Network Administrators Research Articles

CoTNeT: Contextual transformer network for encrypted traffic classification

As network infrastructures continue to grow and traffic encryption technologies evolve at a rapid pace, the task of classifying encrypted traffic has become significantly more intricate. These emerging encryption methods render conventional approaches ineffectual in discerning traffic types, consequently posing novel challenges to network security and administration. Evidently, conventional traffic classification techniques are inadequate when it comes to encrypted traffic. Consequently, researchers have turned to machine learning and deep learning models to address this challenge, achieving remarkable results in this domain. Nonetheless, contemporary deep learning models exhibit a propensity to overly depend on self-attention mechanisms while processing 2D feature maps. This mechanism typically focuses only on individual query-key pairs, neglecting the rich contextual information among adjacent keys, thereby limiting their performance in encrypted traffic classification. To address this limitation, our study examines an innovative approach called CoTNet. The CoT module is integrated into the ResNet model to more comprehensively exploit the contextual associations among input keys. This innovation engenders a sturdier and more potent classification model, adept at comprehensively capturing the inherent patterns and correlated information within input features. The suggested method enhances the ResNet model by substituting the conventional 3x3 convolution operations with CoT modules, thereby more effectively harnessing the contextual associations among input keys. In particular, we integrate self-attention mechanisms at various model levels to more thoroughly capture the inherent patterns and correlated information within input features. Experimental results on two real-world datasets show that CoTNet outperforms multiple state-of-the-art methods in the encrypted traffic classification task.

Case Study in Network Security System Using Random Port Knocking Method on The Principles of Availability, Confidentiality and Integrity

Preventing unidentified individuals from misusing their access to information is a major concern when it comes to data security. Network administrators are charged with working harder to be able to secure the computer network they manage. The utilization of right method is a challenge for network administrators to protect computer network from intruders. The RPK method is one of solution to overcome this problem. This research aims to implement RPK method on the principles of availability, confidentiality, and integrity which have not been explored by previous studies. The network system configuration stage involved installing Debian 9, NMAP, Hydra, RPK, cloud server, remote admin, and attacker. The network security system's performance was tested, revealing a 99.97% availability rate and 100% confidentiality. The system's integrity was assessed, with an average response time of 0.22 seconds and 100% blocking accuracy. The test results indicate that the system's network security performance, using the RPK method, capable of protecting server attacks and effectively upholding security stability.

Performance Analysis of Random Forest Algorithm for Network Anomaly Detection using Feature Selection

As the volume and complexity of computer network traffic continue to increase, network administrators face a growing challenge in monitoring and discovering unusual activity. To keep the network safe and functioning, detecting anomalies is essential. Machine learning-based anomaly detection techniques have become increasingly popular in recent years. This is due to the fact that conventional anomaly detection methods make it difficult to detect unknown and complex attacks. This research aims to conduct a performance analysis of two feature selection methods using the random forest algorithm using the UNSW-NB15 dataset to determine which model is most effective in detecting network traffic anomalies. The models evaluated were random forest with the filter method and random forest with the wrapper method. A number of metrics used for model performance assessment are accuracy, F1-score, receiver operating characteristic curve, and precision-recall. Dataset collection, data pre-processing, feature selection, model construction, and evaluation are the main components of the research methodology. The research results show that the Random Forest approach with the Filter method has an accuracy of 0.8950, F1-score of 0.8333, ROC score of 0.8928, and a precision-recall value of 0.8347. Meanwhile, the approach using the Wrapper method obtained an accuracy of 0.9151, F1-score of 0.8510, ROC score of 0.9136, and a precision-recall value of 0.8637. This shows that the performance of Random Forest with the Wrapper method is superior in all assessment metrics. Random Forest with the Wrapper Method is the right choice of model for detecting network traffic anomalies because of its stable performance and ability to handle complex patterns

Research on Network Security Situation Prediction Algorithm Combining Intuitionistic Fuzzy Sets and Deep Neural Networks

