Network Packet Research Articles

Adaptive event‐triggered tracking control for nonlinear networked systems with dynamic quantization and deception attacks

AbstractThe problem of adaptive event‐triggered security tracking controller design is studied for interval type‐2 (IT2) Takagi‐Sugeno (T‐S) fuzzy‐approximation‐based nonlinear networked systems with deception attacks, privacy protection, and dynamic quantization in this paper. To reduce the network burden, the adaptive event‐triggered schemes (AETSs) and dynamic quantization are introduced to reduce unnecessary transmission and the number of network packets, respectively. Under the framework of network security, a novel security co‐design scheme with the tracking controller, AETSs, and the quantizers is developed, in which the privacy protection of the reference model and the deception attacks of the controller are taken into consideration simultaneously. Sufficient conditions for the results system to be mean‐square asymptotically stable with a tracking performance are established. Finally, two practical simulation examples demonstrate the effectiveness and novelty of the proposed design strategy.

Adaptive optimal tracking control of networked linear systems under two-channel stochastic dropouts

This work investigates the adaptive optimal tracking control problem for networked discrete-time linear systems by directly using the data transmitted via communication networks. It is shown that the concerned problem can be addressed by solving two sub-problems: an adaptive optimal control one and an adaptive output regulation one. Two novel online reinforcement learning based policy iteration and value iteration algorithms are developed, which constitute an integrated framework to learn the optimal feedback control gain and the solutions to regulator equations by directly using the data transmitted via communication networks. Furthermore, it is shown that the tracking error of the closed-loop control system is mean square asymptotically stable even in the case of network packet stochastic dropouts. Simulation results demonstrate the efficacy of the proposed approaches.

Enhancing DDoS Attack Detection and Network Resilience Through Ensemble-Based Packet Processing and Bandwidth Optimization

It is critical to identify Distributed Denial of Service (DDoS) attacks to preserve network integrity and guarantee continuous service delivery. Our research suggests a novel way to lower the network's packet drop ratio and improve the accuracy of DDoS attack detection. Conventional techniques occasionally just use anomaly detection or signature-based detection, which might not be sufficient to protect against DDoS assault schemes that are always changing. To increase the precision and resilience of DDoS detection, our system incorporates several detection strategies, such as signature-based, anomaly-based, and machine learning-based techniques. Additionally, we use network traffic analysis and anomaly detection tools to quickly discover and block harmful traffic patterns. During suspected DDoS attempts, we dynamically modify network parameters and reroute data to reduce the packet drop ratio and maintain service for authorized users. Additionally, our system has feedback systems that allow us to continuously adjust and improve detection algorithms, improving the overall dependability and effectiveness of DDoS attack detection. We illustrate how successfully our method lowers packet drop ratios and strengthens network resilience against DDoS attacks using both simulation and real-world experience.

SEARCH FOR INFORMATIVE FEATURES BASED ON THE PRINCIPAL COMPONENT METHOD IN MALICIOUS TRAFFIC IDENTIFICATION AND ASSESSMENT TASKS

The proposed study will be aimed at improving the accuracy of detecting malicious traffic in telecommunications networks of companies. One of the important tasks of the study was to develop a model of the required network traffic feature space by highlighting the most informative features of network packets. Due to the fact that the analysis of all the features present in network traffic requires large computing resources and the redundancy of the analyzed data can lead to retraining of the developed model, there is an urgent need to reduce the size of the feature space by highlighting the most informative and excluding less informative features. This article proposes the application of the principal component method to achieve the goal of identifying the most informative features from network traffic. The proposed approach increases the reliability of the results of identification of malicious traffic of companies, without loss of quality.

