Packet Header Research Articles

DDoS Attack Detection Model using Machine Learning Algorithm in Next Generation Firewall

Next generation firewall is taking major part to secure network environment in the industry. This device will monitor all the traffic which is coming inside the network or going outside of the network. With all these security devices attackers can still perform various kind of attacks on the network. DDoS attack is one of the hardest attack to identify which will send packets to the network and which will look like normal traffic but it will act as a DDoS traffic. In this paper we used binary decision tree, XGBoost and support vector machine to identify DDoS attack traffic pattern from the different features in the packet header. Data will be fetched from the packet header and among them standard deviation of the packet bytes and packet flows are the features considered. We have applied this data on the trained dataset. Algorithm will predict whether the traffic coming inside the network is trusted or not. Out of the three algorithms Binary Decision tree algorithm is giving 99 percentage of accuracy and will predict the data as fast as possible. Here priority is to filter DDos attacks of any security level in the line speed of the NIDS or any other appliances. This method of DDoS attack detection will add extra layer of security in the next generation firewall which will make firewall more robust.

FedACT: an adaptive chained training approach for federated learning in computing power networks

Federated Learning (FL) is a novel distributed machine learning methodology that addresses large-scale parallel computing challenges while safeguarding data security. However, the traditional FL model in communication scenarios, whether for uplink or downlink communications, may give rise to several network problems, such as bandwidth occupation, additional network latency, and bandwidth fragmentation. In this paper, we propose an adaptive chained training approach (FedACT) for FL in computing power networks. First, a Computation-driven Clustering Strategy (CCS) is designed. The server clusters clients by task processing delays to minimize waiting delays at the central server. Second, we propose a Genetic-Algorithm-based Sorting (GAS) method to optimize the order of clients participating in training. Finally, based on the table lookup and forwarding rules of the Segment Routing over IPv6 (SRv6) protocol, the sorting results of GAS are written into the SRv6 packet header, to control the order in which clients participate in model training. We conduct extensive experiments on two datasets of CIFAR-10 and MNIST, and the results demonstrate that the proposed algorithm offers improved accuracy, diminished communication costs, and reduced network delays.

Detection of Burst Header Packet Flooding Attacks via Optimization based Deep Learning Framework in Optical Burst Switching Network

Detection of Burst Header Packet Flooding Attacks via Optimization based Deep Learning Framework in Optical Burst Switching Network

Tel-MPLS: a new method for maximizing the utilization of IP telephony over MPLS networks

Currently, the multiprotocol label switching (MPLS) standard is extremely prevalent. By exploiting the features provided by MPLS technology, a range of services, including IP telephony, have enhanced their overall performance. However, due to the size of the packet header, the IP telephony service consumes a significant portion of the MPLS network's available bandwidth. For instance, in IP telephony over MPLS networks, the packet header might account for as much as 80% of lost time and bandwidth. Designers working on IP telephony are making substantial efforts to address this issue. This study contributes to current efforts by proposing a novel approach called Tel-MPLS, which involves IP telephony over MPLS. TelMPLS approach uses the superfluous fields in the IP telephony packet's header to retain the packet data, therefore lowering or zeroing the IP telephony packet's payload. Tel-MPLS is an approach that significantly reduces the bandwidth of IP telephony MPLS networks. According to the findings, the Tel-MPLS approach is capable of reducing the amount of bandwidth that is lost by 12% when using the G.729 codec.

Scalable packet classification based on rule categorization and cross-producting

Packet classification performs multidimensional point location upon fields in packet headers to categorize packets into multiple forwarding classes based on pre-defined rules. It plays an important role for the data plane of software-defined networking (SDN). Packet classification is also applied to support quality of service and network security. In this work, we propose an algorithm, Segregated Cross-producting, to improve the scalability of cross-producting in term of storage. Our algorithm starts by categorizing rules according to their length combinations, where the rules of the same length combination do not incur any storage penalty for cross-producting. Then, the algorithm selectively merges rules of different length combinations to improve the search performance. Our scheme is suitable for parallel implementation to further improve speed performance and can support real-time incremental updates. We extensively evaluate the performance of our scheme with rulesets of different sizes and characteristics. The experiment results show that our scheme can provide superior scalability for both speed and space performance.