<div>The expansion of the internet has made everyone’s personal and professional lives more transparent. There are network security issues because people like sharing resources under the right conditions. Academics have demonstrated significant interest in situation awareness, which includes situation prediction, situation appraisal, and event detection, rather than focusing on the security of a single device in the network. Multi-stage attack forecasting and security situation awareness are two significant issues for network supervisors because the future usually is unknown. Hence, this study suggests combined intuitionistic fuzzy sets and deep neural network (CIFS-DNN) for network security situation prediction. The goal is to provide network administrators with a resource they can use as a point of reference while they formulate and carry out preventive actions in the event of a network assault. The job requires differentiating between the event of an assault and a typical instance, as well as differentiating between the various sorts of attacks and a typical case. In this article, we present a model that can more accurately and effectively forecast network security scenarios, and our experiments bear this out. The results show that the proposed technique is successful and exact in predicting network security issues. The suggested CIFS-DNN approach has a low delay rate of 10%, a low latency rate of 20%, a low error rate of 25%, a high prediction ratio of 98.6%, a high security rate of 98.3%, a high accuracy ratio of 99.6%, and a high efficiency ratio of 93.9%</div>

Feature-Selection-Based DDoS Attack Detection Using AI Algorithms

SDN has the ability to transform network design by providing increased versatility and effective regulation. Its programmable centralized controller gives network administration employees more authority, allowing for more seamless supervision. However, centralization makes it vulnerable to a variety of attack vectors, with distributed denial of service (DDoS) attacks posing a serious concern. Feature selection-based Machine Learning (ML) techniques are more effective than traditional signature-based Intrusion Detection Systems (IDS) at identifying new threats in the context of defending against distributed denial of service (DDoS) attacks. In this study, NGBoost is compared with four additional machine learning (ML) algorithms: convolutional neural network (CNN), Stochastic Gradient Descent (SGD), Decision Tree, and Random Forest, in order to assess the effectiveness of DDoS detection on the CICDDoS2019 dataset. It focuses on important measures such as F1 score, recall, accuracy, and precision. We have examined NeTBIOS, a layer-7 attack, and SYN, a layer-4 attack, in our paper. Our investigation shows that Natural Gradient Boosting and Convolutional Neural Networks, in particular, show promise with tabular data categorization. In conclusion, we go through specific study results on protecting against attacks using DDoS. These experimental findings offer a framework for making decisions.

B-CAT: a model for detecting botnet attacks using deep attack behavior analysis on network traffic flows

AbstractThreats on computer networks have been increasing rapidly, and irresponsible parties are always trying to exploit vulnerabilities in the network to do various dangerous things. One way to exploit vulnerabilities in a computer network is by employing malware. Botnets are a type of malware that infects and attacks targets in groups. Botnets develop quickly; the characteristics of initially sporadic attacks have grown into periodic and simultaneous. This rapid development has proved that the botnet is advanced and requires more attention and proper handling. Many studies have introduced detection models for botnet attack activity on computer networks. Apart from detecting the presence of botnet attacks, those studies have attempted to explore the characteristics of botnets, such as attack intensity, relationships between activities, and time segment analysis. However, there has been no research that explicitly detects those characteristics. On the other hand, each botnet characteristic requires different handling, while recognizing the characteristics of the botnet can help network administrators make appropriate decisions. Based on these reasons, this research builds a detection model that can recognize botnet characteristics using sequential traffic mining and similarity analysis. The proposed method consists of two main processes. The first is training to build a knowledge base, and the second is testing to detect botnet activity and attack characteristics. It involves dynamic thresholds to improve the model sensitivity in recognizing attack characteristics through similarity analysis. The novelty includes developing and combining analytical techniques of sequential traffic mining, similarity analysis, and dynamic threshold to detect and recognize the characteristics of botnet attacks explicitly on actual behavior in network traffic. Extensive experiments have been conducted for the evaluation using three different datasets whose results show better performance than others.

Challenges and Outcomes of Combining Machine Learning with Software-Defined Networking for Network Security and management Purpose: A Review

