Network Packet Research Articles

Increasing the Effectiveness of Network Intrusion Detection Systems (NIDSs) by Using Multiplex Networks and Visibility Graphs

In this paper, we present a new approach to NIDS deployment based on machine learning. This new approach is based on detecting attackers by analyzing the relationship between computers over time. The basic idea that we rely on is that the behaviors of attackers’ computers are different from those of other computers, because the timings and durations of their connections are different and therefore easy to detect. This approach does not analyze each network packet statistically. It analyzes, over a period of time, all traffic to obtain temporal behaviors and to determine if the IP is an attacker instead of that packet. IP behavior analysis reduces drastically the number of alerts generated. Our approach collects all interactions between computers, transforms them into time series, classifies them, and assembles them into a complex temporal behavioral network. This process results in the complex characteristics of each computer that allow us to detect which are the attackers’ addresses. To reduce the computational efforts of previous approaches, we propose to use visibility graphs instead of other time series classification methods, based on signal processing techniques. This new approach, in contrast to previous approaches, uses visibility graphs and reduces the computational time for time series classification. However, the accuracy of the model is maintained.

A Cluster-Tree-Based Secure Routing Protocol Using Dragonfly Algorithm (DA) in the Internet of Things (IoT) for Smart Agriculture

The Internet of Things defines a global and comprehensive network whose task is to monitor and control the physical world by collecting, processing, and analyzing data sensed by IoT devices. This network has succeeded in various areas, and one of its most important applications is in smart agriculture because there are many demands for producing high-quality foodstuff in the world. These demands need new production schemes in the agriculture area. In IoT, communication security is essential due to the extensive heterogeneity of IoT devices. In this paper, a cluster-tree-based secure routing approach using the dragonfly algorithm (CTSRD) is proposed for IoT. The proposed scheme presents a distributed and lightweight trust mechanism called weighted trust (W-Trust). W-Trust reduces the trust value corresponding to malicious nodes based on a penalty coefficient to isolate this node in the network. Furthermore, it improves the trust value of honest IoT devices based on a reward coefficient. Additionally, CTSRD introduces a trust-based clustering process called T-Clustering. In this clustering process, cluster head nodes (CHs) are selected among honest IoT nodes. Finally, CTSRD establishes a routing tree based on the dragonfly algorithm (DA) between CHs. This tree is called DA-Tree. To evaluate the quality of the routing tree, a new fitness function is provided in CTSRD. DA-Tree finds a secure, stable, and optimal routing tree to balance the consumed energy and boost the network lifetime. CTSRD is compared with EEMSR and E-BEENISH with regard to the network lifetime, consumed energy, and packet delivery rate. This comparison shows that our scheme can uniformly distribute the consumed energy in IoT and improves the energy consumption and network lifetime. However, it has a slightly lower packet delivery rate than EEMSR.

Dynamic deep stateful firewall packet analysis model

Due to challenges of COVID -19 pandemic, network is widely used and more networkthreats are evolving, therefore, there is a need to improve network tools in order tocontrol threats. Stateful firewall is a network tool that build up packet filters by keepingrecord of packet passing through the network in a state table, so that when a newpacket arrives, the stateful firewall filtering mechanism first checks to determine whetherthe information is similar to the one in state table, in order to allow or blocked a packet.Although several stateful firewall models have been developed to filter network packets,there is no model that is able to filter the entire parts of a network packet which includethe header, trailer and payloads. In the stateful firewall models developed, mixedresearch methodology have been used. The models are developed in pythonprogramming language; an experimental research design is used, string matching andpattern matching algorithms are used in developing the models.