Proactive Analysis and Detection of Cyber-attacks using Deep Learning Techniques

Objectives: This study objective is to create a proactive forensic framework with a classification model to identify the malicious content to avoid cyber-attacks. Methods: In this proposed work, a novel framework is introduced to analyze and detect network attacks before it happens. It monitors the network packet flow, captures the packets, analyzes the packet flow proactively, and detects cyber-attacks using different machine learning algorithms and Deep Convolution Neural network (CNN) technique. The KDD dataset is used in this experiment with 30% for testing and 80% for training. Findings: The simulation results show that the detection percentage of the proposed framework reaches a maximum of 95.92% in different scenarios. It is approximately 10% higher than the existing proactive frameworks for example Gawand’s model, Ahmetoglu’s model and many more. Novelty and applications: The proposed framework is a proactive model which detects the cyber-attack in prior to avoid cyber-attacks. The deep CNN model highly efficient for detecting cyber-attack. Keywords: Proactive Forensic Framework, Deep CNN, Classification Algorithms, Cyber attack detection, Intrusion Detection System

Multi-Objective ED2MT Strategy-based Clustering Algorithm for Large Scale WSN

Wireless Sensor Networks play a crucial role in everyday life, providing a wide range of networking structures to develop real-time applications. Energy consumption is limited by WSN devices, so reducing the energy consumption of malicious nodes is crucial to improving network performance. A main concern of WSNs from an application perspective is the prolonged lifetime of the network and reduced energy usage. To overcome these challenges a novel multi-objective ED2MT (Energy, Distance, Degree, Mobility, Time) driven strategy has been proposed which consists of three phases namely dual Cluster Head Selection, data compression, and routing. In the first phase, the proposed ED2MT uses a Fuzzy C-Means (FCM) clustering algorithm to select dual Cluster Head (CH) which has been performed in two stages, namely Inter-Cluster and Intra-Cluster. In the second phase, a Neighborhood Indexing Sequence (NIS) technique is utilized to compress the number of bits in the data before it is transmitted. In the third phase, a multi-objective shortest-path routing algorithm is utilized for route selection. The performance of the ED2MT method has been evaluated using network lifetime, delay, throughput, alive nodes, energy efficiency, and packet delivery ratio to provide a better result. The proposed ED2MT framework achieves 20.55%, 18.4%, and 15.2% more residual energy than C3HA, CAFL, and DHSCA algorithms.

Res-DFNN: An NN-Based Device Fingerprint Extraction Method Using Network Packet Data

The past few years have witnessed a wider adoption of Internet of Things (IoT) devices. Since IoT devices are usually deployed in an open and uncertain environment, device authentication is of great importance. However, traditional device fingerprint (DF) extraction methods have several disadvantages. First, existing DF extraction methods need private information from devices to compute DFs, which puts the privacy of devices at stake. Second, the manually designing features-based methods suffer from poor performance. To tackle these limitations, we propose a Linear Residual Neural Network-based DF extraction method, Res-DFNN, which utilizes network packet data in the pcap file to generate DF. The key block is designed according to symmetry, and it is verified by simulation that our method achieves better performance in both non-private and privacy-preserving scenarios.

Adversarially robust and real-time DDoS detection and classification framework using AutoML

ABSTRACT Denial of Service (DoS) attacks target the availability part of the CIA triad (Confidentiality, Availability, and Integrity). A special category of these attacks is the Distributed DoS (DDoS) attack, where the attacker uses a network of compromised systems called a botnet to flood a target server with requests and refuses to serve legitimate users. DDoS attacks can cost an organization millions of dollars in terms of lost revenue, remediation costs, and damage to brand reputation. Hence, all organizations need speedy real-time detection of DDoS attacks. This work presents a DDoS detection and classification framework using the flow-based approach for feature engineering and the AutoML technique. Our detection system is trained on the latest DDoS datasets – CIC-DDoS 2019 and CIC-IDS 2017, which contain various categories of DDoS attacks. We use various tools to perform adversarial attacks on our trained model. We retrain our models using adversarially crafted network packet captures and then test our models for robustness against practical adversarial attacks that an attacker might use to evade detection. Finally, we deploy our model in real-time using a GUI-based tool. Our model achieves a validation accuracy of 99.9% and a low false positive rate of 0.05%.