Network Layer Privacy Protection Using Format-Preserving Encryption

Format-Preserving Encryption (FPE) algorithms are symmetric cryptographic algorithms that encrypt an arbitrary-length plaintext into a ciphertext of the same size. Standardisation bodies recognised the first FPE algorithms (FEA-1, FEA-2, FF1 and FF3-1) in the last decade, and they have not been used for network layer privacy protection so far. However, their ability to encrypt arbitrary-length plaintext makes them suitable for encrypting selected packet header fields and replacing their original value with ciphertext of the same size without storing excessive information on the network element. If the encrypted fields carry personally identifiable information, it is possible to protect the privacy of the endpoints in the communication. This paper presents our research on using FPE for network layer privacy protection and describes LISPP, a lightweight, stateless network layer privacy protection system. The system was developed for programmable smart network interface cards (NIC) and thoroughly tested in a real network environment. We have created several implementations ranging from pure P4 to a mix of P4 and C implementations, exploring their performance and the suitability of target-independent P4 language for such processor-intensive applications. Finally, LISPP achieved line rate TCP throughput, up to 4.5 million packets per second, with the penalty of only 30 to 60 microseconds of additional one-way delay, proving that it is adequate for use in production networks. The most efficient implementation was with the FF3-1 algorithm developed in C and carefully adapted to the specific hardware configuration of the NIC.

An FPGA-Based High-Performance Stateful Packet Processing Method.

Compared to a stateless data plane, a stateful data plane offloads part of state information and control logic from a controller to a data plane to reduce communication overhead and improve packet processing efficiency. However, existing methods for implementing stateful data planes face challenges, particularly maintaining state consistency during packet processing and improving throughput performance. This paper presents a high-performance, FPGA (Field Programmable Gate Array)-based stateful packet processing approach, which addresses these challenges utilizing the PHV (Packet Header Vector) dynamic scheduling technique to ensure flow state consistency. Our experiments demonstrate that the proposed method could operate at 200 MHz while adding 3-12 microseconds latency. The method we proposed also provides a considerable degree of programmability.

Packet Header Recognition Utilizing an All-Optical Reservoir Based on Reinforcement-Learning- Optimized Double-Ring Resonators

Packet Header Recognition Utilizing an All-Optical Reservoir Based on Reinforcement-Learning- Optimized Double-Ring Resonators

Packet Classification Using TCAM of Narrow Entries

Packet classification based on rules of packet header fields is the key technology for enabling software-defined networking (SDN). Ternary content addressable memory (TCAM) is a widely used hardware for packet classification; however, commercially available TCAM chips have only limited storage. As the number of supported header fields in SDN increases, the number of supported rules in a TCAM chip is reduced. In this work, we present a novel scheme to enable packet classification using TCAM with entries that are narrower than rules by storing the most representative field of a ruleset in TCAM. Due to the fact that not all rules can be distinguished using one field, our scheme employs a TCAM-based multimatch packet classification technique to ensure correctness. We further develop approaches to reduce redundant TCAM accesses for multimatch packet classification. Although our scheme requires additional TCAM accesses, it supports packet classification upon long rules with narrow TCAM entries, and drastically reduces the required TCAM storage. Our experimental results show that our scheme requires a moderate number of additional TCAM accesses and consumes much less storage compared to the basic TCAM-based packet classification. Thus, it can provide the required scalability for long rules required by potential applications of SDN.

AT-GCN: A DDoS attack path tracing system based on attack traceability knowledge base and GCN

The rapid development of the Internet provides sufficient attack entrances for massive malicious terminals, which makes it extremely challenging to effectively trace the path of DDoS attacks. Traditional solutions mainly trace distributed denial of service (DDoS) attacks by adding tags to data packet headers or querying logs, which increases the cost of tagging. There are also some works that implement attack tracking based on the network-wide perspective and centralized control of SDN, but these methods are difficult to deploy on a large scale. In order to solve this problem, we propose a DDoS attack path tracing system (AT-GCN) based on attack traceability knowledge base and graph convolutional network (GCN). We first propose the construction process of the attack traceability knowledge base, and design the intra-domain attack graph and the traceability algorithm recommendation graph to solve the problems of DDoS attack path traceability and optimal traceability solution recommendation. On this basis, we propose a GCN-based intra-domain attack traceability scheme, and design a subgraph sampling algorithm Tracing-Sample adapted to intra-domain DDoS attack traceability, aiming to efficiently use the graph structure in the knowledge base to reproduce DDoS attack paths. Additionally, we recommend the traceability algorithm based on user-based collaborative filtering (UBCF), and dynamically recommend the best traceability algorithm according to the different requirements of administrators for traceability performance. Compared with other GCN algorithms, the results show that the recall of the AT-GCN system is increased by 7.3% on average, and the FPR is reduced by 5.7% on average at the expense of the memory usage rate. Under different scale topologies, the recall of the AT-GCN system can be stabilized at 95%.