An Effective Hybrid Mobility Aware Energy Efficient Low Latency Protocol (HMEL-MAC) for Wireless Sensor Network

The utilization of a time-sensitive data collection technique distinguishes a normal wireless sensor network (WSN) system from a WSN. To convey data promptly to the intended user, sensor nodes must compete with one another. Network speed and packet delivery rate (PDR) are impacted by the unfairness of competing nodes. To enhance node fairness, a protocol must be successful. The Media Access Control (MAC) protocol, which focuses on the power requirements of the sensor node, manages these procedures. The proposed MAC protocols, however, do not address the quality of service issues and may not offer power efficiency in certain traffic conditions. During the sensor node registration process, the proposed hybrid MAC uses CSMA/CA to register the sensor nodes and assigns time slots and duty cycle modifications to the registered sensor nodes. Basic sensor network operations like scheduling and prioritization enable this. The findings demonstrate how the suggested MAC protocol enhances network performance in terms of throughput, packet delivery rate, low latency, and minimal power consumption while achieving fairness. When all of these elements are taken into account, the finalized product will attain high data rates.

Performance Analysis of IEEE 802.15.4 Bootstrap Process

The IEEE 802.15.4 is a popular standard used in wireless sensor networks (WSNs) and the Internet of Things (IoT) applications. In these networks, devices are organized into groups formally known as personal area networks (PAN) which require a bootstrap procedure to become operational. Bootstrap plays a key role in the initialization and maintenance of these networks. For this reason, this work presents our implementation and performance analysis for the ns-3 network simulator. Specifically, this bootstrap implementation includes the support of three types of scanning mechanisms (energy scan, passive scan, and active scan) and the complete classic association mechanism described by the standard. Both of these mechanisms can be used independently by higher layers protocols to support network initialization, network joining, and maintenance tasks. Performance evaluation is conducted in total network association time and packet overhead terms. Our source code is documented and publicly available in the latest ns-3 official release.

Cyclical Trends of Network Load Fluctuations in Traffic Jamming

The transport of information packets in complex networks is a prototype system for the study of traffic jamming, a nonlinear dynamic phenomenon that arises with increased traffic load and limited network capacity. The underlying mathematical framework helps to reveal how the macroscopic jams build-up from microscopic dynamics, depending on the posting rate, navigation rules, and network structure. We investigate the time series of traffic loads before congestion occurs on two networks with structures that support efficient transport at low traffic or higher traffic density, respectively. Each node has a fixed finite queue length and uses next-nearest-neighbour search to navigate the packets toward their destination nodes and the LIFO queueing rule. We find that when approaching the respective congestion thresholds in these networks, the traffic load fluctuations show a similar temporal pattern; it is described by dominant cyclical trends with multifractal features and the broadening of the singularity spectrum regarding small-scale fluctuations. The long-range correlations captured by the power spectra show a power-law decay with network-dependent exponents. Meanwhile, the short-range correlations dominate at the onset of congestion. These findings reveal inherent characteristics of traffic jams inferred from traffic load time series as warning signs of congestion, complementing statistical indicators such as increased travel time and prolonged queuing in different transportation networks.

IoTDevID: A Behavior-Based Device Identification Method for the IoT

Device identification is one way to secure a network of IoT devices, whereby devices identified as suspicious can subsequently be isolated from a network. In this study, we present a machine learning-based method, IoTDevID, that recognizes devices through characteristics of their network packets. As a result of using a rigorous feature analysis and selection process, our study offers a generalizable and realistic approach to modelling device behavior, achieving high predictive accuracy across two public datasets. The model's underlying feature set is shown to be more predictive than existing feature sets used for device identification, and is shown to generalize to data unseen during the feature selection process. Unlike most existing approaches to IoT device identification, IoTDevID is able to detect devices using non-IP and low-energy protocols.

