Address Port Research Articles

E-minBatch GraphSAGE: An Industrial Internet Attack Detection Model

The Industrial Internet has grown rapidly in recent years, and attacks against the Industrial Internet have also increased. When compared with the traditional Internet, the industrial Internet has a more complex network structure, and the traditional graph neural network attack behavior detection model cannot well adapt to the complex network environment. To make the model better adapt to the complex network environment, this paper proposes the E-minBatch GraphSAG model. First, the application layer source port and source IP address is used as source nodes, the application layer target port and target IP address are used as target nodes, and the remaining traffic information is used as edge information to complete the construction of the graph structure data, and then the constructed graph structure data is presampled to select the edge information that needs to be aggregated next, followed by using the AGG aggregation function to aggregate the information in the domain generated by the presampling process. Finally, the information of two adjacent nodes is aggregated as edge information to classify the edges. Increase the number of IP addresses in the UNSW-NB15 dataset, and then use it for model training and testing. The experimental results show that the accuracy of the model reaches 99.49% in a relatively complex network environment. In this paper, the E-minBatch GraphSAG model is presented in an attempt to solve the problem of attack detection in the complex industrial Internet environment.

Research on Network Routing Control Algorithm Based on OpenFlow and IGP

Given the coexistence of heterogeneous hybrid networks such as IP network, 4G network and Software Defined Network (SDN) in the application of digital news media system, this paper designs a routing control algorithm based on SDN network architecture, which can realize the compatibility of internal gateway protocol and OpenFlow communication strategies. Through the analysis of OpenFlow communication protocol in SDN network architecture, the relationship between Interior Gateway Protocol (IGP) and OpenFlow routing rules is found out. Based on the existing hardware structure of the OpenFlow router, the configuration parameters of a port table, port address table and routing table are improved, and the adjacent routing relation table and information transmission port are used to realize the connection between routers are designed. The attention of users is considered It can reduce the burden of system operation and is compatible with the forwarding control of route forwarding and routing filtering. The adjacent routing relation table is designed to control the process of data collection, storage and forwarding, and the input and output ports between adjacent routers are defined. The open router designed in this paper integrates Simple Network Management Protocol (SNMP) agent and SDN agent mechanism organically to achieve the goal of SDN network management; the routing control module focuses on the management of key data flow, realizes the control of routing state and data flow at the same time, and provides the visualization function of routing state and routing state data flow. By constructing the experimental platform of routing transmission and control functions based on routing control and interior gateway protocol, the effect of routing state control of the two methods is compared and analysed from three aspects of packet transmission state, packet processing state and packet receiving delay in routing control process. The experimental results verify the correctness of the design results.

SPEChecker: Checking the feasibility of Slow-port-exhaustion attack on various hypervisors

Nowadays, with the emergence of IoT technologies, the number of devices connected to the Internet is rapidly increasing. As a result, Network Address Translation (NAT) mechanism is widely used to let multiple devices within a private network make use of a fewer number of public IP addresses. In this research, we focus on Port Address Translation (PAT), an extension of the NAT mechanism that can translate both the IP address and the port number of a TCP/IP packet. An apparent downside of PAT is the fact that when all of the ports are used, no more new outbound connections could be made from the local addresses. In 2018, we introduced Slow-port-exhaustion DoS Attack on a virtual network, a novel type of DoS Attack that exploits some flaws of the TCP protocol and the limitation of the PAT mechanism. In this attack, a compromised internal virtual machine with a low amount of attack bandwidth can occupy the host machine’s ports for a long time and therefore makes other machines on the same virtual network could not connect to the external network. In this paper, we present SPEChecker, a testing tool that can be used to check the feasibility of the Slow-port-exhaustion attack on virtual networks. In the analysis, we also explore a case of a TCP Host that could support this attack. Our testing results also show the potential of SPEChecker in evaluating virtual network security.

Peer Connection Classifier Method for Load Balancing Technique

A large number of requests for internet access causes a long response time resulting in an overload problem. This problem occurs in offices that provide public services such as the Soeman HS Regional Library and Archives Office in Riau Province. So that service work is not disrupted due to overload, network optimization is carried out using Load Balancing Techniques. Load Balancing will balance load traffic on two or more connection lines so that traffic can run optimally. The method used is the Peer Connection Classifier (PCC). This method will divide the load based on the source, destination address, and port address. All internet requests from users will go to the router that has been configured with Load Balancing with the PCC method. The router will manage outgoing requests from users through the Internet Service Provider 1 (ISP 1) line or ISP line 2 to be able to enter the internet connection. The test results show equal distribution of outgoing access to ISP 1 and ISP 2 lines so that there is no overload on any ISP lines. This configuration will be applied to the Mikrotik router using the Winbox application.

