Protocol Header Research Articles

Cross-layer detection and defence mechanism against DDoS and DRDoS attacks in software-defined networks using P4 switches

This paper presents a comprehensive system for detecting and defending against distributed denial-of-service (DDoS) and distributed reflective denial-of-service (DRDoS) flood attacks in software-defined networking (SDN) environments using Programming Protocol-Independent Packet Processors (P4). The proposed system introduces a hybrid intrusion statistical threshold algorithm (HISTA) that analyzes intrusion data statistics to identify potential malicious attacks. Upon detection, the system utilises P4 programmability to implement a custom defence mechanism on the P4 switch. A novel Uruk protocol header collaborates with HISTA for enhanced cross-layer attack detection and categorisation. The HISTA-Uruk mechanism selectively discards malicious packets while ensuring uninterrupted communication for legitimate packets, effectively preventing DDoS/DRDoS attacks. Extensive experiments validate the system’s ability to efficiently detect and thwart various DDoS, DRDoS, and internal attacks, demonstrating its effectiveness in identifying threats and restoring impacted network connections across diverse attack scenarios.

Detecting and Preventing of DDoS Attack in Cloud Computing Environment Based on Hybrid Technique (Cloudflare and WAF)

The adoption of cloud computing has revolutionized data storage and processing globally. Nevertheless, the need for a close watch on security is paramount. Hence, the aim of this paper, to develop a cloud security model that detects and prevents the risks of Distributed Denial of Service (DDoS) attacks in cloud computing systems which are gravely potent and, on the increase, today. This was done using two approaches: analyzing Transmission Control Protocol/Internet Protocol (TCP/IP) header features of incoming packets in cloud computing environment in order to detect and classify spoofed IP address during DDoS attack via a custom-made Web Application Firewall (WAF); and the integration of the cloud resources with Cloudflare. The result shows that a total of 1,625,192 packets were transmitted in a short period which were captured and analyzed via Wireshark. Several TCP errors were observed over a very short time interval which indicated successful DDoS attack effectively crashing the system. The result varied when the custom-made WAF was put in place, and the attacking lab machine launched a TCP syn flood attack against the web server on port http port 80. A total of 2,353,585 packets were transmitted in a short period which were captured and analyzed using Wireshark and contained less TCP errors indicating successful mitigation of DDoS attacks. When the resources were hosted online and integrated with Cloudflare, integrity checks were successful before the resources were loaded, indicating complete mitigation of attacks. Keywords: Bandwidth, Botnet, Cloudflare, Wireshark and Zombie

A deep learning technique to detect distributed denial of service attacks in software-defined networks

Software-Defined Network (SDN) is an established networking paradigm that separates the control plane from the data plane. It has central network control, and programmability facilities, therefore SDN can improve network flexibility, management, performance, and scalability. The programmability and control centralization of SDN have improved network functions but also exposed it to security challenges such as Distributed Denial of Service (DDoS) attacks that target both control and data planes. This paper proposes an effective detection technique against DDoS attack in SDN control plane and data plane. For the control plane, the technique detects DDoS attacks through a Deep Learning (DL) model using new features extracted from traffic statistics. A DL method (AE-BGRU) for DDoS detection uses Autoencoder (AE) with Bidirectional Gated Recurrent Unit (BGRU). The proposed features for the control plane include unknown IP destination address, packets inter-arrival time, Transport layer protocol (TLP) header, and Type of service (ToS) header. For the data plane, the technique tracks the switch's average arrival bit rate with an unknown destination address in the data plane. Then, the technique detects DDoS attacks through a DL-based model which also uses AE with BGRU. The proposed features in the data plane include the switch's stored capacity, the average rate of packets with unknown destination addresses, the IP Options header, and the average number of flows. The dataset is generated from feature extraction and computations from normal and attack packets and used with the classifier. Also, additional Machine Learning (ML) methods are used to enhance the detection process. If the model detects an attack, the technique mitigates DDoS effects by updating the user's trust value and blocking suspicious senders based on the trust value. The experimental results proved that compared to related techniques, the suggested method had a higher accuracy and lower false alarm rate.