Hybrid Detection Technique for IP Packet Header Modifications Associated with Store-and-Forward Operations

The detection technique for IP packet header modifications associated with store-and-forward operation pertains to a methodology or mechanism utilized for the identification and detection of alterations made to packet headers within a network setting that utilizes a store-and-forward operation. The problem that led to employing this technique lies with the fact that previous research studies expected intrusion detection systems (IDSs) to perform everything associated with inspecting the entire network transmission session for detecting any modification. However, in the store-and-forward process, upon arrival at a network node such as a router or switch, a packet is temporarily stored prior to being transmitted to its intended destination. Throughout the duration of storage, IDS operation tasks would not be able to store that packet; however, it is possible that certain adjustments or modifications could be implemented to the packet headers that IDS does not recognize. For this reason, this current research uses a combination of a convolutional neural network and long short-term memory to predict the detection of any modifications associated with the store-and-forward process. The combination of CNN and LSTM suggests a significant improvement in the model’s performance with an increase in the number of packets within each flow: on average, 99% detection performance was achieved. This implies that when comprehending the ideal pattern, the model exhibits accurate predictions for modifications in cases where the transmission abruptly increases. This study has made a significant contribution to the identification of IP packet header modifications that are linked to the store-and-forward operation.

Random Segmentation: New Traffic Obfuscation against Packet-Size-Based Side-Channel Attacks

Despite encryption, the packet size is still visible, enabling observers to infer private information in the Internet of Things (IoT) environment (e.g., IoT device identification). Packet padding obfuscates packet-length characteristics with a high data overhead because it relies on adding noise to the data. This paper proposes a more data-efficient approach that randomizes packet sizes without adding noise. We achieve this by splitting large TCP segments into random-sized chunks; hence, the packet length distribution is obfuscated without adding noise data. Our client–server implementation using TCP sockets demonstrates the feasibility of our approach at the application level. We realize our packet size control by adjusting two local socket-programming parameters. First, we enable the TCP_NODELAY option to send out each packet with our specified length. Second, we downsize the sending buffer to prevent the sender from pushing out more data than can be received, which could disable our control of the packet sizes. We simulate our defense on a network trace of four IoT devices and show a reduction in device classification accuracy from 98% to 63%, close to random guessing. Meanwhile, the real-world data transmission experiments show that the added latency is reasonable, less than 21%, while the added packet header overhead is only about 5%.

A Negotiation-Based Scheme for Interconnecting Heterogeneous Networks With Enhanced Services

Although the TCP/IP protocols have made great contributions to the development of the Internet, there is a consensus that the Internet needs improvement to solve the address space exhausted, content-oriented service, and so on. The academic community has proposed lots of valuable but heterogeneous network protocols, which provide better network services but split the Internet. To connect these heterogeneous networks, many middleboxes (e.g.,NAT and Tunnel) are deployed on the Internet, but these middleboxes mask the communication peers and shield various network services that are provided by these heterogeneous networks. In this article, we propose the HNN (heterogeneous networks negotiation), which provides transparent end-to-end communication and connects heterogeneous networks stateless in the data plane. What's more, HNN enables the host to perceive the available network service provided by heterogeneous networks and helps the host structure appropriate packet header and packet forwarding path to take advantage of these heterogeneous network services. We implement and evaluate an HNN prototype with commodity Barefoot Tofino programmable switch S9180-32X. The evaluation results demonstrate that HNN introduces little processing time overhead (no more than 3%) compared to well-known heterogeneous connectivity techniques (i.e.,NAT and Tunnel) and allows hosts to utilize heterogeneous network services.

Enhancing energy utilization for high power node multicasting in wireless sensor networks

In multicasting packets of data from a node will be sent to a group of receiver nodes at the same time. Multicasting lowers transmission costs. Energy conservation is critical to a sensor network’s long-term viability. Sensor networks have limited and non-replenishable energy supplies, maximizing network lifetime is crucial in sensor nodes. As a result, clustering has become one of the popular methods for extending the lifetime of an entire system by integrating information at the cluster head. Cluster head (CH) selection is the important serving node in each cluster in the Wireless sensor networks (WSN). This paper introduces a High Power Node (HPN) multicasting approach which embeds a cluster of sink node data in packet headers to allow receiver for utilizing a approach for transferring multicast packet data via the shortest paths. The proposed Energy efficient multicasting cluster based routing (EEMCR) protocol utilized high power nodes, which shall play a critical role in minimal energy usage. The implementation findings demonstrate that, when compared with the previous methodologies, the suggested algorithm has enhanced in terms of packet delivery ratio (PDR), End to end delivery rate, efficiency and achieves low energy consumption. The proposed EEMCR obtain 95% efficiency. The results are then compared to other existing algorithms to determine the superiority of the proposed methodology.