Remote patient monitoring service for sleeping human postures in a WBAN

Wireless Body Area Networks (WBANs) provide wireless remote patient monitoring services where doctors get patients' health records without physically visiting them. In WBANs, biosensors are placed on the patient's body that sense and transmit physiological data to the paired medical personnel. Such medical setups are appropriate for COVID-19 patient monitoring, where the patient remains isolated for an extended period. Sometimes, human body parts impede the signals transmitted by biosensors to the coordinator and this type of occlusion lasts for a longer duration during sleeping human postures. In such circumstances, an intermediate biosensor forwards the signals of the occluded biosensor node. The forwarding of messages results in quick depletion of energy resources at the intermediate biosensor, affecting the overall WBAN services. To resolve this, first, we propose an adaptive Relay-Node Centric (RNC) relay-based communication protocol for WBANs, which reduces energy used in relaying and improves the stability period of the network. Second, we design a novel simulation model using an existing real-life experimental dataset to simulate a WBAN placed on the sleeping patient's body. We derive a Discrete Markov Chain (DTMC) model from real-life data and use human biomechanisms to simulate biosensors' connectivity status in four human sleeping positions. Lastly, we evaluate the performance of RNC against the existing cost-function-based and Analytical Hierarchical Process (AHP) based relay selection protocols. Results obtained on the real-life dataset and designed simulation model show that RNC outperforms the existing methods in terms of network stability period and packet success ratio.

Contrastive Learning Enhanced Intrusion Detection

With the continuous development of network technology, the diversity of network traffic constantly increased (intra-class diversity). Nevertheless, the boundary between malicious and benign actions became even ambiguous (inter-class similarity), causing lots of false detection and hindering the further optimization of the detection model. Focusing on challenges brought by intra-class diversity and inter-class similarity, we proposed a novel approach to enhance intrusion detection based on contrastive learning, which can make the right decision while disentangling samples from different classes. First, to bridge the gap when applying contrastive learning to intrusion detection data, we proposed a heuristic method to build contrastive tasks based on random masking of network packet sequences, which can reflect semantic relationships among samples. Then contrastive loss can be calculated to measure the inter-class and intra-class distances. Second, contrastive cross-entropy loss was proposed, which was a combination of contrastive loss and classification loss. Together with a dual branch deep structure, we can optimize the detection and sample distance requirements at the same time. Thirdly, experiments were conducted on diverse real-world and benchmark datasets using different model architectures under various parameter settings. Results on real-world dataset showed that our methods could stable experience a 5% increase in accuracy, and an 8% improvement in detection rate on those easily misdetected scenarios. To verify the method’s effectiveness on different traffic representations, we further conducted experiments on NSL-KDD and UNSW-NB15, which achieved a 7% accuracy improvement on NSL-KDD and a 6% accuracy improvement on UNSW-NB15. Extensive comparison with state of art intrusion detection models in recent five years showed that the proposed methods could effectively improve the accuracy of detection models.

HomeMonitor: An Enhanced Device Event Detection Method for Smart Home Environment

As more and more smart devices are deployed in homes, the communication between these smart home devices and elastic computing services may face some risks of privacy disclosure. Different device events (such as the camera on, video on, etc.) will generate different data traffic during communication. However, the current smart home system lacks monitoring of these device events, which may cause the disclosure of private data collected by these devices. In this paper, we present our device event monitor system, HomeMonitor. HomeMonitor runs in the OpenWRT system and supports complete event monitoring for smart home devices. HomeMoitor solves the problem that machine learning models for detecting device events do not scale flexibly. It uses the network packet size and the direction of the device event for unique identification during training. When detecting, it only needs to get the packet size and timestamp and then query the policy table for signature matching to control the device events. We evaluated the effectiveness of HomeMonitor, and the experiments show that the match rate of our method is 98.8%, the false positive rate is 1.8%, and the detection time is only 16.67% for PINBALL. The results mean that our method achieves the balance of applicable protocol scope, detection performance, and detection accuracy.