Unleashing the Power of Multi-Agent Deep Learning: Cyber-Attack Detection in IoT

Detecting botnet and malware cyber-attacks is a critical task in ensuring the security of computer networks. Traditional methods for identifying such attacks often involve static rules and signatures, which can be easily evaded by attackers. Dl is a subdivision of ML, has shown promise in enhancing the accuracy of detecting botnets and malware by analyzing large amounts of network traffic data and identifying patterns that are difficult to detect with traditional methods. In order to identify abnormal traffic patterns that can be a sign of botnet or malware activity, deep learning models can be taught to learn the intricate interactions and correlations between various network traffic parameters, such as packet size, time intervals, and protocol headers. The models can also be trained to detect anomalies in network traffic, which could indicate the presence of unknown malware. The threat of malware and botnet assaults has increased in frequency with the growth of the IoT. In this research, we offer a unique LSTM and GAN-based method for identifying such attacks. We utilise our model to categorise incoming traffic as either benign or malicious using a dataset of network traffic data from various IoT devices. Our findings show how well our method works by attaining high accuracy in identifying botnet and malware cyberattacks in IoT networks. This study makes a contribution to the creation of stronger and more effective security systems for shielding IoT devices from online dangers. One of the major advantages of using deep learning for botnet and malware detection is its ability to adapt to new and previously unknown attack patterns, making it a useful tool in the fight against constantly evolving cyber threats. However, DL models require large quantity of labeled data for training, and their performance can be affected by the quality and quantity of the data used. Deep learning holds great potential for improving the accuracy and effectiveness of botnet and malware detection, and its continued development and application could lead to significant advancements in the field of cybersecurity.

Вызовы в реализации систем глубокого анализа сетевого трафика методом полного протокольного декодирования

This paper presents a summary of experience in developing the deep packet inspection system using full protocol decoding. The paper reviews the challenges encountered during implementation and provides a high-level overview of the solutions to these issues. The challenges can be grouped into two groups. The first group is related to the fundamental tasks which must be addressed when implementing full protocol decoding systems. This includes ensuring correct protocol parsing, which involves identifying and interpreting protocol headers and fields correctly. Moreover, it is necessary to ensure the processing of fragmented packets and the assembly of fragments into the original message. Additionally, the processing and analysis of encrypted traffic is a crucial task that may require the use of specialized algorithms and tools. The second group of problems is related to optimizing the process of full protocol decoding to ensure high-speed traffic processing, as well as supporting new protocols and the ability to add user-defined extensions. While there are open-source systems that address some of the primary issues associated with full protocol decoding, there may be a need for additional effort and specialized solutions to efficiently operate and expand the functionality of such systems. Although implementing deep network traffic analysis tools using full protocol decoding requires the use of advanced hardware and software technologies, the benefits of such analysis are significant. This approach provides a more complete understanding of network traffic patterns and enables more effective detection and prevention of cyber-attacks. It also allows for more accurate monitoring of network performance and the identification of potential bottlenecks or other issues that may impact network efficiency. In this article, we also emphasize the importance of system architecture development and implementation to ensure the successful deployment of deep network traffic analysis tools using full protocol decoding. At last, we conducted an experiment where several advanced optimizations were implemented in the system that had already solved primary issues. These optimizations related to working with memory, based on the features of the traffic processing scheme. By results, we evaluated significant performance improvement in solving secondary tasks, described in this work.

NNSplit-SØREN: Supporting the model implementation of large neural networks in a programmable data plane

Embedding neural network (NN) models in the data plane is one of the very promising and attractive ways to leverage the computational power of computer network switches. This method became possible with the advent of the P4 language controlling the programmable data plane. However, most data planes today have some constraints, such as a limited set of operations and limited memory size. The computational cost of training large-scale NNs is high. In addition, while complex large-scale NN architectures are often used to improve prediction accuracy, they affect the functional performance of the data plane because of factors such as numerous input parameters and complex model design. Therefore, determining how to reduce the performance cost incurred by implementing large NN models in the data plane is a critical issue that needs to be addressed. This research proposes a technique called Neural Network Split (NNSplit) to solve the performance problems of embedding a large NN in a data plane by splitting the NN layers across multiple data planes. To support layer splitting, a new protocol called SuppORting ComplEx Computation in the Network (SØREN) is also proposed. The SØREN protocol header carries the activation value and bridges the NN layers in all switches. A multi-class classification use case of network traffic is used as the context for the experimental analysis. Experimental results show that compared to non-splitting NN architectures, NNSplit can reduce memory usage by nearly 50% and increase network traffic throughput with the cost of a 14% increase in round-trip time. In addition, when the SØREN protocol is encapsulated into data packets, the average processing time of the switch is 773µs, which has very little impact on the processing time of the packets. Experimental results also show that the proposed NNSplit–SØREN can support large NN models on the data plane with a small performance cost.

