Source Address Research Articles

Deep-transfer learning framework in SDN for gateway ports security

Gateway port security with validation method is an important part in Software Defined Networks (SDN). Using soil-adjusted vegetation index (SAVI) and SDN in one salable network such as Internet of Things (IoT) and Wireless Sensor Network (WSN) meets new challenges in infrastructure and architecture. The main challenges are complexity of deploying SAVI and obtaining security data at the access layer. The use of combined deep-transfer learning model to allow the validation of the appropriate source address at downstream network input ports in SDN. This research aims to provide a secure gateway structure with the maximum privacy of data in the IoT-SDN environment. The use of encryption mechanisms including Datagram Transport Layer Security (DTLS) and Frequency shift keying (FSK) is considered as the main approach used in the Message Queuing Telemetry Transport (MQTT) protocol structure for sending and receiving data. Improving the quality of services includes delays, throughput, and some others to manage the resources of the network. The results represented that the proposed approach has better performance in comparison to others.

HyPASS: Design of hybrid-SDN prevention of attacks of source spoofing with host discovery and address validation

SDN (Software-Defined Networking) is a new technology that separates data and control planes; the main components of SDN are OFSwitches and Controller. The traffic flow is monitored by the SDN controller. Initially, OFSwitches lack security rules for packet handling. OFSwitch sends the packet to the controller for examination, creating control messages that favor the packet and establishing necessary flow entry. Host packets are sent to their destination, seeing only the destination host address and not the source host address. The attacker takes advantage of this situation and generates packets with forged source addresses in order to conceal his identity and perform various source address spoofed attacks such as Denial of Service (DoS), man in the middle (MiM), Distributed DoS (DDoS), and so on. This paper proposes a design for discovering hosts proactively, preparing HostTable, configuring flow entry during handshaking, and detecting and preventing source-forged attacks in Hybrid SDN. We called it HyPASS: Design of Hybrid-SDN Prevention of Source Spoofing Attacks with Host Discovery and Address Validation. We used Python for Mininet implementation and tested it on RYU and POX controllers. During the experiment, it identifies and drops 99.99% of packets with the forged source address.

Deep packet analysis firewall model

Firewall (software or hardware device that monitors traffic into and out of the network). It can be classified as stateless or stateful. The existing firewalls are only concerned with filtering packets based on the information contained in the header part of every packet. The most improved stateful inspection firewalls have a state table enabling the storage of header information such as source address, destination address, port, connection status and protocol. Consequently, existing firewalls can be compared to only reading the book tittle and foregoing other essential activities such as evaluating the content of the book. The proposed Deep packet analysis firewall model, not only evaluated the header content of a packet but also open and examines the content in a packet in order to detect and block any threats. In addition, the proposed model will be analyzing the actual content of the traffic that is flowing through packet as opposed to existing firewall which only focuses on analyzing the header content. The model will also locate, detect, categorize, block, or reroute packets having certain data payload and specific codes that are not located, detected, categorized, blocked or redirected by existing firewall. Therefore, deep packet analysis firewall model is a feasible approach to overcome challenges faced in cyberspace today. The proposed Deep packet analysis firewall model will use mixed research method. Quantitative method will include obtaining data from the peer reviewed academic articles in the area of study. Quantitative method will also entail using a simulation by feeding quantitative data into the model to produce quantitative results. Finally, qualitative method will include conducting interviews and use of questionnaires

Study on data mining method of network security situation perception based on cloud computing

Abstract In recent years, the network has become more complex, and the attacker’s ability to attack is gradually increasing. How to properly understand the network security situation and improve network security has become a very important issue. In order to study the method of extracting information about the security situation of the network based on cloud computing, we recommend the technology of knowledge of the network security situation based on the data extraction technology. It converts each received cyber security event into a standard format that can be defined as multiple brochures, creating a general framework for the cyber security situation. According to the large nature of network security situation data, the Hadoop platform is used to extract aggregation rules, and perform model extraction, pattern analysis, and learning on a network security event dataset to complete network security situation rule mining, and establish a framework for assessing the state of network security. According to the results of the federal rule extraction, the level of network node security risk is obtained in combination with signal reliability, signal severity, resource impact, node protection level, and signal recovery factor. A simulation test is performed to obtain the intrusion index according to the source address of the network security alarm. Through the relevant experiments and analysis of the results, the attack characteristics obtained in this study were obtained after manually reducing the network security event in the 295 h window. The results show that after the security event is canceled, the corresponding window attack index decreases to 0, indicating that this method can effectively implement a network security situation awareness. The proposed technique allows you to accurately sense changes in network security conditions.