Stability Analysis With LMI Based Distributed H ∞ Controller for Vehicle Platooning Under Random Multiple Packet Drops

This paper proposes a discrete time distributed state feedback controller design strategy for a homogenous vehicle platoon system with undirected network topology which is resilient to both external disturbances and random consecutive network packet drop. The system incorporates a distributed state feedback controller design by satisfying bounded <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$H_{\infty }$ </tex-math></inline-formula> norm using Lyapunov-Krasovskii based linear matrix inequality (LMI) approach that ensures internal stability and performance. The effect of packet drops on internal stability in terms of stability margin are studied for a homogenous vehicle platoon system with undirected network topology and external disturbance. The variation of stability margin, representing absolute value of least stable close-loop pole, is also studied for two common undirected network topologies for vehicle platooning, i.e., bidirectional predecessor following (BPF) and bidirectional predecessor leader following (BPLF) topologies by varying platoon members, packet drop rates with number of contiguous packets dropped. Results demonstrate that the control strategy best satisfies the requirement of maintaining a desired inter-vehicular distance with constant spacing policy and leader trajectory using two network topologies: BPF and BPLF. We show how these topologies are robust in terms of ensuring internal stability and performance to maintain cooperative motion of vehicle platoon system with different number of followers, random multiple consecutive packet drops and external disturbance.

RBP: a website fingerprinting obfuscation method against intelligent fingerprintingattacks

A significant danger to website privacy and web security is posed by website fingerprinting (WF), a passive traffic analysis attack. It gathers the network packets created when a user accesses a website and then employs a number of approaches to identify patterns in the network packets that can be used to determine the kind of website the user is accessing. Numerous anonymous networks, like Tor, can satisfy the need to conceal identify from users while participating in network activities, but they are also vulnerable to WF assaults. In this research, we present Random Bidirectional Padding, a website fingerprinting obfuscation technique against sophisticated fingerprinting techniques (RBP). It is a cutting-edge website fingerprinting defence technology built on time sampling and random bidirectional packet padding that can change real packet distribution to destroy Inter-Arrival Time (IAT) features in the traffic sequence and increase the difference between datasets with random bidirectional virtual packet padding. We test the efficiency of thedefence against cutting-edge website fingerprinting attacks in actual circumstances.

Image-Based Approach to Intrusion Detection in Cyber-Physical Objects

Recently, approaches based on the transformation of tabular data into images have gained a lot of scientific attention. This is explained by the fact that convolutional neural networks (CNNs) have shown good results in computer vision and other image-based classification tasks. Transformation of features without spatial relations to images allows the application of deep neural networks to a wide range of analysis tasks. This paper analyzes existing approaches to feature transformation based on the conversion of the features of network traffic into images and discusses their advantages and disadvantages. The authors also propose an approach to the transformation of raw network packets into images and analyze its efficiency in the task of network attack detection in a cyber-physical object, including its robustness to novel and unseen attacks.

Anomaly and Cyber Attack Detection Technique Based on the Integration of Fractal Analysis and Machine Learning Methods

In modern data transmission networks, in order to constantly monitor network traffic and detect abnormal activity in it, as well as identify and classify cyber attacks, it is necessary to take into account a large number of factors and parameters, including possible network routes, data delay times, packet losses and new traffic properties that differ from normal. All this is an incentive to search for new methods and techniques for detecting cyber attacks and protecting data networks from them. The article discusses a technique for detecting anomalies and cyberattacks, designed for use in modern data networks, which is based on the integration of fractal analysis and machine learning methods. The technique is focused on real-time or near-real-time execution and includes several steps: (1) detecting anomalies in network traffic, (2) identifying cyber attacks in anomalies, and (3) classifying cyber attacks. The first stage is implemented using fractal analysis methods (evaluating the self-similarity of network traffic), the second and third stages are implemented using machine learning methods that use cells of recurrent neural networks with a long short-term memory. The issues of software implementation of the proposed technique are considered, including the formation of a data set containing network packets circulating in the data transmission network. The results of an experimental evaluation of the proposed technique, obtained using the generated data set, are presented. The results of the experiments showed a rather high efficiency of the proposed technique and the solutions developed for it, which allow early detection of both known and unknown cyber attacks.