Saving the Bandwidth of IPv6 Networks Using the Fields of the Packet Header

IPv6 protocol is the future of IP networks due to its large IP address capacity. One of the key consequences of this large capacity is that the IP protocol header has enlarged from 20-byte in IPv4 to 40-byte in IPv6. This will consume a considerable share of the bandwidth (BW) for VoIP applications, which produce small packets in tens of bytes only. To handle this issue, we have introduced an efficient technique to use the superfluous fields in the VoIP packet header, including the IPv6 header, to hold the voice data of the packet. This introduced technique is called the Eliminator technique because it shortens or eliminates the packet payload. The Eliminator technique has been analyzed against the typical technique of transferring the VoIP data. The BW utilization of the two techniques has been compared with different codecs namely G.726, G.728, and G.723.1 codecs. The analysis showed that the BW wasting has alleviated by 16.4%, 19.1%, and 25% with these codecs respectively. This BW utilization improvement will indirectly boost the quality of the VoIP calls, especially in the wireless environments. Accordingly, the Eliminator technique is a viable solution for alleviating the wasted BW when running VoIP in IPv6 networks.

Combined Stateful Classification and Session Splicing for High-Speed NFV Service Chaining

<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">Network functions</i> such as firewalls, NAT, DPI, content-aware optimizers, and load-balancers are increasingly realized as software to reduce costs and enable outsourcing. To meet performance requirements these <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">virtual</i> network functions (VNFs) often bypass the kernel and use their own user-space networking stack. A naïve realization of a chain of VNFs will exchange raw packets, leading to many redundant operations, wasting resources. In this work, we design a system to execute a pipeline of VNFs. We provide the user facilities to define (i) a traffic class of interest for the VNF, (ii) a session to group the packets (such as the TCP 4-tuple), and (iii) the amount of space per session. The system synthesizes a classifier and builds an efficient flow table that when possible will automatically be partially offloaded and accelerated by the network interface. We utilize an abstract view of flows to support seamless inspection and modification of the content of any flow (such as TCP or HTTP). By applying only surgical modifications to the protocol headers, we avoid the need for a complex, hard-to-maintain user-space TCP stack and can chain multiple VNFs <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">without re-constructing the stream multiple times</i> , allowing up to 5x improvement over standard approaches.

Detection of Anonymising Proxies Using Machine Learning

Network Proxies and Virtual Private Networks (VPN) are tools that are used every day to facilitate various business functions. However, they have gained popularity amongst unintended userbases as tools that can be used to hide mask identities while using websites and web-services. Anonymising Proxies and/or VPNs act as an intermediary between a user and a web server with a Proxy and/or VPN IP address taking the place of the user’s IP address that is forwarded to the web server. This paper presents computational models based on intelligent machine learning techniques to address the limitations currently experienced by unauthorised user detection systems. A model to detect usage of anonymising proxies was developed using a Multi-layered perceptron neural network that was trained using data found in the Transmission Control Protocol (TCP) header of captured network packets

Zeroize: A New Method to Improve the Utilization of 5G Networks When Running VoIP over IPv6

5G technology is spreading extremely quickly. Many services, including Voice Over Internet Protocol (VoIP), have utilized the features of 5G technology to improve their performance. VoIP service is gradually ruling the telecommunication sector due to its various advantages (e.g., free calls). However, VoIP service wastes a substantial share of the VoIP 5G network’s bandwidth due to its lengthy packet header. For instance, the share of the packet header from bandwidth and channel time reaches 85.7% of VoIP 5G networks when using the IPv6 protocol. VoIP designers are exerting considerable efforts to solve this issue. This paper contributes to these efforts by designing a new technique named Zeroize (zero sizes). The core of the Zeroize technique is based on utilizing the unnecessary fields of the IPv6 protocol header to keep the packet payload (voice data), thereby reducing or “zeroizing” the payload of the VoIP packet. The Zeroize technique substantially reduces the expanded bandwidth of VoIP 5G networks, which is reflected in the wasted channel time. The results show that the Zeroize technique reduces the wasted bandwidth by 20% with the G.723.1 codec. Therefore, this technique successfully reduces the bandwidth and channel time of VoIP 5G networks when using the IPv6 protocol.

