results have shown that the proposed NAT++ infrastructure does not consume more than the resources required by a simple NAT.

A Web-Based Honeypot in IPv6 to Enhance Security

IPv6 is a next-generation IP protocol that replaces IPv4. It not only expands the number of network address resources but also solves the problem of multiple access devices connected to the Internet. While IPv6 has brought excellent convenience to the public, related security issues have gradually emerged, and an assessment of the security situation in IPv6 has also become more important. Unlike passive defense, the honeypot is a security device for active defense. The real network application and the fake network application, disguised by the honeypot, are located on a similar subnet, and provide a network application service; but, in both cases, behavior logs from unauthorized users are caught. In this manner, and to protect web-based applications from attacks, this article introduces the design and implementation of a web-based honeypot that includes a weak password module and an SQL inject module, which supports the IPv6 network to capture unauthorized access behavior. We also propose the Security Situation Index (SSI), which can measure the security situation of the network application environment. The value of SSI is established according to the different parameters that are based on honeypots. There is a firewall outside the test system environment, so the obtained data should be used as the real invasion data, and the captured behavior is not a false positive. Threats can be spotted smartly by deploying honeypots; this paper demonstrates that the honeypot is an excellent method of capturing malicious requests and can be measured with the SSI of the whole system. According to the information, the administrator can modify the current security policy, which can improve the security level of a whole IPv6 network system.

Supervised Learning-Based Fast, Stealthy, and Active NAT Device Identification Using Port Response Patterns

Although network address translation (NAT) provides various advantages, it may cause potential threats to network operations. For network administrators to operate networks effectively and securely, it may be necessary to verify whether an assigned IP address is using NAT or not. In this paper, we propose a supervised learning-based active NAT device (NATD) identification using port response patterns. The proposed model utilizes the asymmetric port response patterns between NATD and non-NATD. In addition, to reduce the time and to solve the security issue that supervised learning approaches exhibit, we propose a fast and stealthy NATD identification method. The proposed method can perform the identification remotely, unlike conventional methods that should operate in the same network as the targets. The experimental results demonstrate that the proposed method is effective, exhibiting a F1 score of over 90%. With the efficient features of the proposed methods, we recommend some practical use cases that can contribute to managing networks securely and effectively.

The importance of the use of IPV6 as an internet migration protocol

The article states the need and importance of the migration from IPv4 to IPv6. All the information that this article contains was obtained from bibliographic research in several books and online papers, just as a survey with the people responsible for some companies’ IT Department, in which we were able to attain a thorough analysis about the migration from IPv4 to IPv6. The currently situation of companies’ systems have been unreasonably unstable with Carrier Grade Network Address Translation - CGNAT, a technique used by internet service providers to share IPv4 public addresses inside private network addresses. Some research indicates that a large amount of IT professionals are suitable to use the IPv6 migration system as well as states that there are several resources and technics for implementation of this new system, however there has to be caution while using dual stacks and tunnels from the more recent system, the IPv6, because some services still are operated by the older system, the IPv4, as long as it continues existing and being used. Nowadays, several internet providers have adopted a new way of using the IPv4 and the IPv6, but the industry lacks business owners or internet managers with the right conscious to obtain the equipment’s that endure the migration to IPv6.

Enhancement in Security of Android Devices Using Malware Prediction with Machine Learning

Due to large number of malicious applications in android devices, security of user data has become a serious issue. We need to detect and predict malware in android application to keep devices secure. SIGPID (Significant Permission Identification) approach extracts Significant Permission required in android application and uses this information to predict malware using supervised learning algorithm. DREBIN method performs broad static analysis and gathers required features from manifest file and application code. The features like network addresses, API calls, hardware components, permissions are mapped into joint vector space. Applying suitable machine learning algorithm to this vector space the system classifies application as malicious or benign application which results into improvement in the prediction accuracy. SIGPID aims to use less number of permissions to predict the malware presence whereas DREBIN aims at giving accurate predictions. We have used principles of these two algorithms to implemented malware detection system Safroid which aims to use less number of permissions and give accurate predictions.

Implementation of Network Address Translation Using TCP/IP Model In Internet Communication System

Nowadays, many people will be used internet that for their work, communication, education, economic and organization necessary that is used today. Network address translation (NAT) is a method of remapping an IP address space into another by modifying network address information in the IP header of packets while they are in transit across a traffic routing device. A network is a system of hardware and software, put together for the purpose of communication and resource sharing. A network includes transmission hardware devise to interconnect transmission media and to control transmissions and software to decode and format data. The Internet protocol suite is the computer networking model and set of communications protocols used on the Internet and similar computer networks. Knowledge on how the internet is able to communicate with internet users is a mystery to some people. Internet communication need to be TCP/IP protocol which means that TCP is Transmission Control Protocol, or what is sometimes simply used to refer to Internet Protocol, is the basic unit for communication on the internet. This can also be applied to private internet, like Ethernet and so on. Despite TCP and IP being used interchangeably, there is a slight difference between the two in relation to the roles they play IP is directly responsible for obtaining internet addresses and then it is the work of TCP to deliver the data obtained to the addresses achieved by IP. TCP/IP provides end-to-end connectivity specifying how data should be packetized, addressed, transmitted, routed and received at the destination. This paper aim is described operation and models of TCP-IP suite in data communication network.