A cascaded federated deep learning based framework for detecting wormhole attacks in IoT networks

The growth of the internet over the years has resulted in massive use and spread of the Internet of Things (IoT) in many areas. From home networks to industrial IoT, from medicine to transportation, IoT is everywhere. This massive usage has come with a price as attackers make use of sophisticated techniques and malware to target these heterogeneous IoT networks. Moreover, the low processing power and minimal resources of the IoT devices make security and privacy a major challenge. This weakness has motivated attackers to target IoT networks in a wide variety of ways by launching different types of attacks. One such kind of attack is the Wormhole attack which belongs to the family of routing attacks and disturbs the normal routing and flow of network packets in the IoT network. Many techniques involving rule-based, trust-based, machine learning-driven and deep learning assisted have been devised to counter wormhole attacks. The proposed research work presents a cascaded wormhole detection technique for IoT networks which is based on the federated deep learning technique and a Dynamic Trust Factor (DTF). The DTF is based on two trust attributes, whereas Convolutional Neural Network (CNN) and Long Short Term Memory (LSTM) deep learning models have been trained using the federated approach, which guarantees data security and privacy at the node level. The proposed technique achieves the accuracy of 96% and is lightweight due to the cascaded and federated learning approach.

Deep Learning Anomaly Classification Using Multi-Attention Residual Blocks for Industrial Control Systems

This paper proposes a novel method monitoring network packets to classify anomalies in industrial control systems (ICSs). The proposed method combines different mechanisms. It is flow-based as it obtains new features through aggregating packets of the same flow. It then builds a deep neural network (DNN) with multi-attention blocks for spotting core features, and with residual blocks for avoiding the gradient vanishing problem. The DNN is trained with the Ranger (RAdam + Lookahead) optimizer to prevent the training from being stuck in local minima, and with the focal loss to address the data imbalance problem. The Electra Modbus dataset is used to evaluate the performance impacts of different mechanisms on the proposed method. The proposed method is compared with related methods in terms of the precision, recall, and F1-score to show its superiority.

A Novel Method for Network Intrusion Detection

Intrusion detection is one of the key research directions of network information security. In order to make up for the deficiencies of traditional security technologies such as firewall, encryption, and authentication, by analyzing the characteristics of network attacks and existing intrusion detection models, the advantages of triadic concept analysis and the application of fuzzy set theory in network intrusion detection are analyzed. The intrusion detection model FCTA based on triadic concept analysis is proposed, which promotes the further development of network intrusion detection. First, we analyze the characteristics of the data and use TF-IDF and Z-Score to normalize and standardize the data to construct a fuzzy triadic background containing quadratic characteristics. It is used to describe the triadic relationship between network connections, network connection characteristics, and intrusion types of network packets. Then, the (i)-induced operator is used to construct the fuzzy triadic concept set based on the fuzzy triadic background and transformed into a fuzzy attribute triadic concept set. Then, the new samples are classified by calculating the similarity between the new samples and the elements in the fuzzy attribute triadic concept set by using the Euclidean distance formula. In order to reduce the model space complexity, compression storage technology is adopted in the model building process.. Finally, by using the IDS-2018 dataset, the rationality and effectiveness of the FCTA model are demonstrated. The average accuracy and average intrusion detection rate of FCTA classification are much higher than BP neural network, SVM algorithm, and KNN algorithm, and the FCTA misjudgment rate is much lower than the BP neural network algorithm, the KNN algorithm, and the SVM algorithm; with the increase of data volume, the accuracy rate and intrusion detection rate increase significantly.