An efficient and reliable service customized routing mechanism based on deep learning in IPv6 network

Best-effort service model of traditional routing is gradually hard to meet the personalized demands under the rapid development of network technologies (e.g. 5G and IPv6). Therefore, service customization should be considered. In this work, a service customized routing mechanism based on deep learning in IPv6 network is proposed, which includes deep learning-based service customization module, reliability evaluation module, and routing calculation module. The first module uses neural network to learn the complex service customization function, which can quickly output win-win customized service strategies based on user demands. The second module can quantify the reliability of service routing paths, where not only the link status of IPv6 Neighbor Unreachable Detection (NUD) is considered, but also propose link performance weights to ensure the reliability of differentiated service performance. The third module uses the gray wolf optimization algorithm to calculate an optimal routing path to forward services with the customized strategies as the constraints and the maximum reliability and minimum cost as the goal. Finally, the mechanism is tested on the IPv6 Source Address Validation Improvement (SAVI) platform, which can reduce the execution time by 12.25% and improve the average routing reliability, user and ISP satisfaction by 9.0%, 40.45% and 7.4%, respectively.

PbCP: A profit-based cache placement scheme for next-generation IoT-based ICN networks

The large number of connected devices generating a massive amount of data in the emerging technologies such as the Internet of Things (IoT), will surpass the capabilities of the current Internet infrastructure. Therefore, it is essential to design a new communication paradigm to meet the demands and requirements of new applications. Information-Centric Networking (ICN) is a new candidate for future Internet architecture that aims at addressing different challenges in the currently used host-centric Internet. In ICN, the data/content is searched, routed, located, and retrieved through the name of the content rather than the address of data source. ICN also enables in-network caching where the intermediate nodes can cache the content. In-network caching helps in improving the network scalability and reduces the content retrieval delay. To date, multiple caching schemes have been designed for IoT data management in ICN; however, most of them suffer from scalability or ignore constraints on the IoT devices. Moreover, the placement of content in a large-scale environment needs further improvement and optimization since it impacts overall network performance. To fill the gaps, in this paper, we combine various metrics that affect caching performance. We formulate the content placement as an optimization problem and then propose a profit-based caching scheme that harnesses the benefits of the Tabu local search algorithm. The simulation results and comparative analysis show that the proposed strategy outperforms the existing state-of-art schemes, notably in terms of memory resources utilization, data transmission time, content diversity ratio, and cache replacement operations.

Beware of IPs in Sheep’s Clothing: Measurement and Disclosure of IP Spoofing Vulnerabilities

Networks not employing destination-side source address validation (DSAV) expose themselves to a class of pernicious attacks which could be prevented by filtering inbound traffic purporting to originate from within the network. In this work, we survey the pervasiveness of networks vulnerable to infiltration using spoofed addresses internal to the network. We issue recursive Domain Name System (DNS) queries to a large set of known DNS servers world-wide using various spoofed-source addresses. In late 2019, we found that 49% of the autonomous systems we tested lacked DSAV. After a large-scale notification campaign run in late 2020, we repeated our measurements in early 2021 and found that 44% of ASes lacked DSAV—though importantly, as this is an observational study, we cannot conclude causality. As case studies illustrating the dangers of a lack of DSAV, we measure susceptibility of DNS resolvers to cache poisoning attacks and the NXNS attack, two attacks whose attack surface is significantly reduced when DSAV in place. We discover 309K resolvers vulnerable to the NXNS attack and 4K resolvers vulnerable to cache poisoning attacks, 70% and 59% of which would have been protected had DSAV been in place.

DoSGuard: Mitigating Denial-of-Service Attacks in Software-Defined Networks.

Software-defined networking (SDN) is a new networking paradigm that realizes the fast management and optimal configuration of network resources by decoupling control logic and forwarding functions. However, centralized network architecture brings new security problems, and denial-of-service (DoS) attacks are among the most critical threats. Due to the lack of an effective message-verification mechanism in SDN, attackers can easily launch a DoS attack by faking the source address information. This paper presents DoSGuard, an efficient and protocol-independent defense framework for SDN networks to detect and mitigate such attacks. DoSGuard is a lightweight extension module on SDN controllers that mainly consists of three key components: a monitor, a detector, and a mitigator. The monitor maintains the information between the switches and the hosts for anomaly detection. The detector utilizes OpenFlow message and flow features to detect the attack. The mitigator protects networks by filtering malicious packets. We implement a prototype of DoSGuard in the floodlight controller and evaluate its effectiveness in a simulation environment. Experimental results show the DoSGuard achieves 98.72% detecion precision, and the average CPU utilization of the controller is only around 8%. The results demonstrate that DoSGuard can effectively mitigate DoS attacks against SDN with limited overhead.

