SNMP MIB Research Articles

Medical Big Data and Postoperative Nursing of Fracture Patients Based on Cloud Computing.

Based on the standards for wireless sensor system identification, the sensor node identity OID identification and the management object OID identification in the SNMP MIB are merged, and a management object OID identification coding mechanism for the SNMP-based wireless sensor system is proposed to make the node management system only. The identity, attributes, and multiple entities of the target sensor node in the wireless sensor network can be identified and managed by the node management object OID. The source of abnormal medical big data generally uses two models of multidimensional data and sliding window for detection and verification. First, the sliding window can be used to detect abnormalities. The result is that under this condition, the detection rate of medical big data is more than 95%; the effect is very good, but in different dimensions, the detection rate of four-dimensional data is 2.9% higher than that of a single-dimensional one. On the basis of the ZigBee wireless network, the terminal signal transmission of fracture treatment can be realized. On this basis, combined with the actual needs of fracture treatment, it can be built with its wireless module. The wireless network has a certain basic function. The reform of the nursing system was carried out on the basis of the safety and reliability of the nursing system, the efficiency of the nursing system was improved, and timely and safe nursing services were achieved.

A novel method of IoT wireless sensor nodes management based on OID technology

With the continuous development of Internet of Things (IoT) technologies, massive wireless sensor nodes are deployed to construct several local wireless sensor networks over the world, which bring a great challenge to enormous wireless sensor nodes management. In this paper, a mechanism of sensor node managed object identifier (OID) is designed to merge classic SNMP MIB managed object identifier with sensor node identifier. Then, the framework of classic SNMP manager and agent is modified and optimised. Finally, a method for sensor nodes remote managing, which adapts to heterogeneous IoT network such as Internet linked with industry wireless network etc., is proposed to achieve hierarchical addressing and unified management of massive sensor nodes. The experimental result demonstrates that the proposed method satisfies the unified managing demand of a tremendous amount of sensor nodes in large-scale IoT network scenario by configuring and controlling sensor nodes.

A QoS-configurable failure detection service for internet applications

Unreliable failure detectors are a basic building block of reliable distributed systems. Failure detectors are used to monitor processes of any application and provide process state information. This work presents an Internet Failure Detector Service (IFDS) for processes running in the Internet on multiple autonomous systems. The failure detection service is adaptive, and can be easily integrated into applications that require configurable QoS guarantees. The service is based on monitors which are capable of providing global process state information through a SNMP MIB. Monitors at different networks communicate across the Internet using Web Services. The system was implemented and evaluated for monitored processes running both on single LAN and on PlanetLab. Experimental results are presented, showing the performance of the detector, in particular the advantages of using the self-tuning strategies to address the requirements of multiple concurrent applications running on a dynamic environment.

Research and Application of Network Router Link Prediction Method

Multiple Autonomous systems (ASes) of the network are usually consisted of many routers such as inter-router and intra-router connection each other. In order to detect the network routers connection relationship, many researchers at home or abroad use various methods such as active end-to-end links detection or observing SNMP MIBs to understand the links’ connection relationship among the routers in network’ ASes. In this paper, by using the link prediction algorithm based on the similarity, we tried to predict the links’ connection relationship and got the possible network topology structure among the network’ ASes when the actual connection link don’t be completely detected. Through the experiments, the prediction results can be seen that the similarity algorithm index of ACT, SRW, and SimRank based on the random walk can also achieve better prediction accuracy above 0.95, which prove the similarity index especially the random walk algorithm can realize the higher link prediction accuracy to the network’ ASes under the conditions of missing some known connection link, etc.

An in-depth analysis on traffic flooding attacks detection and system using data mining techniques

Recently, as network traffic flooding attack such as DoS and DDoS have posed devastating threats on network services, rapid detection, and semantic analysis are the major concern for secure and reliable network services. In addition, in a recent issue of the safety and comfort of vehicles and communication technologies for service is required. We propose a traffic flooding attack detection and an in-depth analysis system that uses data mining techniques. In this paper we (1) designed and implemented a system that detects traffic flooding attacks. Then, it executes classification by attack type and it uses SNMP MIB information based on C4.5 algorithm; (2) conducted a semantic interpretation that extracts and analyzes the rules of execution mechanism that are additionally provided by C4.5; (3) performed an in-depth analysis on the attack patterns and useful knowledge inherent in their data by type, utilizing association rule mining. Classification by attack and attack type based on C4.5 and association rules, automatic rule extraction and semantic in-depth interpretation, which are proposed in this paper, provide a positive possibility to add momentum towards the development of new methodologies for intrusion detection systems as well as to support establishing policies for intrusion detection and response systems.

