Real IP Research Articles

Markov-Modulated On–Off Processes in IP Traffic Modeling

This paper deals with the modeling of real IP flows using Markov-modulated On–Off processes. In the first section of the paper, we summarize the knowledge found so far about the Markov modulated On–Off regular process model, which has already been published in our previous papers. For the sake of completeness, we also summarize the well-known facts regarding the Bernoulli process. In the second section, we deal with the continuation of modeling using the Markov-modulated On–Off Bernoulli process. Our own derivation of the hitherto-unknown probability distribution of time spaces (tail distribution) is completely new. For its derivation, we used the tail distribution generating function, and then, using its derivation, we calculated the hitherto-unknown moments of the distribution (mean, variation, and third initial moment). This knowledge will allow us to create a new numerical procedure for estimating MMBP parameters from measured IP traffic. Finally, we present a formula for the sizing of network resources for a given flow using effective bandwidth with respect to QoS based on a given level of IP traffic.

Characterizing the Bitcoin network topology with Node‐Probe

AbstractIn blockchain networks, topology discovery is a prerequisite when investigating the network characteristics (e.g., performance and robustness), which can provide a deeper comprehension of the behavior of the nodes and topology dynamicity. In this paper, we conduct a longitudinal study on the Bitcoin topology by collecting network snapshots from 2018 to 2022 with Node‐Probe, our topology discovery technique that uses recursive scanning to find all reachable nodes in the Bitcoin network. Using Node‐Probe, we have collected 5‐week‐long snapshots (36‐day‐long snapshots) of the Bitcoin main network and analyzed the network properties, community structure, and topology dynamicity. We confirm that our approach achieves a precision of 99% with a recall of 98% in inferring the topology. Analytical results on community structure show that the Bitcoin network has more communities than what should be expected from a random network. Meanwhile, analytical results on dynamicity indicate that the topology stands firmly on heavy and long‐running nodes. Improving the propagation mechanism using master nodes could improve the propagation delay by proximity compared with the Bitcoin default protocol. Considering a K‐anonymity attack, any transaction from one of the autonomous systems containing only a single Bitcoin node can easily be linked to real users' IP information.

CACS: A Context-Aware and Anonymous Communication Framework for an Enterprise Network Using SDN

The emergence of software-defined networking (SDN) has revolutionized the management of an enterprise network. The SDN-based design provides flexibility in network management, which spans over multiple applications, e.g., routing, switching, forwarding, and controlling. It reduces the reliance on vendor-specific devices and middlebox solutions, such as firewalls, intrusion detection systems (IDSs), intrusion prevention systems (IPSs), etc. Furthermore, due to the integration of different technologies, privacy is one of the core issues faced by the enterprise. Host anonymity is one of the techniques to safeguard against privacy attacks; however, the existing anonymization solutions provide better anonymity, but at the cost of higher latency and are most suited for Internet traffic. To tackle this issue in an enterprise network, we propose an SDN-based communication framework using enterprise integration patterns (EIPs) that offers anonymous communication in an enterprise environment. Host anonymity is achieved by replacing the real IP address with the spoofed IP address during the transmission of data packets inside the network. Unlike the traditional networks, SDN can modify the header fields of packets as they traverse in the network from the source to the destination. In addition to the host anonymity, this framework also provides context-aware communication by leveraging the SDN global visibility characteristic, where application services are discoverable on the network without disclosing the addresses of the application servers. Moreover, context-aware services enable network traffic to be routed based on the application-layer services rather than the network-layer information. In the end, evaluation of the proposed framework is carried out with respect to the performance of anonymous communication, computational complexity, and security of the complete proposed framework. In addition, we also highlighted that the proposed framework is more suitable for heterogeneous network environments such as Internet of Things-based solutions.