Field Trial on 5G New Radio Over Satellite

5G New Radio (NR) is the 3rd Generation Partnership Project (3GPP) radio access technology for the next generation mobile communications network. A major evolution of 5G constitutes the integration of non-terrestrial networks including geostationary and low Earth orbit satellites. The seamless integration of satellites in the terrestrial mobile network requires significant adaptations within the radio access network and the development of new features in the core network to cope with the specific satellite channel characteristics. To date, the 5G control and data plane has been standardized to handle only continuous backhaul communication between the network components. However, a mobile satellite enabled next generation Node B (gNB) located in a vehicle or in a moving aerial platform needs to be able to handle frequent backhaul outages of various duration as well as longer signal delays as opposed to short terrestrial connections via fiber. In this paper, we report the results of an over-the-air (OTA) field trial comprising a mobile edge node connected to the 5G standalone core network components over a geostationary satellite. We analyze Transmission Control Protocol (TCP) acceleration and GPRS Tunneling Protocol (GTP)/TCP/Internet Protocol (IP) header compression features through the GTP. Moreover, the influence of short and long interruptions in the communication between the edge node and the central components on the entire system performance is investigated. The header compression and TCP acceleration modules were implemented on the satellite modems and are now part of the protocol stack of these devices. The results show up to 12% higher data rates for the 5G user equipment (UE), on a 1.5 MHz single carrier return link compared to deactivated TCP acceleration and header compression. We increased the data rate by 20% on the 4.5 MHz DVB-S2X forward link between the UE and 5G core. Moreover, our measurements reveal that even satellite-enabled gNB mobility is possible with the current Release 15 standard. After a short outage of the satellite connection due to shadowing, the UE can successfully re-establish the user plane connection to the core network. Our results will facilitate the full integration of satellite components in 5G through open and standard solutions.

Machine Learning-based Distributed Denial of Service Attacks Detection Technique using New Features in Software-defined Networks

Software-Defined Networking is a new network architecture that separates control and data planes. It has central network control and programmability facilities, so it improves manageability, scaling, and performance. However, it may suffer from creating a single point of failure against the controller, which represents the network control plane. So, defending the controller against attacks such as a distributed denial of service attack is a valuable and urgent issue. The advances of this paper are to implement an accurate and significant method to detect this attack with high accuracy using machine learning-based algorithms exploiting new advanced features obtained from traffic flow information and statistics. The developed model is trained with kernel radial basis function. The technique uses advanced features such as unknown destination addresses, packets inter-arrival time, transport layer protocol header, and type of service header. To the best knowledge of the authors, the proposed approach of the paper had not been used before. The proposed work begins with generating both normal and attack traffic flow packets through the network. When packets reach the controller, it extracts their headers and performs necessary flow calculations to get the needed features. The features are used to create a dataset that is used as an input to linear support vector machine classifier. The classifier is used to train the model with kernel radial basis function. Methods such as Naive Bayes, K-Nearest Neighbor, Decision Tree, and Random Forest are also utilized and compared with the SVM model to improve the detection operation. Hence, suspicious senders are blocked and their information is stored. The experimental results prove that the proposed technique detects the attack with high accuracy and low false alarm, compared to other related techniques.