Current research in data dissemination in Vehicular Ad Hoc Networks (VANETs) has examined different approaches and frameworks to enhance the effectiveness and dependability of information sharing between vehicles on the road. The integration of Machine Learning (ML) with Software-Defined Networking (SDN) has fundamentally transformed the field of network administration and security. This paper specifically addresses the challenges faced by traditional network architectures in effectively handling the increasing amount of data and complex applications. Software-Defined Networking (SDN), a cutting-edge framework, separates the control of network operations from the actual forwarding of data, offering a versatile and cost-effective solution. The combination of Software-Defined Networking (SDN) and Machine Learning (ML) allows for the extraction of valuable information from network data, leading to enhanced network management and the facilitation of predictive analytics. The aim of this study is to examine the feasibility and challenges of incorporating machine learning into software-defined networking (SDN), focusing particularly on practical applications. Integrating Machine Learning (ML) into Software-Defined Networking (SDN) presents challenges, including the requirement for robust algorithms to detect patterns and ensure security. It is crucial to carry out the tasks of developing and implementing machine learning models for real-time predictions and ensuring the robustness of the system. Research is essential to strike a balance between the transformative abilities of ML-SDN and the practical network environments. This helps to improve the resilience, security, and adaptability of network infrastructures in the digital age.

Provider perceptions of barriers to biosimilar utilization in community oncology practices

BackgroundBiosimilars reduce the burden of cost on patients and payers, and so doing, increase access to life-saving care. However, biosimilar uptake in the US has been inconsistent. ObjectivesThis study assessed provider perceptions of barriers to biosimilar use and their relationships to utilization rates in a large, national oncology network and examined if perceptions differed by demographic and practice characteristics. MethodsA 28-item survey was administered to 400 network physicians, pharmacists, nurses, and administrators, spanning 25 provider groups, and measured 1) barriers to use categorized into 4 subscales—payer-related, provider-related, operational, and patient-related, using a Likert scale ranging from Never (1) to Always (5); and 2) demographic and practice characteristics. Utilization rates were assessed using aggregated patient-level drug administration data found in the electronic health record system. Descriptive and inferential statistics were used to describe responses and assess relationships between variables. ResultsA total of 46 responses were analyzed, with a response rate of 11.5%. Most respondents were female (55.6%), physicians (52.2%), with over 6 years of experience (67%). A majority worked in practices participating in the Oncology Care Model (86.7%) and received continuing education on biosimilars (84.8%). Overall scale score was moderately low (mean=2.31), indicating low levels of perceived barriers. The lowest subscale score was operational barriers (mean=2.21), while payer-related barriers was the highest (mean=2.78). Perceptions of barriers did not differ based on demographic and practice characteristics. The average biosimilar utilization rate was 66.2%, with practices in the West administering biosimilars most frequently (71.8%). Utilization was not impacted by perceptions of barriers. ConclusionPerceived barriers to biosimilar utilization were not common and not associated with utilization. Infrequent impediments to utilization may be associated with network-wide emphasis on continuing education and a value-based care environment. Future research should consider other practice- and patient-level factors that may impact biosimilar utilization.

Strengthening Wireless Network Security: Supervised Machine Learning-Based Intrusion Detection for Enhanced Threat Mitigation

With the wireless networks deemed vital to our laced and unetched world, it has become fundamental to safeguard these networks against the various cyber threats that are on the rise. As a research proposal I show concern about the application of a Supervised Machine Learning-Based Intrusion Detection system, making use of Multilayer Perceptron (MLP), Support Vector Machine (SVM), and Logistic Regression (LR) algorithms. The survey begins with the introduction of an intrusive inter-dataset technology that merges two catalytic datasets into a single efficient model that can address both model security and data sensitivity concerns. The evaluation of several machine learning algorithms within the proposed framework is a core component of the analysis. The accuracy measure as well as others such as recall, precision, and F1 score, are applied to evaluate the algorithms' level in detecting intrusions from different datasets.The investigation shows that the intra-dataset routing noticeably improves the detecting modules' efficiency. Notably, the model of MLP algorithm has enhanced recall which in turn shows the enhancement of the positive instance identification. SVM shows increased precision, which accounts for the improved accuracy since correct names of positive cases are produced more often. LR finds it overall enhance the precisions thus attesting to its efficiency in correct deductions. The research documents the multifaceted nature of IDS, prompting the intervention of the machine learning algorithms with ddoswdelcome intrusion detection system. A study which provides a practical guide for network administrators and security professionals hinting on how to select algorithms to meet the distinct security needs in their enterprises. These findings contribute to the open discourse on wireless network security and serve as a base for future study of this engaging research topic in constantly developing field of intrusion detection.