Research and Implement of an Algorithm for Physical Topology Automatic Discovery in Switched Ethernet

Abstract In this paper, a novel practical algorithmic solution for automatic discovering the physical topology of switched Ethernet was proposed. Our algorithm collects standard SNMP MIB information that is widely supported in modern IP networks and then builds the physical topology of the active network. We described the relative definitions, system model and proved the correctness of the algorithm. Practically, the algorithm was implemented in our visualization network monitoring system. We also presented the main steps of the algorithm, core codes and running results on the lab network. The experimental results clearly validate our approach, demonstrating that our algorithm is simple and effective which can discover the accurate up-to-date physical network topology.

A XML-based Model of SNMP MIB in IP Network Management System

A XML-based Model of SNMP MIB in IP Network Management System

SNMP 기반의 실시간 트래픽 폭주 공격 탐지 시스템 설계 및 구현

Recently, as traffic flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems (IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network traffic. In this paper we propose an SNMP-based lightweight and fast detection algorithm for traffic flooding attacks, which minimizes the processing and network overhead of the detection system, minimizes the detection time, and provides high detection rate. The attack detection algorithm consists of three consecutive stages. The first stage determines the detection timing using the update interval of SNMP MIB. The second stage analyzes attack symptoms based on correlations of MIB data. The third stage determines whether an attack occurs or not and figure out the attack type in case of attack.

SVM을 이용한 SNMP MIB에서의 트래픽 폭주 공격 탐지

DoS/DDoS로 대표되는 트래픽 폭주 공격은 대상 시스템뿐만 아니라 네트워크 대역폭 및 프로세서 처리능력, 시스템 자원 등을 고갈시킴으로써 네트워크에 심각한 장애를 유발하기 때문에, 신속한 트래픽 폭주 공격의 탐지는 안정적인 서비스의 제공 및 시스템의 운영에 필수요건이다. 전통적인 패킷 수집을 통한 DoS/DDoS의 탐지방법은 공격에 대한 상세한 분석은 가능하나 설치의 확장성 부족, 고가의 고성능 분석시스템의 요구, 신속한 탐지를 보장하지 못하는 문제점을 갖고 있다. 본 논문에서는 MIB 정보 갱신 시점 단위로 수집된 SNMP MIB 객체 정보를 바탕으로 Support Vector Data Description(SVDD)을 이용하여 보다 빠르고 정확한 침입탐지와 쉬운 확장성, 저비용탐지 및 정확한 공격유형별 분류를 가능케 하는 새로운 시스템을 설계 및 구현하였다. 실험을 통하여 만족스러운 침입 탐지율과 안전한 False Negative Rate(FNR), 공격유형별 분류율 수치 등을 확인함으로써 제안된 시스템의 성능을 검증하였다. Recently, as network flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems(IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network environment. In this paper we propose a lightweight and fast detection mechanism for traffic flooding attacks. Firstly, we use SNMP MIB statistical data gathered from SNMP agents, instead of raw packet data from network links. Secondly, we use a machine learning approach based on a Support Vector Machine(SVM) for attack classification. Using MIB and SVM, we achieved fast detection with high accuracy, the minimization of the system burden, and extendibility for system deployment. The proposed mechanism is constructed in a hierarchical structure, which first distinguishes attack traffic from normal traffic and then determines the type of attacks in detail. Using MIB data sets collected from real experiments involving a DDoS attack, we validate the possibility of our approaches. It is shown that network attacks are detected with high efficiency, and classified with low false alarms.