Adoption of IP Truncation in a Privacy-Based Decision Tree Pruning Design: A Case Study in Network Intrusion Detection System

A decision tree is a transparent model where the rules are visible and can represent the logic of classification. However, this structure might allow attackers to infer confidential information if the rules carry some sensitive information. Thus, a tree pruning methodology based on an IP truncation anonymisation scheme is proposed in this paper to prune the real IP addresses. However, the possible drawback of carelessly designed tree pruning might degrade the performance of the original tree as some information is intentionally opted out for the tree’s consideration. In this work, the 6-percent-GureKDDCup’99, full-version-GureKDDCup’99, UNSW-NB15, and CIDDS-001 datasets are used to evaluate the performance of the proposed pruning method. The results are also compared to the original unpruned tree model to observe its tolerance and trade-off. The tree model adopted in this work is the C4.5 tree. The findings from our empirical results are very encouraging and spell two main advantages: the sensitive IP addresses can be “pruned” (hidden) throughout the classification process to prevent any potential user profiling, and the number of nodes in the tree is tremendously reduced to make the rule interpretation possible while maintaining the classification accuracy.

Structured nonnegative matrix factorization for traffic flow estimation of large cloud networks

Network traffic matrix estimation is an ill-posed linear inverse problem: it requires to estimate the unobservable origin destination traffic flows, X, given the observable link traffic flows, Y, and a binary routing matrix, A, which are such that Y=AX. This is a challenging but vital problem as accurate estimation of OD flows is required for several network management tasks. In this paper, we propose a novel model for the network traffic matrix estimation problem which maps high-dimension OD flows to low-dimension latent flows with the following three constraints: (1) nonnegativity constraint on the estimated OD flows, (2) autoregression constraint that enables the proposed model to effectively capture temporal patterns of the OD flows, and (3) orthogonality constraint that ensures the mapping between low-dimensional latent flows and the corresponding link flows to be distance preserving. The parameters of the proposed model are estimated with a training algorithm based on Nesterov accelerated gradient and generally shows fast convergence. We validate the proposed traffic flow estimation model on two real backbone IP network datasets, namely Internet2 and GÉANT. Empirical results show that the proposed model outperforms the state-of-the-art models not only in terms of tracking the individual OD flows but also in terms of standard performance metrics. The proposed model is also found to be highly scalable compared to the existing state-of-the-art approaches.

Towards Enhancing the Endpoint Security using Moving Target Defense (Shuffle-based Approach) in Software Defined Networking

Static IP addresses make the network vulnerable to different attacks and once the machines are compromised, any sensitive information within the network can be spoofed. Moving Target Defense (MTD) provides an efficient mechanism for proactive security by constantly changing different system attributes. Software Defined Networks (SDNs) provide greater flexibility in designing security solutions due to their centralized management and programming capabilities. In this paper, a mechanism for the protection of endpoint security is developed using IP address host shuffling. In the proposed approach, the real IP address of the host is masked and a virtual IP address is assigned. The virtual IPs are mined from the pool of unassigned IP addresses. The address pool is created using a pseudo-random number generator to guarantee high randomness. This approach helps in invalidating the intelligence gathered by the adversaries through the changes in the network configuration that will disturb attack execution, eventually leading to attack failure. Transparency is attained via preserving the actual IP intact and mapping a virtual IP to it. The proposed solution is implemented using the RYU Controller and Mininet. The efficient results obtained from the experiments substantiate the effectiveness of the MTD approach for enhancing endpoint security.

Performance comparison between virtual MPLS IP network and real IP network without MPLS

In this paper an IP based network consisting of two separate IP networks - a virtual one, running MPLS and an experimental IP network, connected to the virtual one, have been studied. VoIP traffic is exchanged between the two networks. Both networks are connected to the Internet and exchange traffic with it. The virtual network is created by using GNS3. The purpose of this paper is to show a comparison in the performance between the two IP networks. In addition, mathematical distributions and approximations have been made to be used to further evaluate the performance of the two networks. The used methodology in the present work can be applied in the study of different IP networks through which different types of real-time traffic passes.