IP Packaging Filtering in Computer Networks Using Artificial Intelligence in the Regulatory Authority of Electronic and Communications Kosovo

The security of our data is one of the most important challenges, and it is one of the things we must be careful about what we display on the Internet. For the security of this data, computer and cyber networking experts use different methods to prevent these attacks, prevention is done by Firewall techniques, and then by Router where both of these cases are quite popular nowadays today, however, another innovation is that filtering can also be done through Artificial Intelligence. In this paper, research has been done on the application of Artificial Intelligence methods such as those of deep learning on IP packages through Artificial Intelligence where specifically the method of Support Vector Machine with the training of a model through a simulated input corpus, using MATLAB software. From the results of the research by Artificial Intelligence, the source address, destination address, port number, protocol and package size were used as filters. All the practical work was done in over 350 different IP addresses, where 175 IPs were used for algorithm training, as well as 175 IPs were used for testing by combining them with filtering attributes, where in the end the filtering accuracy gained is quite high (83%).

An Optimal Framework for SDN Based on Deep Neural Network

Software-defined networking (SDN) is a new paradigm that promises to change by breaking vertical integration, decoupling network control logic from the underlying routers and switches, promoting (logical) network control centralization, and introducing network programming. However, the controller is similarly vulnerable to a “single point of failure”, an attacker can execute a distributed denial of service (DDoS) attack that invalidates the controller and compromises the network security in SDN. To address the problem of DDoS traffic detection in SDN, a novel detection approach based on information entropy and deep neural network (DNN) is proposed. This approach contains a DNN-based DDoS traffic detection module and an information-based entropy initial inspection module. The initial inspection module detects the suspicious network traffic by computing the information entropy value of the data packet's source and destination Internet Protocol (IP) addresses, and then identifies it using the DDoS detection module based on DNN. DDoS assaults were found when suspected irregular traffic was validated. Experiments reveal that the algorithm recognizes DDoS activity at a rate of more than 99%, with a much better accuracy rate. The false alarm rate (FAR) is much lower than that of the information entropy-based detection method. Simultaneously, the proposed framework can shorten the detection time and improve the resource utilization efficiency.

Counterfeit Clones: A Novel Technique for Source and Sink Location Privacy in Wireless Sensor Networks

Wireless Sensor Networks (WSNs) are an essential part of the Internet of Things (IoT). In WSNs, sensors are randomly deployed in harsh environments for monitoring purposes. In such environments, employing only the content protection mechanisms available leaves WSNs vulnerable to unauthorized interception by global and local adversaries. An attacker may exploit contextual data to locate the source or the sink; therefore, context privacy is an exigent part of WSN privacy that cannot be neglected. WSN is used in many applications and can transmit sensitive information. To protect sensitive information, it is necessary to provide protection techniques to prevent the adversary from breaching and exposing the location of the source and sink. Past works focus on protecting the location at the routing level; however, the adversary could bypass that and easily locate the nodes by capturing frames and discovering the source and destination addresses. In this paper, we propose the Counterfeit Clones (CC) scheme to protect nodes’ location privacy at the data link layer by using a lightweight one-way hash function to hide the MAC address. At the routing level, fake sources and sinks are deployed to obfuscate the source and the destination node identity. The performance analysis results confirm that the CC technique has a longer safety time with lower energy consumption in comparison with some of the existing solutions. Compared to contrasting algorithms, CC can increase the safety time and protect the location privacy for source and sink with faster packet transmission to the base station.

Self-healing topology for DDoS attack identification & discovery protocol in software-defined networks

Software defined networking is an emerging network architecture that separates the control plane from the data plane of network devices and places the control plane on one or more control servers capable of managing the rules traffic forwarding of all communication devices under your domain. This article describes the architecture, different modules, and event sequences of the HyPASS for real-time protection from address-forged attacks with proactive host discovery and address validation. Such attacks cause the wastage of network bandwidth, processing power, and network resources available to the user. We performed the latency, throughput, and attack prevention tests using POX & RYU controllers on the Mininet network simulator with and without HyPASS. The system performance is analyzed for accuracy and efficiency in four different SDN scenarios categorized as fully OpenFlow enabled and Hybrid. The proposed system discovers all the live hosts in the network, updates Host Table at the handshaking between controller and OpenFlow switches. Experiments show that the system prevented all the address-forged attacks by validating the source address in different SDN environments. It achieves a 99.99% filtering accuracy level in a fully OpenFlow-enabled setup.