Traffic flooding attack detection with SNMP MIB using SVM

Recently, as network flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems (IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network traffic. Little or no integration exists between IDS and SNMP-based network management, in spite of the extensive monitoring and statistical information provided by SNMP agents implemented on network devices and systems. In this paper we propose a lightweight and fast detection mechanism for traffic flooding attacks. Firstly, we use SNMP MIB statistical data gathered from SNMP agents, instead of raw packet data from network links. The involved SNMP MIB variables are selected by an effective feature selection mechanism and gathered effectively by the MIB update time prediction mechanism. Secondly, we use a machine learning approach based on a Support Vector Machine (SVM) for attack classification. Using MIB and SVM, we achieved fast detection with high accuracy, the minimization of the system burden, and extendibility for system deployment. The proposed mechanism is constructed in a hierarchical structure, which first distinguishes attack traffic from normal traffic and then determines the type of attacks in detail. Using MIB datasets collected from real experiments involving a DDoS attack, we validate the possibility of our approaches. It is shown that network attacks are detected with high efficiency, and classified with low false alarms.

Two-Tier GCT Based Approach for Attack Detection

The frequent attacks on network infrastructure, using various forms of denial of service attacks, have led to an increased need for developing new techniques for analyzing network traffic. If efficient analysis tools were available, it could become possible to detect the attacks and to take action to weaken those attacks appropriately before they have had time to propagate across the network. In this paper, we propose an SNMP MIB oriented approach for detecting attacks, which is based on two-tier GCT by analyzing causal relationship between attacking variable at the attacker and abnormal variable at the target. According to the abnormal behavior at the target, GCT is executed initially to determine preliminary attacking variable, which has whole causality with abnormal variable in network behavior. Depending on behavior feature extracted from abnormal behavior, we can recognize attacking variable by using GCT again, which has local causality with abnormal variable in local behavior. Proactive detecting rules can be constructed with the causality between attacking variable and abnormal variable, which can be used to give alarms in network management system. The results of experiment showed that the approach with two-tier GCT was proved to detect attacks early, with which attack propagation could be slowed through early detection.

Extending the OSI model for wireless battlefield networks: a design approach to the 8th Layer for tactical hyper-nodes

In this paper, we introduce the architecture and functionality of a new 8th layer that extends the well known 7-layer OSI model to implement adaptive networking by giving every critical node of a C4I network its own specialised Network Operation Centre (NOC) capability. We call these 'intelligent nodes' that adapt their behaviour and organisation through incorporation of these 8th layer hyper-nodes. The hyper-nodes achieve goal-seeking behaviour by satisfying Service Level Agreement constraints; they achieve sensing by way of polling SNMP MIB data describing overall NOC status; they capture experience through a memory mechanism for learned network management actions.

Topology Discovery in Large Ethernet Mesh Networks

Automatic discovery of physical topology plays a crucial role in enhancing the manageability of modem large Ethernet mesh networks. Despite the importance of the problem, earlier research and commercial network management tools have typically concentrated on either discovering active topology, or proprietary solutions targeting specific product families. Recent works [1]-[3] have demonstrated that physical topology can be determined using standard SNMP MIB, but these algorithms depend on Filtering Database and rely on the so-called spanning tree protocol (IEEE 802.1d) in order to break cycles, thereby avoiding the possibility of infinitely circulating packets and deadlocks. A previous work [1] requires that Filtering Database entries are completed; however it is a very critical assumption in a realistic Ethernet mesh network. In this paper, we have proposed a new topology discovery algorithm which works without the complete knowledge of Filtering Database. Our algorithm can discover complete physical topology including inactive interfaces eliminated by the spanning tree protocol in LEMNs. The effectiveness of the algorithm is demonstrated by an implementation.

A Study upon SNMP MIB II Algorithm: For the Calculation of the Line Utilization

This study proposes an algorithm of the maximum value accumulation method that uses the SNMP MIB II to calculate the line utilization on a network based on TCP/IP protocol. There are four types of algorithms to calculate it; the utilization accumulation method, the utilization midterm calculation method, the maximum calculation method, and the maximum accumulation method. The first two methods are not suitable to detect the faults or process the transmission delays in that they are to be followed by their line utilization, if applicable. On the contrary, the other two whose calculations are based on their accumulated amount of bytes, can be used to not only detect the faults but also compensate for the packet delays. The calculations of the line utilization have their practical uses in the capacity planning, the best calculation algorithm for which the maximum accumulation method would serve as. Its practicability includes coping with system faults, line and routing faults and wraparound of the MIB variables, along with its availability as an indicator for the bandwidth upgrade. The study includes its comparison of the latter two methods above by collecting the current traffic on a TCP/IP network to work on the characteristics of the proposed algorithm, as would help a network manager understand the current status of the line capacity to use series of data as an indicator in the line capacity planning.