MASK: Practical Source and Path Verification Based on Multi-AS-Key

The source and path verification in Path-Aware Networking considers the two critical issues: (1) end hosts could verify that the network follows their forwarding decisions, and (2) both on-path routers and destination host could authenticate the source of packets and filter the malicious traffic. Unfortunately, the state-of-the-art mechanisms require heavy communication overhead in the network and computation overhead in the router; moreover, it is difficult to meet the dynamic requirements of the end host. We propose a user-driven mechanism, source and path verification based on Multi-AS-Key (MASK). MASK decreases the communication overhead by a short additional packet header and reduces the computation overhead by separating the control and data plane in terms of the cryptographic operation. Furthermore, it utilizes the stateful user to instruct the stateless routers to process the packet with a user-driven policy, thus satisfying the user’s requirements such as detecting the packet drop and replay attack. With the plausible design, the communication overhead for realistic path lengths is 1/2 to 1/10 compared with the state-of-the-art mechanisms. We implement MASK in the BMv2 environment and commodity Barefoot Tofino programmable switch, testify that MASK introduces significantly less overhead than the state-of-the-art mechanisms, and demonstrate that MASK could achieve the verification in the programmable switch at line rate.

Implementation of Blockchain-Assisted Source Routing for Traffic Management in Software-Defined Networks

The control and infrastructure layers are split into Software-Defined Networks (SDNs). With the control and infrastructure planes split, new network applications may be developed with more simplicity and greater independence. On the other hand, the disadvantages of SDN create a slew of questions. In large-scale networks, such as Wide Area Networks (WANs) covering huge areas, more propagation delays substantially contribute to network convergence time. In addition, traditional SDN restricts network design flexibility due to the influence of controller location on network performance in large-scale networks. SDN-based source routing (SR) has emerged as a viable solution to the issues above, where the packet header field is used to specify a packet's route. This study presents an SR-based End-to-End (E2E) traffic management framework called SoRBlock. In SoRBlock, inter-domain routing uses blockchain technology, while intra-domain routing relies on the SR technique in SDNs. The simulation results show that the proposed SR-based SoRBlock framework outperforms the traditional hierarchical routing approach, HRA, in SDN networks by lowering path setup time (PST) and the number of controller messages. While the same (i.e., identical origin and target) service requests were used for all runs in the simulations, the proposed SoRBlock architecture presents almost three times less total PST between 45ms and 65ms than the HRA method between 130ms and 200ms due to the HRA approach's increased node-controller and controller-controller latencies. On the other hand, SoRBlock shows two times less PST ([75ms – 90ms]) than HRA ([150ms – 175ms]) when different service requests (i.e., different origin and target) were used. Concerning Controller Messages Processed (CMP), the HRA deals nearly 50% more controller messages between 7 and 15 than the SoRBlock between 3 and 10 when the number of domains varies, while the CMP in the SoRBlock scheme ([10 - 17]) approaches that in the HRA framework ([15 - 20]) regarding the ratio while the count of nodes rises in domains.

Lightweight Differentiated Transmission Based on Fuzzy and Random Modeling in Underwater Acoustic Sensor Networks.

Energy-efficient and reliable underwater acoustic communication attracts a lot of research due to special marine communication conditions with limited resources in underwater acoustic sensor networks (UASNs). In their final analysis, the existing studies focus on controlling redundant communication and route void that greatly influence UASNs' comprehensive performances. Most of them consider directional or omnidirectional transmission for partial optimization aspects, which still have many extra data loads and performance losses. This paper analyzes the main issue sources causing redundant communication in UASNs, and proposes a lightweight differentiated transmission to suppress extra communication to the greatest extent as well as balance energy consumption. First, the layered model employs layer ID to limit the scale of the data packet header, which does not need depth or location information. Second, the layered model, fuzzy-based model, random modeling and directional-omnidirectional differentiated transmission mode comb out the forwarders step by step to decrease needless duplicated forwarding. Third, forwarders are decided by local computation in nodes, which avoids exchanging controlling information among nodes. Simulation results show that our method can efficiently reduce the network load and improve the performance in terms of energy consumption balance, network lifetime, data conflict and network congestion, and data packet delivery ratio.