Status of address spoofing attack prevention techniques in software-defined networking (SDN)

The numerous benefits of software-defined networking technology are enticing businesses to use it. Simple forwarding devices that support the OpenFlow protocol send data packets across the network data plane and control plane. The flight control plane is managed using SDN control. A forwarding device sends a data packet from the source host to the destination, using the address information from the packet in process. Before sending any data, the device will first check to see if the originating host address is valid. The SDN controller monitors data packet flows and makes the necessary entries in the device’s flow route. Hosts are unable to send data packets because there is no first flow entry. The forwarding device sends this data packet to the controller. As a result of this analysis, the controller creates the relevant flow entry in the device’s flow table. If this is the case, fake source address attacks could be used to wreak havoc on the network. This article investigates the current state of SDN attack avoidance solutions for SDN configuration and provides a review of such tactics.

Optimizing network microsegmentation policy for cyber resilience

This paper describes an approach for improving cyber resilience through the synthesis of optimal microsegmentation policy for a network. By leveraging microsegmentation security architecture, we can reason about fine-grained policy rules that enforce access for given combinations of source address, destination address, destination port, and protocol. Our approach determines microsegmentation policy rules that limit adversarial movement within a network according to assumed attack scenarios and mission availability needs. For this problem, we formulate a novel optimization objective function that balances cyberattack risks against accessibility to critical network resources. Given the application of a particular set of policy rules as a candidate optimal solution, this objective function estimates the adversary effort for carrying out a particular attack scenario, which it balances against the extent to which the solution restricts access to mission-critical services. We then apply artificial intelligence techniques (evolutionary programming) to learn microsegmentation policy rules that optimize this objective function.

An Adaptive Authenticated Model for Big Data Stream SAVI in SDN-Based Data Center Networks

With the rapid development of data-driven and bandwidth-intensive applications in the Software Defined Networking (SDN) northbound interface, big data stream is dynamically generated with high growth rates in SDN-based data center networks. However, a significant issue faced in big data stream communication is how to verify its authenticity in an untrusted environment. The big data stream traffic has the characteristics of security sensitivity, data size randomness, and latency sensitivity, putting high strain on the SDN-based communication system during larger spoofing events in it. In addition, the SDN controller may be overloaded under big data stream verification conditions on account of the fast increase of bandwidth-intensive applications and quick response requirements. To solve these problems, we propose a two-phase adaptive authenticated model (TAAM) by introducing source address validation implementation- (SAVI-) based IP source address verification. The model realizes real-time data stream address validation and dynamically reduces the redundant verification process. A traffic adaptive SAVI that utilizes a robust localization method followed by the Sequential Probability Ratio Test (SPRT) has been proposed to ensure differentiated executions of the big data stream packets forwarding and the spoofing packets discarding. The TAAM model could filter out the unmatched packets with better packet forwarding efficiency and fundamental security characteristics. The experimental results demonstrate that spoofing attacks under big data streams can be directly mitigated by it. Compared with the latest methods, TAAM can achieve desirable network performance in terms of transmission quality, security guarantee, and response time. It drops 97% of the spoofing attack packets while consuming only 9% of the controller CPU utilization on average.

Enhancement performance of random forest algorithm via one hot encoding for IoT IDS

The random forest algorithm is one of important supervised machine learning (ML) algorithms. In the present paper, the accuracy of the results of the random forest (RF) algorithm has been improved by the use of the One Hot Encoding method. The Intrusion Detection System (IDS) can be defined as a system that can predict security vulnerabilities within network traffic and is located out of range on a network infrastructure. It does not affect the efficiency of the built-in network because it analyzes a copy of the built-in traffic flow and reports results to the administrator by giving alerts. However, since IDS is a listening system only, it cannot take automatic action to prevent an attack or security vulnerability detected from infecting the system, it provides information about the source address to start the break-in, the address of the target and the type of suspected attack. The IoTID20 dataset is used to verify the improved algorithm, where this dataset is having three targets, the proposed system is compared with the state-of-art approaches and shows superiority over them.

LAFS: a learning-based adaptive forwarding strategy for NDN-based IoT networks.