Embedding the three pass protocol messages into transmission control protocol header

&lt;span&gt;Transmission control protocol provides reliable communication between two or more parties. Each transmitted packet is acknowledged to make sure successful deliveries. Transport layer security protocols send security information exchange as TCP loads. As results, the handshaking stage experiences longer delay as TCP acknowledgement process has already been delay prone. Furthermore, the security message transfers may have their own risks as they are not well protected yet. This paper proposes TCP-embedded three pass protocol for dynamic key exchange. The key exchange is embedded into TCP headers so that transmission delay is reduced, and message transfer is secured. The proposed protocol was assessed on self network by using socket programming in lossless environment. The assessments showed that the proposed protocol reduced three-pass protocol message transfer delay up to 25.8% on lossless channel. The assessment on security also showed that TCP-embedded three pass protocol successfully secured each transmitted TCP load using a unique key; that is much securer than the compared method.&lt;/span&gt;

Analysis for Modulation and Coding Scheme with Data Rate Traffic Over IEEE 802.11AC and 802.11N in Wireless Multimedia

This paper discusses wireless traffic consisting of various types of data packets. Regardless of the type of data being sent and received, the transmission can suffer from latency problems. The wireless multimedia standard enables the service provider to prioritize voice, video, best-effort, and background data by adding differentiated services code point value to the internet protocol header. This effectively allows network users to benefit from optimal network performance while using various applications with different latency and throughput requirements. In this paper, we conducted a study of five use-cases over two common wireless standards, IEEE 802.11n and IEEE 802.11ac. The study was carried out by prioritizing, respectively, voice, video data packets, with lowest priority assigned to best-effort data packets. The best-effort traffic can have more bandwidth than the voice or video. Under each use case, we evaluated the impact of additional network load on video streaming.

Considerations around Transport Header Confidentiality, Network Operations, and the Evolution of Internet Transport Protocols

To protect user data and privacy, Internet transport protocols have supported payload encryption and authentication for some time. Such encryption and authentication is now also starting to be applied to the transport protocol headers. This helps avoid transport protocol ossification by middleboxes, while also protecting metadata about the communication. Current operational practice in some networks inspect transport header information within the network, but this is no longer possible when those transport headers are encrypted. This document discusses the possible impact when network traffic uses a protocol with an encrypted transport header. It suggests issues to consider when designing new transport protocols or features. These considerations arise from concerns such as network operations, prevention of network ossification, enabling transport protocol evolution and respect for user privacy.

Steganography and Steganalysis in Voice over IP: A Review.

The rapid advance and popularization of VoIP (Voice over IP) has also brought security issues. VoIP-based secure voice communication has two sides: first, for legitimate users, the secret voice can be embedded in the carrier and transmitted safely in the channel to prevent privacy leakage and ensure data security; second, for illegal users, the use of VoIP Voice communication hides and transmits illegal information, leading to security incidents. Therefore, in recent years, steganography and steganography analysis based on VoIP have gradually become research hotspots in the field of information security. Steganography and steganalysis based on VoIP can be divided into two categories, depending on where the secret information is embedded: steganography and steganalysis based on voice payload or protocol. The former mainly regards voice payload as the carrier, and steganography or steganalysis is performed with respect to the payload. It can be subdivided into steganography and steganalysis based on FBC (fixed codebook), LPC (linear prediction coefficient), and ACB (adaptive codebook). The latter uses various protocols as the carrier and performs steganography or steganalysis with respect to some fields of the protocol header and the timing of the voice packet. It can be divided into steganography and steganalysis based on the network layer, the transport layer, and the application layer. Recent research results of steganography and steganalysis based on protocol and voice payload are classified in this paper, and the paper also summarizes their characteristics, advantages, and disadvantages. The development direction of future research is analyzed. Therefore, this research can provide good help and guidance for researchers in related fields.

Traffic Type Recognition Method for Unknown Protocol—Applying Fuzzy Inference

In this paper, we propose a system that can recognize traffic types without prior knowledge of static features such as protocol header information by combining protocol analysis based on an ecological sequence alignment algorithm in a bioinformatics and fuzzy inference system. The algorithm proposed in this paper obtained up to a 91% level of performance at a similar level to several existing algorithms in experiments using datasets containing various types of traffic. In addition, it showed an excellent accuracy of 82.5% or more even under severe conditions that lowered the amount of data to a level of at least 40% or only included data in the middle of the traffic. This shows that the problem of dependence on initial data that frequently occurs in existing machine learning and deep learning-based traffic classification algorithms does not appear in the proposed algorithm. Furthermore, based on the ability to directly extract traffic characteristics without being dependent on static field values, it has secured the ability to respond with a small number of data by taking advantage of the flexibility of the membership function of the fuzzy inference engine. Through this, the applicability to low-power and low-performance environments such as IoT networks was confirmed. In this paper, we describe in detail the theoretical background for constructing such an algorithm and relevant experiments and considerations for actual verification.