Search of real network addresses of web applications using the CDN service

In the following research, we have considered the problem of finding real network addresses of web applications. For this purpose, we have used a service, which based on providing content delivery to networks. Thus, the known solutions are analyzed, and their features of use are established. Among them, the focus of this service on speeding up the operation and security of web applications is highlighted. Taking into account these features, this issue is complicated by the focus on describing the technical capabilities of the already known solutions. This limits the detection of web application of configuration vulnerabilities. To prevent this, the capabilities of content delivery networks have been used. This use is based on redirecting HTTPS traffic through their servers and, as a result, hiding the real IP address of the web application. The most common implementations of the service based on content delivery networks are highlighted. The focus on the web application firewall is shown. Its applicability at the configuration of DNS requests and finding of real network addresses is established. Also, the most typical methods of their search are identified. Among them, the emphasis is placed on the use of services for viewing current and archival data of Internet resources; using MX records as sources of IP addresses; sending letters by e-mail to the specified (correct or incorrect) e-mail addresses; finding subdomains without a configured service of content delivery networks; obtaining an SSL certificate; using DNS name research tools. The implementation of these methods is demonstrated by the selected software. To do this, the criteria are introduced and their capabilities are compared. The results of using the selected software show the limitations of its functionality. To prevent this, it is recommended to combine methods of searching for real network addresses of web applications using the service of content delivery networks.

A Multi-view Approach to Preserve Privacy and Utility in Network Trace Anonymization

As network security monitoring grows more sophisticated, there is an increasing need for outsourcing such tasks to third-party analysts. However, organizations are usually reluctant to share their network traces due to privacy concerns over sensitive information, e.g., network and system configuration, which may potentially be exploited for attacks. In cases where data owners are convinced to share their network traces, the data are typically subjected to certain anonymization techniques, e.g., CryptoPAn, which replaces real IP addresses with prefix-preserving pseudonyms. However, most such techniques either are vulnerable to adversaries with prior knowledge about some network flows in the traces or require heavy data sanitization or perturbation, which may result in a significant loss of data utility. In this article, we aim to preserve both privacy and utility through shifting the trade-off from between privacy and utility to between privacy and computational cost. The key idea is for the analysts to generate and analyze multiple anonymized views of the original network traces: Those views are designed to be sufficiently indistinguishable even to adversaries armed with prior knowledge, which preserves the privacy, whereas one of the views will yield true analysis results privately retrieved by the data owner, which preserves the utility. We formally analyze the privacy of our solution and experimentally evaluate it using real network traces provided by a major ISP. The experimental results show that our approach can significantly reduce the level of information leakage (e.g., less than 1% of the information leaked by CryptoPAn) with comparable utility.

A GRU deep learning system against attacks in software defined networks

The management of modern network environments is becoming more and more complex due to new requirements of devices' heterogeneity regarding the popularization of the Internet of Things (IoT), as well as the dynamic traffic required by next-generation applications and services. To address this problem, Software-defined Networking (SDN) emerges as a management paradigm able to handle these problems through a centralized high-level network approach. However, this centralized characteristic also creates a critical failure spot since the central controller may be targeted by malicious users aiming to impair the network operation. This paper proposes an SDN defense system based on the analysis of single IP flow records, which uses the Gated Recurrent Units (GRU) deep learning method to detect DDoS and intrusion attacks. This direct flow inspection enables faster mitigation responses, minimizing the attack's impact over the SDN. The proposed model is tested against several different machine learning approaches over two public datasets, the CICDDoS 2019 and the CICIDS 2018. Furthermore, a lightweight mitigation approach is presented and evaluated through performance tests regarding each detection method. Finally, a feasibility test is performed regarding the throughput of flows per second that each detection method can analyze. This test is accomplished through the use of real IP Flow data collected at a large-scale network. The results point out promising detection rates and an elevated amount of analyzed flows per second, which makes GRU a feasible approach for the proposed system.

Virtual IP-based Secure Gatekeeper System for Internet of Things.