Malicious Packet Detection Technology Using Reinforcement Learning

In the present day, the advancement of 5G and Internet of Things (IoT) technology has resulted in the interconnectedness of everyday objects through networks. However, attempts to exploit networked computers for malicious purposes continue to rise while the attacks utilizing malicious codes to compromise user information's confidentiality and integrity are becoming increasingly sophisticated and intelligent. To counter these evolving threats, researches have been conducted on a method to identify malicious network packets using a combination of security control systems and Artificial Intelligence (AI) technology, especially supervised learning. Unfortunately, the current cybersecurity control systems suffer from inefficiencies in terms of both manpower and cost. Moreover, the surge in remote work has created challenges in responding swiftly to security incidents. Furthermore, the existing AI technology based on supervised learning has limitations, particularly in detecting new variants of malicious code, and its accuracy in identifying malicious code depends heavily on the quantity and quality of available data. In light of these challenges, this study, reinforcement learning is employed to overcome the limitations of the original supervised learning-based malicious packet detection system, such as high dependency on training data and the failure to detect variant malicious packets. This research proposes a malicious packet detection technology capable of addressing new malicious packets or variant types effectively.

DDoS Protection System for SDN Network Based on Multi Controller and Load Balancer

DDoS attacks on SDN networks can create a single point of failure that has the potential to disrupt the overall network performance. In a single controller scheme, there is a potential risk of experiencing buffer overload, leading to traffic congestion as switches must wait for responses from the controller before forwarding network packets. To address this challenge, this research implements security measures using a multi-controller and load balancer approach, aiming to enhance SDN network resilience against DDoS attacks. The system operates by distributing the workload from the main controller to a backup controller through a load balancer when indications of a DDoS attack are detected. These attack indications are determined based on the miss rate value of unique forwarding requests exceeding a specific threshold. The results of this approach have proven effective in improving the reliability, responsiveness, and quality of SDN network traffic during DDoS attacks. The testing parameters involved in this research include controller response time and network traffic quality, comprising latency, bandwidth, throughput, and jitter. Based on the test results, the multi-controller and load balancer-based approach successfully enhanced network quality and controller responsiveness by 66.51% compared to the longer single controller scenario, specifically 202.49% during DDoS attacks. In terms of controller responsiveness, there is a very slight increase of around 0.01% in latency between the two. While Multi Controller demonstrated a remarkable 43.21% increase in throughput compared to Single Controller, this improvement in throughput is accompanied by a significant 204% increase in jitter.

ADVANCES IN NETWORK SECURITY FOR A RESILIENT DIGITAL CYBERSPACE INFRASTRUCTURE

In network security, safeguarding digital cyberspace infrastructure against malicious intrusions remains a paramount concern. This study addresses this imperative by proposing a novel approach that integrates digital watermarking, Huffman coding, and sophisticated attack classification techniques within the Controller Area Network (CAN) protocol framework. The proliferation of interconnected systems and the increasing sophistication of cyber threats necessitate novel strategies to fortify network defenses and ensure resilience in the face of adversarial activities. The research problem revolves around the need to develop an effective method for detecting and categorizing reconnaissance and violent attacks within cyberspace networks, particularly those utilizing the CAN protocol. Despite advancements in security protocols and intrusion detection systems, existing methodologies often fall short in accurately distinguishing between benign and malicious network activities, leaving critical infrastructure vulnerable to exploitation. This research uses digital watermarking to embed metadata within network packets, Huffman coding for efficient data compression, and advanced attack classification algorithms for real-time threat identification. The experimental results demonstrate the efficacy of the proposed approach in accurately differentiating between reconnaissance probes and violent attacks, thereby enabling timely and targeted responses to mitigate security threats.

Hardware-Free Network Internals Exploration

In undergraduate computer networking courses, the ideal scenario involves demonstrating network communications with multiple interconnected computers and a packet sniffer tool. However, practical challenges arise when attempting hands-on exercises, such as accessing or reconfiguring physical computers for online networking practice. Additionally, certain network concepts, like routing and switching, are typically discussed theoretically due to the limitations of observing external network packet transfers and the constraints faced by institutions in maintaining the necessary hardware for hands-on practice. This paper introduces a simulation-based approach to facilitate the teaching and learning of computer networking internals in an online environment, eliminating the need for dedicated hardware devices. The paper outlines various simulation activities and experiments designed to assist instructors in teaching and enable students to explore these internal networking concepts effectively.