Advanced location-based IPv6 address for the node of wireless sensor network

Fields such as military, transportation applications, human services, smart cities and many others utilized Wireless Sensor Network (WSN) in their operations. Despite its beneficial use, occurrence of obstacles is inevitable. From the sensed data, the randomly nodes distribution will produce multiple benefits from self-configuration and regular positioning reporting. Lately, localization and tracking issues have received a remarkable attention in WSNs, as accomplishing high localization accuracy when low energy is used, is much needed. In this paper, a new method and standards-compliant scheme according to the incorporation of GPS location data into the IPv6 address of WSN nodes is suggested. The suggestion is likewise others which depends on ground-truth anchor nodes, with a difference of using the network address to deliver the information. The findings from the results revealed that perfect GPS coordinates can be conducted in the IPv6 address as well as with the transmission radius of the node, and the information is significantly adequate to predict a node’s location. The location scheme performance is assessed in OMNet++ simulation according to the positioning error and the power metrics used. Moreover, some improvement practices to increase the precision of the node location are suggested.

Study of IPv6 Protocol in the Data Model of the Smart Grid Distribution Domain

Introduction: This article is the product of the research “Study of the IPv6 Protocol in the data model of the Smart Grid distribution domain” developed at the Universidad del Valle and carried out during 2019.
 Problem: There is an immediate need to establish standards and protocols for the Smart Grid for both the electrical components and the component technologies of information and communication.
 Objective: The objective of the research is to characterize the use of IPv6 in the context of the communications domain distribution of the Smart Grid.
 Methodology: The work defines a virtualization environment in which the performance of IPv6 in the domain distribution of the Smart Grid will be evaluated; this evaluation includes measurement and analysis of delays as well as traffic volumes, bandwidth, cyber-security conditions, and time allocation of network addresses.
 Results: The IPv6 protocol is considered as a viable alternative in the Smart Grid communication model in order to comply with the communication requirements.
 Conclusion: The implementation of Quality of Service QoS in IPv6 defined in RFC2474 is essential in the Smart Grid communication network in order to meet the communication requirements of the defined applications.
 Originality: There is great expectation that networks based on the Internet Protocol will serve as a key element for communications within the Smart Grid.
 Limitations: The wide scope and dimensions involving Smart Grids, it is almost impossible to implement the communication network of a Smart Grid completely in a single simulation tool or emulation.

Neither Denied nor Exposed: Fixing WebRTC Privacy Leaks

To establish peer-to-peer connections and achieve real-time web-based communication, the Web Real-Time Communication (WebRTC) framework requires address information of the communicating peers. This means that users behind, say, Network Address Translation (NAT) or firewalls normally rely on the Interactive Connectivity Establishment (ICE) framework for the sake of negotiating information about the connection and media transferring. This typically involves Session Traversal Utilities for NAT (STUN)/Traversal using Relays around NAT (TURN) servers, which assist the peers with discovering each other’s private and public IP:port, and relay traffic if direct connection fails. Nevertheless, these IP:port pieces of data can be easily captured by anyone who controls the corresponding STUN/TURN server, and even more become readily available to the JavaScript application running on the webpage. While this is acceptable for a user that deliberately initiates a WebRTC connection, it becomes a worrisome privacy issue for those being unaware that such a connection is attempted. Furthermore, the application acquires more information about the local network architecture compared to what is exposed in usual HTTP interactions, where only the public IP is visible. Even though this problem is well-known in the related literature, no practical solution has been proposed so far. To this end, and for the sake of detecting and preventing in real time the execution of STUN/TURN clandestine, privacy-invading requests, we introduce two different kinds of solutions: (a) a browser extension, and (b) an HTTP gateway, implemented in C++ as well as in Golang. Both solutions detect any WebRTC API call before it happens and inform accordingly the end-user about the webpage’s intentions. We meticulously evaluate the proposed schemes in terms of performance and demonstrate that, even in the worst case, the latency introduced is tolerable.

UAV communication system integrated into network traversal with mobility

In this paper, a secured unmanned aerial vehicle (UAV)-assisted heterogeneous network environment, and seamless IP prototype is proposed. UAV is controlled over the Internet to resolve a long-range communication barrier and to improve remote sensing. In the new technology, a pilot can control UAV via an end device (ED)-secured communication without any information about the network architectures, network address translation types, Internet protocol version. Network traversal with mobility (NTMobile) offers a secured communication for UAV through a public network infrastructure. NTMobile enhances the security and maintain mobility by generating keys and building tunnel using virtual IPs for two nodes inside the network. In the prototype the UAV flight controller can install a ground control station application on the UAV board. An ED can be any smart device connected to the Internet with the ability to run the remote protocols, which allows the pilot to send commands and receives data from UAV. Moreover, the pilot transmits commands through the remote desktop protocol or secure shell protocol. Experimentally, an autopilot mission is designed and uploaded to the flight controller where UAV and ED are forced to switch access network between cellular network LTE and 802.11a IEEE wireless local area network in specific waypoints. The novelty of this study is proposing secure continuous connectivity of the UAV communication and control system even during the occurrence of a network switch, which is one of the important factor in the heterogeneous network environment. The results revealed that NTMobile maintains continuous communication by re-establishing the created tunnel between UAV and ED in the proposed prototype while both are travelling in a heterogeneous network.