The advantage of using the Network Address Translation device is that the internal IP address, which makes the IP address space of Internet of Things (IoT) devices expanded, is invisible from the outside and safe from external attacks. However, the use of these private IPv4 addresses poses traversal problems, especially for the mobile IoTs to operate peer-to-peer applications. An alternative solution is to use IPv6 technologies for future IoT devices. However, IPv6 package, including IPSec, is too complex to apply to the IoT device because it is a technology developed for the user terminal with enough computing power. This paper proposes a gatekeeper to enable the real IP addresses of IoTs inside the same subnetwork to be not explicitly addressable and visible from outside of the gatekeeper. Each IoT device publishes its virtual IP address via the Registrar Server or Domain Name System (DNS) with which the gatekeeper shares the address mapping information. While the gatekeeper maintains the mapping information for the local IoT devices, the registration server or DNS has global address mapping information so that any peer can reach the mapping information. All incoming and outgoing packets must pass through the gatekeeper responsible for the address conversion and security checks for them from the entrance. This paper aims to apply our gatekeeper system to a platform of self-driving cars that allows surrounding IoT cameras and autonomous vehicles to communicate with each other securely, safely, and rapidly. So, this paper finally analyzes improvement effects on latency to show that our gatekeeper system guarantees the latency goal of 20 ms under the environment of 5G links.

Separating Monitoring from Control in SDN to Mitigate DDoS Attacks in Hybrid Clouds

Background & Objective: Detecting and mitigating Distributed Denial of Service (DDoS) attacks is a serious problem. In addition, new features and network deployments such as Software- Defined Networking (SDN) may open the door for new threats that did not previously exist. : Recent publications and patent are reviewed to find new techniques developed for integrating different mechanisms to secure networks against DDoS. Methods: This work presents a simple model for integrating different mechanisms to secure both SDN and legacy network in a hybrid cloud environment, it is called FocusON. It aims at mitigating DDoS attacks of a victim network. In addition, separating network monitoring from its control aims at mitigating DDoS attacks of a victim network. Traffic pattern analysis is apart from attack detection mechanism that gives a conceptual representation of a specific kind of DDoS attacks. DDoS detection is a completely automated process. Once called, for the reaction, the active response will be taken against the real IP source of the attacker. : The communication time overhead was tested in order to evaluate the remote server response time in case of deploying our proposed model mechanisms and without our proposed model. : Here we introduce a response mechanism that consists of an analysis of event logs, traffic patterns, and IP traceback. The proposed model categorizes the underlying network according to the location into a victim network and the source of attack (public cloud). Results & Conclusion:: The proposed model implemented in a hybrid cloud environment using the network of SDN and legacy network. The experimental setup was built using our network lab connected to the Amazon public cloud.

Research on Random Virtual IP Address Redistribution Technology Based on OpenFlow

In view of the shortcomings of traditional network defense measures and the dynamic defense needs of existing network security, a random virtual IP address redistribution technology based on OpenFlow protocol is proposed, which realizes the conversion between real IP address space and random virtual IP address space. The technology can increase the randomness of IP addresses in two dimensions of time and space, and increase the difficulty of network sniffing and network attacks. It provides new solutions and ideas for the implementation of dynamic defense at the network level.

Spatiotemporal graph convolutional recurrent networks for traffic matrix prediction

SummaryThrough accurate network‐wide traffic prediction, network operators can agilely manage resources and improve robustness by proactively adapting to new traffic patterns, especially for traffic engineering, capacity planning and quality of service provisioning. However, due to the proliferation of backbone network traffic as well as the complexity and dynamics of network communication behavior, accurate and effective network‐wide traffic prediction is challenging. To address the challenges, this paper focuses on short‐term traffic matrix (TM) prediction in large‐scale IP backbone networks. In order to improve the prediction performance, a novel spatiotemporal graph convolutional recurrent network (SGCRN)—a deep learning framework that incorporates both spatial and temporal dependencies of traffic flows, is proposed to implement TM prediction with high accuracy and efficiency. By learning network‐wide traffic as graph‐structured TM time series, SGCRN jointly utilizes graph convolutional networks (GCN) and gated recurrent units (GRU) networks to extract comprehensive spatiotemporal correlations among traffic flows. Specifically, SGCRN employs GCNs to identify structural spatial features of traffic flows by considering topological properties, and utilizes GRUs to implement temporal features learning by considering short and long‐term dynamics of traffic flows. Extensive experimental results on the inter‐Points of Presence network traffic data from four real IP backbone networks show that SGCRN can effectively predict short‐term network‐wide TM with superior accuracy compared with other four widely used traffic prediction methods.