ANALISIS SIMULASI PROTOKOL ROUTING DINAMIS OSPF UNTUK PENINGKATAN EFISIENSI JARINGAN HYBRID KAMPUS UNUD DENPASAR

UNUD GDLN building located in UNUD Sudirman campus acts as an information and communication technology service center as an internet access service provider, radio broadcast and online learning. The UNUD Campus network currently uses a static hybrid routing protocol, where the static routing protocol has the disadvantage that the network administrator must always reconfigure the network if there is a topology change. The Open Shortest Path First (OSPF) dynamic routing protocol can be used as a solution to overcome the weaknesses of static routing protocols because it is more suitable for larger networks and has the advantage of automatically determining the best route. This research aims to analyze the application of OSPF routing protocol in UNUD Denpasar Campus with GNS3 simulation. This research uses Quality of Service (QoS) parameters to analyze network performance, and test scenarios by PING with large data transmission that imitates YouTube video streaming. The results showed that OSPF dynamic routing protocol has better performance and has met the TIPHON standard with very good results for packet loss, throughput, and delay parameters and good results for jitter parameters. Tests on static routing protocol simulations and OSPF routing protocols are carried out by comparing the transmission process based on the resolution on YouTube video streaming imitation, starting with 360p, 480p, 720p and 1080p resolutions. Based on the results of the study, it can be concluded that OSPF routing is more suitable and produces better parameter values when transmitting streaming video with a resolution of 480p, 720p and 1080p, while the transmission of streaming video with a resolution of 360p is more suitable for static routing which is more suitable for transmission with lower resolutions.

Performance, privacy and security issues at the TCP internet layer

The rapid growth of internet-based services and applications has revolutionized the way we communicate, interact, and conduct business. However, this widespread connectivity also brings forth numerous challenges related to performance and privacy security at the internet layer. This paper aims to provide a comprehensive analysis of the various issues that arise in this context, highlighting their impact on user experience, data protection, and network efficiency, to address performance concerns; the research paper investigates the factors affecting internet Layer. Through extensive research studies, the paper examines the impact of network congestion, routing inefficiencies, and protocol limitations on the overall performance of internet-based services. This research delves into the vulnerabilities and risks associated with the internet layer. It investigates the potential threats posed by malicious actors, including hackers, data breaches, and unauthorized access to sensitive information. The findings of this research contribute to a comprehensive understanding of the interplay between performances and privacy security issues at the internet layer. By identifying the key challenges and potential solutions, this study provides valuable insights for network administrators, service providers, policymakers, and end-users to optimize performance while ensuring robust privacy and security measures. Ultimately, this research aims to foster a safer and more efficient internet ecosystem for all stakeholders.

S2DN: Design of robust authentication protocol with session key establishment in multi-controller based software-defined VANETs

Advancements in technology and the adoption of innovative developments have significantly simplified our lives. One notable innovation in the networking domain is Software Defined Networking (SDN), which revolutionizes the network layer by enabling centralized network administration and re-programmability. SDN technology finds application in diverse fields such as Vehicular Ad-hoc Networks (VANETs), Wireless Sensor Networks (WSNs), Internet of Things (IoT) communications, and cloud-fog computing. The integration of SDN technology into VANET systems has notably improved network performance but has also raised security concerns. To tackle this issue, this paper focuses on devising an authentication mechanism to facilitate secure communication across various VANET levels by establishing a shared session key. Moreover, the research proposes a method to mitigate the challenge of single points of failure, a typically difficult issue to address. To ensure the security of all confidential information during protocol execution, simulations are conducted using the Scyther tool. Additionally, an informal security analysis is performed, demonstrating the robustness of the proposed protocol. The proposed protocol also performs outstanding in terms of performance results

Securing SDN: Hybrid autoencoder-random forest for intrusion detection and attack mitigation

Software Defined Networking (SDN) has revolutionized network administration by providing centralized management through software, enabling traffic adjustment independent of the data plane. Despite the benefits, SDN networks are prone to security threats from external sources, thus necessitating the implementation of security measures. Unfortunately, most existing efforts have been just a simple mapping of earlier solutions into the SDN environments. This paper addresses the problem of SDN security based on deep learning in a purely native SDN environment, where a Deep Learning intrusion detection module is tailored to a native SDN environment. In particular, we propose a hybrid Deep AutoEncoder with a Random Forest classifier model (DAERF) to enhance intrusion detection performance in a native SDN environment. The proposed model is incorporated into a novel adaptive framework for attack mitigation in SDN environments. The proposed framework consists of a three-layer protection mechanism for detecting and preventing attacks. It is based on entropy-based detection, hybrid machine learning in the control layer and proactive services monitoring in the application layer. Experimental results have shown that our DEARF proposed autoencoder model achieved anomaly detection rates in excess of 98% in stand-alone mode as well as when incorporated within the framework, making it highly solution for next generation SDN networks.