Named Data Networking (NDN) is a data-driven networking model that proposes to fetch data using names instead of source addresses. This new architecture is considered attractive for the Internet of Things (IoT) due to its salient features, such as naming, caching, and stateful forwarding, which allow it to support the major requirements of IoT environments natively. Nevertheless, some NDN mechanisms, such as forwarding, need to be optimized to accommodate the constraints of IoT devices and networks. This paper presents LAFS, a Learning-based Adaptive Forwarding Strategy for NDN-based IoT networks. LAFS enhances network performances while alleviating the use of its resources. The proposed strategy is based on a learning process that provides the necessary knowledge allowing network nodes to collaborate smartly and offer a lightweight and adaptive forwarding scheme, best suited for IoT environments. LAFS is implemented in ndnSIM and compared with state-of-the-art NDN forwarding schemes. As the obtained results demonstrate, LAFS outperforms the benchmarked solutions in terms of content retrieval time, request satisfactory rate, and energy consumption.

On Capturing DDoS Traffic Footprints on the Internet

While distributed denial-of-service (DDoS) attacks are easy to launch and are becoming more damaging, the defense against DDoS attacks often suffers from the lack of relevant knowledge of the DDoS traffic, including the paths the DDoS traffic has used, the source addresses (spoofed or not) that appear along each path, and the amount of traffic per path or per source. Though IP traceback and path inference approaches could be considered, they are either expensive and hard to deploy or inaccurate. We propose PathFinder, a service that a DDoS defense system can use to obtain the footprints of the DDoS traffic to the victim. PathFinder employs an architecture that is easy to implement and deploy on today's Internet, a PFTrie data structure that introduces multiple design features to log traffic at line rate, and streaming and zooming mechanisms that facilitates the storage and transmission of DDoS footprints more efficiently. Our evaluation shows that PathFinder can significantly improve the efficacy of a DDoS defense system, its PFTrie data structure is fast and has a manageable overhead, and its streaming and zooming mechanisms significantly reduce the delay and overhead in transmitting DDoS footprints.

A dynamic and lightweight framework to secure source addresses in the SDN-based networks

We consider the problem of source address validation implementation (SAVI) in a Software-Defined Network (SDN) environment. The integration of SAVI and SDN can further address the challenges in a typical architecture such as the complexity of SAVI's deployment and the acquisition of security data in the access layer. A key aspect of this campaign consists of filtering forged packets and verifying the authenticity of the source address. A common strategy is to create bindings between the IP address of a node and a property of the host's network attachment. However, problem still accompany with the deployment of SAVI, including the performance cost of the SDN controller caused by the redundant validation process, especially in the case of an overflow of the flow table and other anomalous conditions in the network. Our contribution in this paper is to design and implement a dynamic framework for lightweight SAVI based on SDN (D-SAVI), which is an enhancement of SDN setups to allow proper source address validation on downstream network ingress ports, without incurring a large performance overhead. Initially, we proposed a fine-grained dual-level structure to match flow entry flexibly to complete the dynamic deployment of SAVI. A priority-based validation mechanism was added for further efficiency optimization. We then designed a state partition and transition module to optimize network performance under anomalous conditions, especially the communication performance between the controllers and switches in the SDN-based networks with a global view. Consequently, under the premise of network security, D-SAVI could filter out, with better packet forwarding efficiency, packets that do not match existing binding relationships. The experimental results demonstrate that our implementation provides source address verification with less resource consumption than existing methods.

Network intrusion detection with a novel hierarchy of distances between embeddings of hash IP addresses

Including high-dimensional categorical predictors in a machine learning model is a major challenge. This is particularly appropriate for the IP and Port addresses of network connections when they are considered as predictors (features) in machine learning models. These features are particularly important for network intrusion detection, as many attacks exploit information about IP/Port addresses. The sparsity and high dimensionality of these features make it difficult their inclusion into the models, being discarded as useful information in many cases. This work proposes to replace the original network addresses by new features based on a set of distances defined between different components of the source and destination IP and Port addresses. These distances incorporate information on the probability of co-occurrence of source and destination addresses. The distances are calculated using a dense, low-dimensional vector representation (embedding) of the different network address components. The embeddings are obtained with a neural network, which requires few computational resources, plus an additional hash function that collapses the extremely large range of IP and Port values, making the model implementation feasible. A self-supervised learning framework under a hierarchical model is used to train the encoding network.The novel features can be used to predict future co-occurrence of source and destination network addresses, and, when applied as features in a supervised model, they significantly increase the prediction performance of most classifiers for the detection of network intrusions. We demonstrate this prediction improvement over two modern network intrusion datasets: CICIDS2017 and CICDDoS2019.