Topology Discovery in Heterogeneous IP Networks: The NetInventory System

Knowledge of the up-to-date physical topology of an IP network is crucial to a number of critical network management tasks, including reactive and proactive resource management, event correlation, and root-cause analysis. Given the dynamic nature of today's IP networks, keeping track of topology information manually is a daunting (if not impossible) task. Thus, effective algorithms for automatically discovering physical network topology are necessary. Earlier work has typically concentrated on either 1) discovering logical (i.e., layer-3) topology, which implies that the connectivity of all layer-2 elements (e.g., switches and bridges) is ignored, or 2) proprietary solutions targeting specific product families. In this paper, we present novel algorithms for discovering physical topology in heterogeneous (i.e., multi-vendor) IP networks. Our algorithms rely on standard SNMP MIB information that is widely supported by modern IP network elements and require no modifications to the operating system software running on elements or hosts. We have implemented the algorithms presented in this paper in the context of the NetInventory topology-discovery tool that has been tested on Lucent's own research network. The experimental results clearly validate our approach, demonstrating that our tool can consistently discover the accurate physical network topology with reasonably small running-time requirements even for fairly large network configurations.

Development of SNMP‐XML translator and gateway for XML‐based integrated network management

AbstractThe research objective of our work is to develop a SNMP MIB to XML translation algorithm and to implement an SNMP‐XML gateway using this algorithm. The gateway is used to transfer management information between an XML‐based manager and SNMP‐based agents. SNMP is widely used for Internet management, but SNMP is insufficient to manage continuously expanding networks because of constraints in scalability and efficiency. XML–based network management architectures are newly proposed as alternatives to SNMP‐based network management, but the XML‐based Network Management System (XML‐based NMS) cannot directly manage legacy SNMP agents. We also implemented an automatic specification translator (SNMP MIB to XML Translator) and an SNMP‐XML gateway. Copyright © 2003 John Wiley &Sons, Ltd.

Proactive Intrusion Detection and Distributed Denial of Service Attacks—A Case Study in Security Management

Little or no integration exists today between Intrusion Detection Systems (IDSs) and SNMP-based Network Management Systems (NMSs), in spite of the extensive monitoring and alarming capabilities offered by commercial NMSs. This difficulty is mainly associated with the distinct data sources used by the two systems: packet traffic and audit records for IDSs and SNMP MIB variables for NMSs. In this paper we propose and evaluate a methodology for utilizing NMSs for the early detection of Distributed Denial of Service attacks (DDoS). A principled approach is described for discovering precursors to DDoS attacks in databases formed by MIB variables recorded from multiple domains in networked information systems. The approach is rooted in time series quantization, and in the application of the Granger Causality Test of classical statistics for selecting variables that are likely to contain precursors. A methodology is proposed for discovering precursor rules from databases containing time series related to different regimes of a system. These precursor rules relate precursor events extracted from input time series with phenomenon events extracted from output time series. Using MIB datasets collected from real experiments involving Distributed Denial of Service Attacks, it is shown that precursor rules relating activities at attacking machines with traffic floods at target machines can be extracted by the methodology. The technology has extensive applications for security management: it enables security analysts to better understand the evolution of complex computer attacks, it can be used to trigger alarms indicating that an attack is imminent, or it can be used to reduce the false alarm rates of conventional IDSs.

Topology discovery for large ethernet networks

Accurate network topology information is important for both network management and application performance prediction. Most topology discovery research has focused on wide-area networks and examined topology only at the IP router level, ignoring the need for LAN topology information. Recent work has demonstrated that bridged Ethernet topology can be determined using standard SNMP MIBs; however, these algorithms require each bridge to learn about all other bridges in the network. Our approach to Ethernet topology discovery can determine the connection between a pair of the bridges that share forwarding entries for only three hosts. This minimal knowledge requirement significantly expands the size of the network that can be discovered. We have implemented the new algorithm, and it has accurately determined the topology of several different networks using a variety of hardware and network configurations. Our implementation requires access to only one endpoint to perform the queries needed for topology discovery.