Short‐term power forecasting method for 5G photovoltaic base stations on non‐sunny days based on SDN‐integrated INGO‐BP and RGAN

AbstractIn response to the suboptimal efficiency observed in the network configuration and administration of 5G photovoltaic base stations (PVBSs), as well as the inherent limitations in accurately forecasting photovoltaic power during inclement weather conditions, this research article introduces a concise and effective method for short‐term power prediction of PVBSs when subjected to non‐sunny weather conditions, leveraging the paradigm of software defined networking. This method ingeniously amalgamates the improved Northern Goshawk optimized back propagation neural network (INGO‐BP) and recurrent generative adversarial networks (RGAN). The investigation commences by delineating a comprehensive PVBS system framework underpinned by SDN principles. Subsequently, it employs the Pearson correlation coefficient technique and principal component analysis for the judicious selection of pertinent features from the PVBS photovoltaic dataset, thereby ameliorating the issue of multicollinearity within the predictive model. To culminate the research endeavour, the INGO algorithm is enlisted to optimize the weightings and bias parameters of the BP neural network, while RGAN is harnessed for the acquisition of distinctive distribution patterns in photovoltaic data across diverse meteorological conditions. This augmentation enhances the model's capacity to discern the intricate long‐term mappings between photovoltaic power and meteorological data. The empirical findings substantiate the elevated accuracy of the INGO‐BP prediction model across sunny, cloudy, and rainy weather conditions, with a discernible enhancement in predictive accuracy for PVBS performance under non‐sunny weather conditions facilitated by data augmentation via RGAN.

Implementation support for the data-driven components of care in a multisite network of coordinated specialty care programs.

Beyond training providers prior to the roll-out of coordinated specialty care (CSC) for first-episode psychosis in clinical settings, implementation support for data-informed care remains an area that has received very little attention. The current paper describes the development and refinement of implementation support for the data-driven components of care in the New Journeys network, Washington State's CSC model for psychosis, comprised of 14 CSC programs. Using the Evidence-Based System for Innovation Support Logic Model, this paper outlines the individual components for implementation support, tools, training, technical assistance, and quality improvement/evaluation that have been developed for the New Journeys network. We present examples of modifications that have occurred over nine years to address the needs of clients, providers, and state-level network administrators to facilitate the data-driven components of care. We conclude with recommendations based on lessons learned in Washington State aimed at improving implementation of data-driven care in CSC models throughout the USA.

Comparative Analysis of Cloud based SDN and NFV in 5g Networks

The acceleration of 5G and other communication technologies is significantly influenced by digitization. However, the current state of 5G development falls short in meeting various performance and manageability requirements, particularly in supporting data center networks. To overcome these challenges, telecom enterprises commonly utilize Network Function Virtualization (NFV) and Software-Defined Networking (SDN) in their data centers. This paper introduces a comprehensive SDN-NFV architecture aimed at simplifying network administration tasks for telecom enterprises. The evolution of interconnect network operations for virtual services has undergone substantial transformations due to the adoption of Software-Defined Networking (SDN) and Network Function Virtualization (NFV). We conducted an investigation into the SDN/NFV paradigm to determine the effective implementation, management, and distribution of network services to end users. This compilation of research papers delves into various aspects of Software-Defined Networking (SDN) and Network Function Virtualization (NFV) within the realm of emerging technologies. Aissioui et al. (2015) contribute with an elastic distributed SDN/NFV controller designed for the efficient management of 5G mobile cloud systems, addressing their dynamic nature. Alenezi et al. (2019) focus on cloud-based SDN and NFV architectures tailored for IoT infrastructure, emphasizing scalability and flexibility. Barakabitze et al. (2020) provide an extensive survey on 5G network slicing using SDN and NFV, categorizing approaches and discussing future challenges.