Privacy-Preserving Multilayer In-Band Network Telemetry and Data Analytics: For Safety, Please do Not Report Plaintext Data

With the evolution of Internet infrastructure and network services, multilayer in-band network telemetry (ML-INT) and data analytics (DA) have been considered as key enabling techniques to realize real-time and fine-grained network monitoring, especially for backbone IP-over-Optical networks. However, the existing ML-INT&DA systems have privacy and security issues, because plaintext ML-INT data is reported from the data plane and gets analyzed in the control plane. In this work, we address these issues by designing a privacy-preserving ML-INT&DA system for IP-over-Optical networks. We first leverage vector homomorphic encryption (VHE) to design a lightweight encryption scheme, which overcomes the security breaches due to eavesdropping and preserves the delicate correlations buried in multi-dimensional ML-INT data. Then, we develop an effective data compression scheme to further encode the encrypted ML-INT data and make the results suitable for hash-based signature. The signature is for data certification and enables the DA in the control plane to verify the integrity of received ML-INT data. Hence, the threats from data tampering are removed. Next, we architect a deep learning (DL) model that can directly operate on encrypted ML-INT data for anomaly detection. Finally, we implement the proposed ML-INT&DA system, and experimentally demonstrate its effectiveness in a real IP over elastic optical network (IP-over-EON) testbed, whose key elements, i.e., optical line system (OLS), bandwidth-variable wavelength-selective switches (BV-WSS’) and programmable data plane (PDP) switches, are all commercial products.

Resource Allocation and QoS Guarantees for Real World IP Traffic in Integrated XG-PON and IEEE802.11e EDCA Networks

Globally, there is a significant rise in the number of connected devices. Every device has an access to wide variety of telecom services among which voice, video and best effort (BE) contribute significantly. There is a noticeable growing trend towards upstream BE traffic besides real time e-services that demand high quality of service (QoS). Converged next-generation fiber-wireless (FiWi) access networks composed of next-generation passive optical network (XG-PON) and 802.11n based wireless local area network (WLAN) has emerged as a suitable choice to provide high quality and affordable e-services to plenty of subscribers as they possess both high bandwidth and flexibility. In this paper, we study the performance of the integrated network architecture which combines XG-PON and enhanced distributed channel access (EDCA) under real time bursty traffic derived from the current global IP traffic distribution. The joint tuning of various crucial parameters of both XG-PON and EDCA with incorporation of an efficient deficit dynamic bandwidth algorithm (DBA) at optical line terminal (OLT) is done by exhaustive simulations in network simulator-3 (NS-3). Through intensive simulations and tuning, we are able to achieve a end-to-end delay performance of <; 150 ms for voice, <; 500 ms for video and a few seconds for BE upto full capacity. Also, a packet loss ratio (PLR) of <; 3% and <; 6% is achieved for voice and BE respectively upto full load. For voice PLR is <; 1% upto 60% total offered load. Further, it is observed that the fine tuning of key parameters has also resulted in increased bandwidth for dominant BE services. Therefore, this optimized network architecture is 20% more fair to BE services as compared to the conventional integrated FiWi architectures.