Implementation of Efficient Intrusion Detection of Imbalanced Network Traffic using Deep Learning

A crucial component of network security is intrusion detection, but this task can be difficult when dealing with statistics on the distribution of network traffic, where benign cases exceed malicious ones by a large margin. The goal of this project is to create a powerful intrusion detection system using a recurrent neural network (RNN) to address this problem. RNNs are excellent at identifying temporal dependencies in sequential data, which makes them useful for examining network traffic patterns. The suggested methodology calls for preprocessing the data, balancing the dataset, feature extraction, choosing an RNN model, training, assessing, adjusting, and monitoring in real time. The network traffic data is cleaned and formatted during the preprocessing stage, and balancing algorithms make sure the RNN is trained on a representative dataset. It then extracts pertinent aspects, including behavioral patterns and packet header data. Effective intrusion detection requires the use of an appropriate RNN architecture, such as LSTM or GRU. The model is subsequently trained, assessed using a range of criteria, and refined through iterations. The optimized RNN model is then implemented for real-time intrusion detection, monitoring network traffic continuously and producing alerts for probable intrusions. This research seeks to improve the precision and efficacy of network security systems, maintaining the integrity of crucial information in the linked world of today, by utilizing RNNs for intrusion detection in imbalanced network trafficking. Keywords IDS, Imbalanced Network Traffic, Deep Learning, Recurrent Neural Network.

Accelerating Pattern Matching Using a Novel Multi-Pattern-Matching Algorithm on GPU

Nowadays, almost all network traffic is encrypted. Attackers hide themselves using this traffic and attack over encrypted channels. Inspections performed only on packet headers and metadata are insufficient for detecting cyberattacks over encrypted channels. Therefore, it is important to analyze packet contents in applications that require control over payloads, such as content filtering, intrusion detection systems (IDSs), data loss prevention systems (DLPs), and fraud detection. This technology, known as deep packet inspection (DPI), provides full control over the communication between two end stations by keenly analyzing the network traffic. This study proposes a multi-pattern-matching algorithm that reduces the memory space and time required in the DPI pattern matching compared to traditional automaton-based algorithms with its ability to process more than one packet payload character at once. The pattern-matching process in the DPI system created to evaluate the performance of the proposed algorithm (PA) is conducted on the graphics processing unit (GPU), which accelerates the processing of network packets with its parallel computing capability. This study compares the PA with the Aho-Corasick (AC) and Wu–Manber (WM) algorithms, which are widely used in the pattern-matching process, considering the memory space required and throughput obtained. Algorithm tables created with a dataset containing 500 patterns use 425 and 688 times less memory space than those of the AC and WM algorithms, respectively. In the pattern-matching process using these tables, the PA is 3.5 and 1.5 times more efficient than the AC and WM algorithms, respectively.

DIWGAN Optimized with Namib Beetle Optimization Algorithm for Intrusion Detection in Mobile Ad Hoc Networks

ABSTRACT Mobile ad hoc network (MANET) plays a major role in wireless devices such as defense and flooding. Despite their smart applications, MANET faces more security issues than traditional wired and wireless networks on account of their distinct features, such as no central coordination, dynamic topology, temporal network life, and the nature of wireless communication. To overcome these issues, this manuscript proposes a Dual Interactive Wasserstein Generative Adversarial Network optimized with Namib Beetle Optimization Algorithm is proposed for intrusion detection and preventing attacks in MANET. By utilizing the One Way Hash Chain Function, mobile users first register with the Trusted Authority. Each mobile user sends a finger vein biometric along with their user id, latitude, and longitude for authentication verification. The packet analyzer, feature extraction, preprocessing, and classification are the four parts that make up intrusion detection. To determine if any attack patterns have been identified, the packet analyzer is examined. This is executed using a Type 2 Fuzzy Controller that deems packet header information. Anisotropic diffusion Kuwahara filtering techniques is time series is taken into consideration in the preprocessing unit. The battle royal optimization algorithm is utilized in the feature extraction unit to acquire a better collection of features for packet categorization. The classification unit classifies the packets into five categories: DoS, Probe, U2R, R2L, and Anomaly using the proposed technique. Finally, the proposed method provides 26.26%, 15.57%, 32.9% higher accuracy, 33.06%, 23.82%, and 38.84% lesser delay analysed to the existing models.