Network intrusion detection with a novel hierarchy of distances between embeddings of hash IP addresses

Including high-dimensional categorical predictors in a machine learning model is a major challenge. This is particularly appropriate for the IP and Port addresses of network connections when they are considered as predictors (features) in machine learning models. These features are particularly important for network intrusion detection, as many attacks exploit information about IP/Port addresses. The sparsity and high dimensionality of these features make it difficult their inclusion into the models, being discarded as useful information in many cases. This work proposes to replace the original network addresses by new features based on a set of distances defined between different components of the source and destination IP and Port addresses. These distances incorporate information on the probability of co-occurrence of source and destination addresses. The distances are calculated using a dense, low-dimensional vector representation (embedding) of the different network address components. The embeddings are obtained with a neural network, which requires few computational resources, plus an additional hash function that collapses the extremely large range of IP and Port values, making the model implementation feasible. A self-supervised learning framework under a hierarchical model is used to train the encoding network.The novel features can be used to predict future co-occurrence of source and destination network addresses, and, when applied as features in a supervised model, they significantly increase the prediction performance of most classifiers for the detection of network intrusions. We demonstrate this prediction improvement over two modern network intrusion datasets: CICIDS2017 and CICDDoS2019.

Session layer security enhancement with md5 and multiplicative inverse cryptographic mechanism

This paper proposes MD5 and Multiplicative Inverse based Data Encryption Model for security of data during data transmission. It discusses about Cloud computing mechanism which is used to deliver information technology services. In cloud computing, Data security is biggest issue and significant aspect of Internet for enterprises of each size and type. However there are several existing researches that proposed different security mechanisms but they have certain limitations. Therefore this proposed model is developed to enhance the security of data at multiple layers. User defined port and IP address is used to make this proposed model more secure data transmission model. Moreover, the early session timeout is also controlled by reducing packet size. Proposed work would be capable to increase the efficiency of data communication along with security. In addition, unauthentic access of data is restricted using IP validation process.

Design of single layer banyan network using quantum-dot cellular automata for nanocommunication

Banyan network is a multistage communication architecture that route the input signal based on port address of receiver. The port address is recognized as a string. This paper illustrates the design of a novel single layer banyan network using QCA for nanocommunication. To design the proposed communication architecture, a new single layer 2-inputs and 2-outputs crossbar switch is proposed and implemented in QCA. Using this crossbar switch as a major building block, a 4x4, and 8x8 banyan networks have been achieved in this paper. The effect of stuck-at-fault at the control input is observed and excelled for fault free design of the crossbar switch. Similarly, the fault tolerant nature of the proposed banyan networks have been characterized by considering the stuck-at-fault effect at the control signals of crossbar switches within the architecture. The designs are evaluated considering device area, delay, and logic gates. Theoretical values have been matched up with the simulation results to verify design accuracy.

Characteristics and Temporal Behavior of Internet Backbone Traffic

With the rapid increase demand for data usage, Internet has become complex and harder to analyze. Characterizing the Internet traffic might reveal information that are important for Network Operators to formulate policy decisions, develop techniques to detect network anomalies, help better provision network resources (capacity, buffers) and use workload characteristics for simulations (typical packet sizes, flow durations, common protocols). In this paper, using passive monitoring and measurements, we show collected data traffic at Internet backbone routers. First, we reveal main observations on patterns and characteristics of this dataset including packet sizes, traffic volume for inter and intra domain and protocol composition. Second, we further investigate independence structure of packet size arrivals using both visual and computational statistics. Finally, we show the temporal behavior of most active destination IP and Port addresses.