A Study on the Concept of Using Efficient Lightweight Hash Chain to Improve Authentication in VMF Military Standard

Authentication algorithms in the form of cryptographic schemes, such as the Secure Hash Algorithm 1 (SHA-1) and the digital signature algorithm (DSA), specified in the current variable message format (VMF) military standard have numerous reliability-related limitations when applied to tactical data link (TDL) and multi-TDL networks (MTN). This is because TDL and MTN require maximum tactical security, communication integrity, and low network overhead based on many protocol header bits for rapid communication with limited network resources. The application of such authentication algorithms to TDL and MTN in a rapidly changing battlefield environment without reinforcement measures will lead to functional weaknesses and vulnerabilities when high-level digital-covert activities and deception tactics are implemented. Consequently, the existing VMF authentication scheme must be improved to secure transmission integrity, lower network transaction, and receive authentication tactical information in VMF-based combat network radio (CNR) networks. Therefore, in this study, a tactical wireless ad hoc network topology, similar to that of the existing CNRs, is considered, and a lightweight multi-factor hash chain-based authentication scheme that includes a time-based one-time password (T-OTP) for network overhead reduction and terminal authentication is proposed, coupled with exception handling. The proposed method enhances the confidentiality of tactical message exchanges and reduces unnecessary network transactions and transmission bits for authentication flows between real-time military terminals owned by squads, while ensuring robustness in limited battlefields. Based on these approaches, in the future, we intend to increase the authentication reliability between wireless terminals in the Korean variable message format (KVMF)-based CNR networks based on the Korean Army Corps network scenarios.

Performance Analysis of WebRTC and SIP-based Audio and Video Communication Systems

Video and audio communications have become an integral part of all spheres of life. Two commonly used real-time communication protocols for IP-based video and audio communications are the session initiation protocol (SIP) and web real-time communications (WebRTC). These two protocols have been widely used in softphone and video conferencing applications. The main aim of this paper is to make a comparative analysis of the performance of client server applications for video and audio communications developed by both SIP and WebRTC. The SIP system comprises of a desktop client developed in C#, a mobile client developed in Android studio and a FreeSwitch server. For the WebRTC application, the client was developed in JavaScript and the server in Node.js. The WebRTC application also included a speech translation API for real-time speech translation and employed two different codecs namely VP8 and VP9 via a modification of the Session Description Protocol (SDP) header. Results showed that WebRTC peer-to-peer audio communication provides a much lower quality in terms of SSNR than the SIP audio calls. However, for video communications, WebRTC provides better quality in terms of PSNR than SIP. The performance of the WebRTC application was also evaluated with the different codecs in terms of PSNR as well as the impact of the real-time speech translation delay.

Protecting Physical Communications in 5G C-RAN Architectures through Resonant Mechanisms in Optical Media.

Future 5G networks are characterized by three basic ideas: enhanced mobile broadband communications, massive machine-type communications, and ultra-low-latency communications. Any of these requirements needs, to be fulfilled, the implementation of high-efficiency technologies at all levels. This includes some of the costliest mechanisms in terms of computational time and bitrate: information protection solutions. Typical techniques in this area employ complex algorithms and large protocol headers, which strongly reduces the effective baud rate and latency of future 5G networks and communications. This is especially relevant in the access network, which in 5G networks will follow a cloud-based architecture, where thousands of different devices must communicate, before aggregating all those streams to be sent to the backbone. Then, new and more efficient mechanisms are needed in the cloud radio access networks (C-RAN) for future 5G systems. Therefore, in this paper it is proposed a novel information protection scheme for C-RAN architectures based on resonant phenomena in optical fibers communicating the fronthaul and backhaul in 5G networks. Resonant structures and physical nonlinearities generate a chaotic signal which may encrypt and hide at physical level every communication stream in a very efficient manner. To evaluate the proposed mechanism, an experimental validation based on simulation techniques is also described and results discussed.