The Time-to-live Research Articles

A Method for Malicious Network Packet Detection based on Anomalous TTL Values

In the current digital age, a pervasive shift towards digitalization is evident in all aspects of life, encompassing entertainment, education, business, and more. Consequently, the demand for internet access has surged, paralleled therefore unfortunate escalation in cybercrimes. This study undertakes an exploration into the intrinsic nature of network packets, aiming to discern their potential for malice or legitimacy. In the internet, 32 intermediate nodes are encountered by a Network packet before it reaches its final host. Our findings suggest that the time-to-live (TTL) parameter in certain IP packets diverges from the initial TTL by more than 32 intermediary hops. It's likely that these packets are generated by specialized software. We anticipate that malicious IP packets exhibit unconventional TTL values, influenced by factors such as the source machine's operating system and protocols like TCP/ICMP/UDP, etc. To gauge the effectiveness and value of the proposed method, an experiment was conducted utilizing the SNORT NIDS system. Filtering rules based on signatures were formulated to thoroughly analyze the traffic. Real network data, along with DARPA and MACCDC 2012 datasets, were employed as inputs for the SNORT NIDS, and it has been observed that the suggested approach successfully detects the anomalous network packets.

On Renting Edge Resources for Service Hosting

The rapid proliferation of shared edge computing platforms has enabled application service providers to deploy a wide variety of services with stringent latency and high bandwidth requirements. A key advantage of these platforms is that they provide pay-as-you-go flexibility by charging clients in proportion to their resource usage through short-term contracts. This affords the client significant cost-saving opportunities by dynamically deciding when to host its service on the platform, depending on the changing intensity of requests. A natural policy for our setting is the Time-To-Live (TTL) policy. We show that TTL performs poorly both in the adversarial arrival setting, i.e., in terms of the competitive ratio, and for i.i.d. stochastic arrivals with low arrival rates, irrespective of the value of the TTL timer. We propose an online policy called RetroRenting (RR) and characterize its performance in terms of the competitive ratio. Our results show that RR overcomes the limitations of TTL. In addition, we provide performance guarantees for RR for i.i.d. stochastic arrival processes coupled with negatively associated rent cost sequences and prove that it compares well with the optimal online policy. Further, we conduct simulations using both synthetic and real-world traces to compare the performance of RR with the optimal offline and online policies. The simulations show that the performance of RR is near optimal for all settings considered. Our results illustrate the universality of RR.

NB-IoTtalk: A Service Platform for Fast Development of NB-IoT Applications

Narrowband Internet of Things (NB-IoT) is considered as a promising wireless communications technology for Internet of Things (IoT) especially for the outdoor environment. Many outdoor IoT applications involve large numbers of homogeneous NB-IoT devices. It is tedious to specify and accommodate these devices during application development. To resolve this issue, this paper proposes a service platform for fast development of NB-IoT applications called NB-IoTtalk. This platform utilizes a tag mechanism to provide an easy-to-manipulate graphical user interface to accommodate a large number of NB-IoT devices in an application and transparently show them in a visual map. Our approach automatically creates and parses the device profile used to interpret the payload of an NB-IoT message. We then use a smart parking lot application as an example to investigate the event-triggered reporting of NB-IoT in terms of the time-to-live (TTL) report frequency and the outage detection accuracy. This paper provides the guidelines to set the TTL interval for event-triggered NB-IoT applications.

LAPEL: Hop Limit Based Adaptive PIT Entry Lifetime for Vehicular Named Data Networks

Named data networking (NDN) uses the content name instead of its location within the interest message to locate the content within the network. An interest is broadcasted by the content seeking node over the wireless channel with specific content name and waits for the data message containing the actual content. The broadcast region of an interest is restricted by using the time-to-live (TTL) field of the message. Record of every pending interest is stored in the pending interest table (PIT) for a specific duration, called PIT entry lifetime (PEL). The record is purged when a node either receives the data message or the PEL expires. The size of the PIT has a significant impact on the name prefix search during the interest or data message forwarding process. Additionally, the interest and/or data message loss in the vehicular network is very frequent, which results in a significant PIT size depending on the PEL. Vanilla NDN uses the fixed PEL of $4\text{ s}$ , and the very recent work considers the constant parameters to control the PEL, which fails to reduce the PIT size. Hence, in this paper, we propose a hop limit based adaptive PEL (LAPEL) scheme, which adaptively estimates the PEL at interest forwarding vehicle. LAPEL estimates PEL based on the lower layer parameters and has no constant factor that makes it more adaptive than the previously proposed schemes. Simulation results show that LAPEL has $52\%$ less PEL, reduces $8.4\%$ the PIT size, and achieves $4.5\%$ more interest satisfaction ratio, for any simulated TTL and interest rates.