Intelligent SDN Architecture With Fuzzy Neural Network and Blockchain for Monitoring Critical Events

ABSTRACT The article deals with the creation of an intelligent architecture of the Internet of Things transport environment based on software-defined network (SDN) and blockchain for detecting threats and attacks. The transport environment is created for the monitoring system of critical events in the road transport infrastructure. Blockchain technology is used to authenticate network nodes, store sensor data in a distributed ledger. The network packet clustering method based on a fuzzy neural network is used to detect packets with possible malicious content. The intelligent SDN architecture is a hierarchy of four layers with six levels and includes: a) edge computing layer (sensor nodes and routers level, SDN switches data level), b) fog computing layer (zone server level, control level in SDN controllers), c) a cloud computing layer with data center servers, d) a layer for presenting monitoring results on user devices and applications. Detection of threats and attacks is implemented by validating network nodes and analyzing header fields of IP packets and TCP segments. The intrusion detection system includes a parser and analyzer of data packets, a module for filtering traffic by type, port numbers and other characteristics of packets, a module for synthesizing digital signatures of trusted nodes and their validation, a module for analyzing and clustering packets based on fuzzy logic and a neural network, modules for logging procedures. The probability function of packets belonging to clusters is tuned through deep learning of a five-layer neural network. The conclusion about belonging and degree of similarity with malicious packages is formed using the fuzzy logic apparatus. To train the neural network, the previously synthesized rules of the flow tables and the identified signs of atypical data packets are used. The functionality and effectiveness of the SDN architecture with an intrusion detection system is validated by simulating procedures in the NS3 Simulator system, evaluating authenticity, latency, throughput, response time, and accuracy in detecting atypical data packets.

A DDoS Detection and Prevention System for IoT Devices and Its Application to Smart Home Environment

The Internet of Things (IoT) has become an integral part of our daily life as it is growing in many fields, such as engineering, e-health, smart homes, smart buildings, agriculture, weather forecasting, etc. However, the growing number of IoT devices and their weak configuration raise many security challenges such as designing protocols to protect these devices from various types of attacks such as using them as bots for DDoS attacks on target servers. In order to protect IoT devices from enslavement as bots in a home environment, we develop a lightweight security model consisting of various security countermeasures. The working mechanism of the proposed security model is presented in a two-part experimental scenario. Firstly, we describe the working mechanism of how an attacker infects an IoT device and then spreads the infection to the entire network. Secondly, we propose a set of mechanisms consisting of filtration, detection of abnormal traffic generated from IoT devices, screening, and publishing the abnormal traffic patterns to the rest of the home routers on the network. We tested the proposed scheme by infecting an IoT device with malicious code. The infected device then infects the rest of the IoT devices in its network and launches a DDoS attack by receiving attack-triggering commands from the botmaster. Finally, the proposed detection mechanism is used to detect the abnormal traffic and block the connection of infected devices in the network. The results reveal that the proposed system blocks abnormal traffic if the packets from an IoT device exceeded a threshold of 50 packets. Similarly, the network packet statistics show that, in the event of an unwanted situation, the detection mechanism runs smoothly and avoids any possible delays in the network.

An Artificial Intelligent Mechanism for Future Networks using Mininet Wi-Fi

In this paper, Mininet Wi-Fi was used to simulate a Software Defined Network to demonstrate Mininet Wi-Fi’s s ability to simulate their post and wireless dimension by assigning site to other site or access points and revoking these wireless associations which can also be integrated into the existing network. Need of networks continuously growing with more clients, more base points, and more network traffic. The security of these networks and network topologies becomes the most crucial part. The discovered mechanism will work in the network for security purposes. Mininetwi-fi will run the topology and parallellyWireshark that start capturing the network packet and protocol-like information. The extracted information will load in the CIC flow meter to make that readable. Further by processing that data using AIML algorithms data will be shuffled to avoid overfitting&amp;underfitting then will be classified and labeled as normal data and attacked data. These results benefit modern and current networkline-up as the live network devices can also interact with the testing space for the data center, cloud, and mobile providers. The proposed framework can correctly enhance the overall performance of the synchrophasor based adaptive dependability/ security bias scheme in the course of DoS assaults and keep away from maloperation of the security devices, which enhances the strength system's balance.