Device-to-device based path selection for post disaster communication using hybrid intelligence

Public safety network communication methods are concurrence with emerging networks to provide enhanced strategies and services for catastrophe management. If the cellular network is damaged after a calamity, a new-generation network like the internet of things (IoT) is ready to assure network access. In this paper, we suggested a framework of hybrid intelligence to find and re-connect the isolated nodes to the functional area to save life. We look at a situation in which the devices in the hazard region can constantly monitor the radio environment to self-detect the occurrence of a disaster, switch to the device-to-device (D2D) communication mode, and establish a vital connection. The oscillating spider monkey optimization (OSMO) approach forms clusters of the devices in the disaster area to improve network efficiency. The devices in the secluded area use the cluster heads as relay nodes to the operational site. An oscillating particle swarm optimization (OPSO) with a priority-based path encoding technique is used for path discovery. The suggested approach improves the energy efficiency of the network by selecting a routing path based on the remaining energy of the device, channel quality, and hop count, thus increasing network stability and packet delivery.

Uncovering the Limitations and Insights of Packet Status Prediction Models in IEEE 802.15.4-Based Wireless Networks and Insights from Data Science

Wireless networks play a pivotal role in various domains, including industrial automation, autonomous vehicles, robotics, and mobile sensor networks. This research investigates the critical issue of packet loss in modern wireless networks and aims to identify the conditions within a network’s environment that lead to such losses. We propose a packet status prediction model for data packets that travel through a wireless network based on the IEEE 802.15.4 standard and are exposed to five different types of interference in a controlled experimentation environment. The proposed model focuses on the packetization process and its impact on network robustness. This study explores the challenges posed by packet loss, particularly in the context of interference, and puts forth the hypothesis that specific environmental conditions are linked to packet loss occurrences. The contribution of this work lies in advancing our understanding of the conditions leading to packet loss in wireless networks. Data are retrieved with a single CC2531 USB Dongle Packet Sniffer, whose pieces of information on packets become the features of each packet from which the classifier model will gather the training data with the aim of predicting whether a packet will unsuccessfully arrive at its destination. We found that interference causes more packet loss than that caused by various devices using a WiFi communication protocol simultaneously. In addition, we found that the most important predictors are network strength and packet size; low network strength tends to lead to more packet loss, especially for larger packets. This study contributes to the ongoing efforts to predict and mitigate packet loss, emphasizing the need for adaptive models in dynamic wireless environments.

Safeguarding IoT networks: Mitigating black hole attacks with an innovative defense algorithm

The Internet of Things (IoT) and Wireless Sensor Networks (WSNs) have rapidly spread in recent decades, leading to remarkable innovation and integrated possibilities. The switch from IPv4 to IPv6, made possible by advancements in networking technology and the use of nanodevices, has further improved connectivity. This move allows for connecting a wider range of devices to servers. Nevertheless, the increasing interconnectivity has brought about difficulties in efficiently overseeing and analysing the enormous amount of data produced throughout all levels of the IoT. The requirement of comprehensive security management is particularly concerning for IoT devices due to their large quantity and small size. Within the layered architecture of IoT, the network layer assumes pivotal importance in ensuring security, bearing responsibility for storing routing information and executing corresponding decisions. The Black Hole attack is a frequently encountered and significant concern among the security attacks addressed. This paper thoroughly examines the consequences of the Black Hole attack on IoT networks, carefully analyzing its impact. Furthermore, it presents a novel mitigation algorithm designed to counter such threats efficiently. The research employs NS2 and Simulink to run extensive simulations, enabling the evaluation of network throughput and Packet Delivery Ratio (PDR). Applying the proposed mitigation strategy to a network affected by the Black Hole attack results in a significant improvement in throughput, which closely resembles that of an unaffected network. The observed Packet Delivery Ratio (PDR) is measured at 98.21%. This highlights the algorithm’s effectiveness in mitigating the detrimental effects of the Black Hole attack on IoT networks.