Entropy-Based Anomaly Detection in a Network

Every computer on the Internet these days is a potential target for a new attack at any moment. In this paper we propose a method to enhance network security using entropy based anomaly detection. Intrusion detection system Snort is used for collecting the complete network traffic. Snort alert is then processed for selecting the attributes. Then Shannon entropies are calculated to analyze source IP address, source port address, destination IP address, destination port address, source IP threat, source port threat, destination IP threat, destination port threat and datagram length. Renyi cross entropy method is applied on Shannon entropy vector to detect network attack. After detecting attack in network, list of source IP address, source port address, destination IP address, destination port address with respective number of attack are generated for the advance protection of the network. This facilitates the network administrator to block/unblock IP addresses and ports where is attacks were detected. In this method about 90% attacks are detected. The rest 10% network traffic could not be detected. Since some low priority network traffic being treated as genuine traffic.

A keyed-hashing based self-synchronization mechanism for port address hopping communication

Port address hopping (PAH) communication is a powerful network moving target defense (MTD) mechanism. It was inspired by frequency hopping in wireless communications. One of the critical and difficult issues with PAH is synchronization. Existing schemes usually provide hops for each session lasting only a few seconds/minutes, making them easily influenced by network events such as transmission delays, traffic jams, packet dropouts, reordering, and retransmission. To address these problems, in this paper we propose a novel self-synchronization scheme, called ‘keyed-hashing based self-synchronization (KHSS)’. The proposed method generates the message authentication code (MAC) based on the hash based MAC (HMAC), which is then further used as the synchronization information for port address encoding and decoding. Providing the PAH communication system with one-packet-one-hopping and invisible message authentication abilities enables both clients and servers to constantly change their identities as well as perform message authentication over unreliable communication mediums without synchronization and authentication information transmissions. Theoretical analysis and simulation and experiment results show that the proposed method is effective in defending against man-in-the-middle (MITM) attacks and network scanning. It significantly outperforms existing schemes in terms of both security and hopping efficiency.

Estrategias de comercialización y marketing urbano: el producto Puerto Norte Rosario, Argentina

El objetivo es identificar las estrategias de comunicación y publicidad con que se abordan los públicos específicos del gran proyecto urbano de Puerto Norte, antiguamente predios del ferrocarril y el puerto. Se analiza también la dinámica del mercado inmobiliario, entre los años 2005 y 2014. La metodología se centra principalmente en el análisis de contenido de documentos escritos y gráficos. Además, se recurre a la modalidad interpretativa para realizar entrevistas semiestructuradas a actores claves. Los principales resultados evidencian que la comercialización se presenta de forma variada, en la que la oferta es restringida por los medios de comunicación a valores y representaciones simbólicas, entendiendo los proyectos como bienes de consumo.

QR code based blind digital image watermarking with attack detection code

A QR code based blind digital image watermarking technique with an attack detection feature is described here. The technique describes a key based framework to incorporate image, server port address or website address as watermark data; which increases the extended usability of the embedded data and the adaptability of the verification application. The watermarking problem is formulated as a signal communication problem with watermark data representation, embedding of watermark and attack detection as a source encoding, channel encoding and attenuation detection problems respectively. The mathematical aspects of the respective signal processing problems are extended to digital image watermarking with sufficient background support. The use of QR code ensures extended usability, while the application specific watermark data achieves adaptability of the verification application. The QR code is embedded into the attack resistant HH component of 1st level DWT domain of the cover image and to detect malicious interference by an attacker, a unique image registry code generated from the high frequency structural components of the stego-image is used. The key based approach and the attack resistant embedding domain makes this method robust against visually invariant attacks. The testing results show the compliance of the method with all the proposed aspects.

A Practical Method for Software Encryption

Some technical measures should be taken for software protection in addition to the laws and regulations. Software encryption is a commonly used method. The main methods of software encryption are introduced here firstly, and the characteristics of different methods are given. Then the idea of encryption card based on computer system bus is put forward. The design of logical circuit for the concrete realization is shown and the key detection process is described. The key is generated by the port address dynamically with the encryption card. There are several key with multi port. The encryption card is difficult to decrypt and is with good stability, high reliability.

An Area Optimized Robust Router Design Implementation

The router is a Network Router has a one input port from which the packet enters. It has three output ports where the packet is driven out. Packet contains 3 parts. They are Header, data and frame check sequence. Packet width is 8 bits and the length of the packet can be between 1 bytes to 63 bytes. Destination address(DA) of the packet is of 8 bits. The switch drives the packet to respective ports based on this destination address of the packets. Each output port has 8-bit unique port address. If the destination address of the packet matches the port address, then switch drives the packet to the output port, Length of the data is of 8 bits. In this paper the Xilinx ISE EDA Tool is used for synthesis and Modelsim is used for simulation.