Network Traffic Monitoring and Real-time Risk Warning based on Static Baseline Algorithm

With the rapid growth of network traffic, in order to monitor network traffic, the author proposes a baseline based traffic inspection method. The main objective is to develop a global system for identifying malicious traffic, rather than a precise method for detecting the types of worms produced by malicious traffic. Although traffic is caused by the causes, network administrators can use this international search technique to detect malicious traffic data. The system based approach mainly includes designing time based on the traditional traffic model, detecting various equipments and network traffic process, and configuring the traffic flow according to each time frame. This method uses Cisco's NetFlow Collector, a NetFlow Collector (NFC), to collect raw NetFlow data transmitted by the device through UDP every 5 minutes. the Then, three-dimensional data such as communication port, communication time, and traffic flow (bytes or packets) is used to filter, remove the different values, calculate the base values, and compare the real-time results with the base values to check the traffic defects in the current network. If there are differences between the monitoring data and the system configuration at the same time, the system will issue an abnormal warning, and as time accumulates, the alarm level will gradually escalate.

Gradient-Based Optimization for Intent Conflict Resolution

The evolving landscape of network systems necessitates automated tools for streamlined management and configuration. Intent-driven networking (IDN) has emerged as a promising solution for autonomous network management by prioritizing declaratively defined desired outcomes over traditional manual configurations without specifying the implementation details. This paradigm shift towards flexibility, agility, and simplification in network management is particularly crucial in addressing inefficiencies and high costs linked to manual management, notably in the radio access part. This paper explores the concurrent operation of multiple intents, acknowledging the potential for conflicts, and proposes an innovative reformulation of these conflicts to enhance network administration effectiveness. Following the initial detection of conflicts among intents using a gradient-based approach, our work employs the Multiple Gradient Descent Algorithm (MGDA) to minimize all loss functions assigned to each intent simultaneously. In response to the challenge posed by the absence of a closed-form representation for each key performance indicator in a dynamic environment for computing gradient descent, the Stochastic Perturbation Stochastic Approximation (SPSA) is integrated into the MGDA algorithm. The proposed method undergoes initial testing using a commonly employed toy example in the literature before being simulated for conflict scenarios within a mobile network using the ns3 network simulator.

Quality of services in software defined networking: challenges and controller placement problems

<span>Quality of service (QoS) is pivotal for ensuring effective and reliable network performance, yet achieving end-to-end QoS within current network architectures remains a persistent challenge. The emergence of software defined networking (SDN) addresses limitations in traditional networking by offering a centralized control plane. This allows dynamic resource management and efficient enforcement of QoS policies by network administrators. However, the controller placement problem (CPP) within SDN poses a significant challenge, as identifying the optimal placement of controllers is a non-deterministic polynomial-time hardness (NP-hard) problem. Researchers are actively working on solutions to address this challenge, especially in large-scale networks where deploying controllers becomes complex. Additionally, maintaining QoS in terms of controller management presents another hurdle. This paper explores these challenges, delving into the literature and providing a comprehensive analysis of controller performance metrics related to QoS parameters such as load balancing, reliability, consistency, and scalability. By addressing these challenges, the research aims to enhance QoS within the SDN framework.</span>

Server Redundancy: Performa Jaringan Mengunakan DNS Failover MikroTik pada Kasus Private Server dan Public Server

The digitization of user services has increased, in line with the need for VPS and cloud computing services, which are rampant among application and platform developers. Quite a few companies that create applications or application users have servers to handle user needs. Testing is carried out using the ICMP Protocol to get real-time results and can be measured. From Scenario 1, carrying out 20 test requests, we get a packet loss of 5% with RTT Avarage of 195,838ms and Mdev 4,103ms. If you apply DNS failover in scenario 2, the client will likely access the web a little slower, as evidenced by the packet loss being 25% greater in value. Compared to scenario 1, having a high standard deviation (Mdev) of round-trip times is not desirable. This variation is also known as jitter. Increased jitter can cause a bad user experience, especially in real-time audio and video streaming applications. However, this is still understandable because it only has a 1-5 second effect on the service. Next, in scenario 3, we can see that private and public servers have relatively high gab with 0% packet loss, which has a small Mdev value of 0.309ms. Therefore, the DNS failover method is a solution for network administrators who have problems related to server migration between public servers and private servers so that services can run even if a server is maintaining or downlinking.