Automated Network Incident Identification through Genetic Algorithm-Driven Feature Selection

The cybersecurity landscape presents daunting challenges, particularly in the face of Denial of Service (DoS) attacks such as DoS Http Unbearable Load King (HULK) attacks and DoS GoldenEye attacks. These malicious tactics are designed to disrupt critical services by overwhelming web servers with malicious requests. In contrast to DoS attacks, there exists nefarious Operating System (OS) scanning, which exploits vulnerabilities in target systems. To provide further context, it is essential to clarify that NMAP, a widely utilized tool for identifying host OSes and vulnerabilities, is not inherently malicious but a dual-use tool with legitimate applications, such as asset inventory services in company networks. Additionally, Domain Name System (DNS) botnets can be incredibly damaging as they harness numerous compromised devices to inundate a target with malicious DNS traffic. This can disrupt online services, leading to downtime, financial losses, and reputational damage. Furthermore, DNS botnets can be used for other malicious activities like data exfiltration, spreading malware, or launching other cyberattacks, making them a versatile tool for cybercriminals. As attackers continually adapt and modify specific attributes to evade detection, our paper introduces an automated detection method that requires no expert input. This innovative approach identifies the distinct characteristics of DNS botnet attacks, DoS HULK attacks, DoS GoldenEye attacks, and OS-Scanning, explicitly using the NMAP tool, even when attackers alter their tactics. By harnessing a representative dataset, our proposed method ensures robust detection of such attacks against varying attack parameters or behavioral shifts. This heightened resilience significantly raises the bar for attackers attempting to conceal their malicious activities. Significantly, our approach delivered outstanding outcomes, with a mid 95% accuracy in categorizing NMAP OS scanning and DNS botnet attacks, and 100% for DoS HULK attacks and DoS GoldenEye attacks, proficiently discerning between malevolent and harmless network packets. Our code and the dataset are made publicly available.

Recursive Quantization-based Event Triggered Observer for Networked Systems Under Network Congestion and Packet Loss

Recursive Quantization-based Event Triggered Observer for Networked Systems Under Network Congestion and Packet Loss

A new intelligent cross-domain routing method in SDN based on a proposed multiagent reinforcement learning algorithm

PurposeA cross-domain intelligent software-defined network (SDN) routing method based on a proposed multiagent deep reinforcement learning (MDRL) method is developed.Design/methodology/approachFirst, the network is divided into multiple subdomains managed by multiple local controllers, and the state information of each subdomain is flexibly obtained by the designed SDN multithreaded network measurement mechanism. Then, a cooperative communication module is designed to realize message transmission and message synchronization between the root and local controllers, and socket technology is used to ensure the reliability and stability of message transmission between multiple controllers to acquire global network state information in real time. Finally, after the optimal intradomain and interdomain routing paths are adaptively generated by the agents in the root and local controllers, a network traffic state prediction mechanism is designed to improve awareness of the cross-domain intelligent routing method and enable the generation of the optimal routing paths in the global network in real time.FindingsExperimental results show that the proposed cross-domain intelligent routing method can significantly improve the network throughput and reduce the network delay and packet loss rate compared to those of the Dijkstra and open shortest path first (OSPF) routing methods.Originality/valueMessage transmission and message synchronization for multicontroller interdomain routing in SDN have long adaptation times and slow convergence speeds, coupled with the shortcomings of traditional interdomain routing methods, such as cumbersome configuration and inflexible acquisition of network state information. These drawbacks make it difficult to obtain global state information about the network, and the optimal routing decision cannot be made in real time, affecting network performance. This paper proposes a cross-domain intelligent SDN routing method based on a proposed MDRL method. First, the network is divided into multiple subdomains managed by multiple local controllers, and the state information of each subdomain is flexibly obtained by the designed SDN multithreaded network measurement mechanism. Then, a cooperative communication module is designed to realize message transmission and message synchronization between root and local controllers, and socket technology is used to ensure the reliability and stability of message transmission between multiple controllers to realize the real-time acquisition of global network state information. Finally, after the optimal intradomain and interdomain routing paths are adaptively generated by the agents in the root and local controllers, a prediction mechanism for the network traffic state is designed to improve awareness of the cross-domain intelligent routing method and enable the generation of the optimal routing paths in the global network in real time. Experimental results show that the proposed cross-domain intelligent routing method can significantly improve the network throughput and reduce the network delay and packet loss rate compared to those of the Dijkstra and OSPF routing methods.