Multi-Priority Frame Forwarding in Tree-Based Routing Ethernet

Local area network (LAN) technology is extensively employed in backbones and campus networks due to its excellent price/performance ratio and its installation convenience. However, with the increasing demand for multimedia and real-time applications, LAN requires additional operations to support Quality-of-Service (QoS). In this paper, we propose a novel bridge protocol that can forward frames with different priorities using different paths based on Hierarchical Local MAC (HLMAC) address. It can reduce storage requirement significantly and avoid broadcast storm to save bandwidth. The HLMAC can simplify the routing and avoid the need of all nodes having global knowledge of the network topology. Frame can be forwarded at very high speed by decoding the HLMAC gradually, without routing table lookuping or port address learning. Through simulation, it is shown that this protocol can improve the throughput and path length, and ensure the forwarding path of higher priority frame is superior to a lower priority frame.

A comparative study of attributes for gathering admissible evidence in the investigation of distributed denial of service (DDoS) attacks

Global crises have widened the scope of criminal activities that intruders commit on computer networks. However, available litigations to charge intruders are ineffective because most electronic evidence obtained from intrusion logs are inadmissible in several courts of law. Therefore, this paper critically discusses the concept of admissible evidence in courts of law and how forensics experts can extract them from intrusion logs. This paper also discusses a model that adopts information theory to reclassify attributes of intrusions that are used to extract admissible evidence. Evaluations demonstrate that majority of the attributes of distributed denial of service attacks are less informative. The results suggest that type of service, TCP flags, TTL, length of packet, destination IP address, TCP acknowledgement and IP protocol are less informative while source addresses, destination port address and timestamp are informative attributes for forensics investigation of distributed denial of service attacks investigated in this paper.

The Design and Implementation of Motion Control Card Based on DSP

A hardware implement scheme is proposed based on digital signal processor, and the complex programmable logic device and industry standard architecture bus is proposed. The dual-port random access memory communication circuit, I/O port address decoding circuit, two axis control output circuit and position detecting circuit are developed, the main program and interrupt-serving program of digital signal processor are designed by the idea of modularization. The static accuray of the motion control card is tested via special experimental device. The present analysis show that the designed circuit is effective and the static control precision of motion control card is satisfied.

A software architecture framework for on-line option pricing

The problem of growing computational complexity in the finance industry demands manageable, high-speed and real-time solutions in solving complex mathematical problems such as option pricing. In current option trading scenarios, determining a fair price for options "any time" and "anywhere" has become vital yet difficult computational problem. In this study, we have designed, implemented, and deployed an architecture for pricing options on-line using a hand-held device that is J2ME-based Mobile computing-enabled and is assisted by web mining tools. In our architecture, the client is a MIDP user interface, and the back end servlet runs on a standalone server bound to a known port address. In addition, the server uses table-mining techniques to mine real-time data from reliable web sources upon the mobile trader's directive. The server performs all computations required for pricing options since mobile devices have limited battery power, low bandwidth, and low memory. We have parallelized and implemented various computational techniques such as binomial lattice and finite differencing. To the best of our knowledge, this is one of the first studies that facilitate the mobile-enabled-trader to compute the price of an option in ubiquitous fashion. This architecture aims at providing the trader with various computational techniques to avail (to provide results from approximate to accurate results) while on-the-go and to make important and effective trading decisions using the results that will ensure higher returns on investments in options.

A PC parallel port button box provides millisecond response time accuracy under Linux

For psychologists, it is sometimes necessary to measure people's reaction times to the nearest millisecond. This article describes how to use the PC parallel port to receive signals from a button box to achieve millisecond response time accuracy. The workings of the parallel port, the corresponding port addresses, and a simple Linux program for controlling the port are described. A test of the speed and reliability of button box signal detection is reported. If the reader is moderately familiar with Linux, this article should provide sufficient instruction for him or her to build and test his or her own parallel port button box. This article also describes how the parallel port could be used to control an external apparatus.

Random pattern testability of memory address logic

An analytical method is described for determining the random pattern testability of faults in combinational logic feeding the address inputs of embedded memories. Difference information from replicated copies of embedding logic is used to determine the probability of detecting any fault in the upstream of either a read or write port address decoder. The method can be used with minor extensions to existing detection probability tools such as the cutting algorithm.