An Intrusion Tracking Watermarking Scheme

With the rapid development of edge computing technology, the scale of the network continues to expand. Various types of applications are becoming more widespread. In the edge computing, existing network agents, NAT, IP tunneling technologies, and rapidly evolving anonymous communication systems provide convenience for attackers to hide real IP. In addition, the attacker forms a “stepping” chain by breaking through several intermediate systems of the edge computing network. Thereby implementing an invisible intrusion attack across multiple autonomous domains can increase the difficulty of intrusion tracking. Aiming at the problem of insufficient applicability of existing interval centroid based watermarking technique, this paper proposes a histogram specified interval centroid-based watermarking technique. It improves cross-domain collaborative intrusion tracking. This technique improves the resistance of the prior art to multi-flow attacks in edge computing. It decreases the time and space overhead of the detector. Compared with other interval centroid based watermarking techniques, this method has stronger concealment. The proposed method can effectively defend against multi-flow attacks of edge computing. The time and space overhead of the detector can be reduced when multiple attack flows are tracked in parallel. Thus, it is suitable for edge computing. The robustness and adaptability are improved by this method.

A survey on existing IP trace back mechanisms and their comparisons

Security is the one of the main point of focus in recent trends of computer science, as it has to determine the right people accessing the system and ones who are trying the bypassing it. IP spoofing is one of the prevalent attacks, where the attackers launch the attack by spoofing the source address, once this happens they can attack without revealing their exact location. The attacker uses a fraudulent IP address to conceal their identity. To reveal the attackers real locations many IP trace back mechanisms have been proposed but the attacker immediately gets away with the information. There is another problem which is to detect DDoS traffic and the precarious packets set up by the attacker, which are a threat to the victim as well as the whole network, here lies another hurdle which is to differentiate between the attacker’s data traffic from the normal data traffic. There are many solutions given for this but one among them is IP trace back which already has researched upon in the past and implemented then, but what is lacking in the solution such that the attacks are even now taking place. IP trace back if modified, strengthened would analyze the traffic faster and trace out the attacker with a faster pace, which is why a hybrid IP tracing and tracking mechanism if introduced could ease the current problem.

Web Phishing Detection Using a Deep Learning Framework

Web service is one of the key communications software services for the Internet. Web phishing is one of many security threats to web services on the Internet. Web phishing aims to steal private information, such as usernames, passwords, and credit card details, by way of impersonating a legitimate entity. It will lead to information disclosure and property damage. This paper mainly focuses on applying a deep learning framework to detect phishing websites. This paper first designs two types of features for web phishing: original features and interaction features. A detection model based on Deep Belief Networks (DBN) is then presented. The test using real IP flows from ISP (Internet Service Provider) shows that the detecting model based on DBN can achieve an approximately 90% true positive rate and 0.6% false positive rate.

Implementación del sistema de habilitación de salud en la IPS simulada como estrategia orientada a la prestación de servicios tecnológicos.

En este artículo se presentan los resultados obtenidos en el desarrollo de la fase inicial de un proyecto de innovación, ejecutado en el Centro de Servicios de Salud, Servicio Nacional de Aprendizaje (SENA), Regional Antioquia, cuyo objetivo general es implementar el sistema de habilitación para la prestación de servicios tecnológicos en una Institución Prestadora de Servicios de Salud (IPS) simulada, apoyando la seguridad del paciente, de manera que se garanticen procesos acordes con el contexto laboral y permitan la ejecución de los procesos investigativos y de innovación. El SENA es una institución de formación técnica y tecnológica y no una institución prestadora de servicios de salud. Sin embargo, cuenta con ambientes de aprendizaje que simulan una IPS real, dotados con todos los implementos, insumos, equipos biomédicos y capacidad tecnológica. Allí se pueden realizar procedimientos como en una institución prestadora de servicios de salud, por tanto los aprendices que hacen uso de estos ambientes en el marco de su formación, estarán accediendo a mejores herramientas tecnológicas y pedagógicas, lo que les permitirá ser más competitivos en el medio. Adicionalmente se pretende presentar la metodología de implementación del sistema de habilitación en la IPS simulada. Por otra parte, es de resaltar los resultados logrados durante la primera fase, cuyo avance ha arrojado información importante para continuar avanzando hacia el logro del propósito del proyecto.