НЕЙРОННІ МЕРЕЖІ УВИЯВЛЕННІ АТАК НА РОЗПОДІЛЕНІ СИСТЕМИ

Modern challenges in processing vast amounts of data are solved with the help of complex distributed systems, which in turn require cyber protection, that has the instruments for managing security riskssuch as information acquisition, espionage, reduction of system productivity, etc. This article provides an overview of some approaches to detecting cyberattacks, which in particular use machine learning. Their advantages, disadvantages, work methods, vulnerabilities, and approaches to their protection are given. Approaches to using various machine learning modelsfor pre-processing input data, which is subsequently analyzed by intrusion detectors, and ways of improving the accuracy and effectiveness of cyberattack identification were also investigated.As a result of the analysis of research, it is shown that there is a need to combine data from various attack detection systems used at different layers of cyber defense. The use of attack detection systems in different layers of the system allows the detection of such attacks as SQL insertion, obtaining administrator rights, acquiring access to the node, DDoS, and Probe. This can be done by analyzing logs, or network packets in case of SQL insertion, or by monitoring Internet traffic during a DDoS attack. Taking into account the growing variety of attacks on distributed systems and the increase in the amount of information being processed, the use of machine learning in attack detection systems is becoming an increasingly attractive direction for study. Artificial intelligence can be involved in selecting the necessary features for analysis, detecting interven-tions, reducing the level of false attack detections, and improving the accuracy of their recognition. The ability to retrainthe model on new data is a significant advantage due to the small number of available test datasets dedicated to attacks on dis-tributed systems. There is a need to investigate the feasibility of using certain machine learning models and neural networks, based on available input data and requirements for accuracy and speed.It has been determined that anomaly detection is the most common approach to recognizing attacks using machine learning in the commercial product market. Analysis of attacks against machine learning-based defenses that use an anomaly detection approach has shown that there are weaknesses that can be minimized with additional protection; for example, time-distributed attacks can adapt to acceptable ranges of deviation of network indicators. An overview of the mechanisms for ensuring the resistance of protection systems tosuch influences, including the addition of various noises during training, range reduction of system parameter values, variations in retraining the model on misleading data, and the use of special classifiers, was performed

P4flow: A software-defined networking approach with programmable switches for accounting and forwarding IPv6 packets with user-defined flow label tags

A comprehensive analysis of the HEP (High Energy Physics) experiment traffic across LHCONE (Large Hadron Collider Open Network Environment) and other networks, is essential for immediate network optimisation (for example by the NOTED project) and highly desirable for long-term network planning. Such an analysis requires two steps: tagging of network packets to indicate the type and owner of the traffic being carried and then processing of the tagged packets. The RNTWG (Research Network Technical Working Group) has defined a specification to identify the experiment and the application that originates a given network flow, named scitags (Scientific Network Tags) that is applied to the flow label field of the IPv6 header. We report here on the second step: processing of packets tagged according to this specification. We developed P4flow as a software-defined networking approach by using P4 (Programming Protocol-Independent Packet Processors), a language for programming the data plane of network devices to accounting and process IPv6 packets with a scitags-based stamp in the flow label field, to understand the network utilisation and the applications used by the WLCG (Worldwide Large Hadron Collider Computing Grid) sites. With P4flow, and exploiting the control plane capabilities provided by RARE/FreeRtr (an Open Source Network Operating System developed by the GÉANT community), we cannot only generate statistics concerning the traffic per experiment and application but can also, using an Intel Tofino P4-programmable ASIC Ethernet Switch, decide how to forward traffic matching defined flow labels. This latter capability is particularly interesting as we prepare for a future where LHC experiments will be sharing network links with other major science collaborations such as SKA and ITER.