Geo-Reactive: An Efficient and Reliable Hybrid Routing Protocol for VANETs

Objective: The main objective of this paper is to find an efficient and reliable path for routing data packets in vehicular ad hoc networks using hybrid routing. The hybrid routing protocol, Geo-Reactive, comprises of geographical routing and reactive routing with stable links. Method/Analysis: An analytical model has been derived for selective forwarding of Route Request (RREQ) packets through stable links. The mobility trace is generated using SUMO (Simulation of Urban Mobility) tool. This trace file is fed to NS-2 (Network Simulator) to compare the performance of our proposed protocol with GPSR in terms of packet delivery ratio, packet drop ratio and end-end delay. Findings: The simulation results obtained have been compared with GPSR and the results were promising in terms of packet delivery ratio, packet drop ratio and average end-end delay. The packet delivery ratio of Geo-Reactive increases when compared with GPSR as packets are forwarded only through stable links. This avoids frequent link failures thus improving the packet delivery ratio. This is also reflected in packet drop ratio. In Geo-Reactive protocol the Sequence number in the packet header of the reactive phase ensures that packets never get into loops which forces packets to be dropped after the Time-To-Live (TTL) expires. Also reduction in frequent link failures reduces packet drop ratio. As Geo-Reactive establishes a path with stable links, end to end communication delay is also reduced. Thus Geo-Reactive outperforms GPSR. Improvement: Geo-Reactive protocol definitely improves the performance of position based greedy forwarding technique by adopting a reactive protocol with stable links as recovery strategy. This hybrid mechanism of forwarding data packets using stable links outperforms GPSR.

Contact expectation based routing for delay tolerant networks

In conventional networks, routing problem can be modeled as the design of an efficient source-to-destination route based on persistent end-to-end paths. However, in a delay tolerant network (DTN), nodes are intermittently connected and thus, the end-to-end paths will not always exist, in which routing is a challenging issue. Previous DTN routing protocols tend to make routing decision based on the nodes’ contact information. In this paper, we observe that considering both the nodes’ contact information and message property such as the time-to-live (TTL) would help to improve the performance. Embedded this idea, we first propose an expected encounter based routing protocol (EER) which distributes multiple replicas of a message proportionally between two encounters according to their expected encounter values. In case of a single replica of a message, EER makes the routing decision by comparing two encountering nodes’ minimum expected meeting delays to destination. We further propose a community aware routing protocol (CAR) which takes advantages of the high contact frequency property of the nodes within the same community. We also propose the buffer management strategies corresponding for the two protocols. We conduct simulations to evaluate our proposed protocols and some existing ones on three metrics: delivery ratio, latency and goodput. The simulation results illustrate that our proposed EER and CAR protocols outperform other existing ones.

Hierarchical Cache Performance Analysis Under TTL-Based Consistency

This paper introduces an analytical model for characterizing the instantaneous hit ratio and instantaneous average hit distance of a traditional least recently used (LRU) cache hierarchy. The analysis accounts for the use of two variants of the Time-to-Live (TTL) weak consistency mechanism. The first is the typical TTL scheme (TTL-T) used in the HTTP/1.1 protocol where expired objects are refreshed using conditional GET requests. The second is TTL immediate ejection (TTL-IE) where objects are ejected as soon as they expire. The analysis also accounts for two sharing protocols: Leave Copy Everywhere (LCE) and Promote Cached Objects (PCO). PCO is a new sharing protocol introduced in this paper that decreases the user's perceived latency and is robust under nonstationary access patterns.

A Lease Algorithm to Maintain Strong Mapping Cache Consistency

In the Locator/ID separation protocol (LISP) network, mapping caches are usually used in Ingress tunnel routers to cache recently used identifier-to-locator mappings of remote hosts. When the original mapping in the Egress tunnel router changes, it introduces the problem of cache consistency. In general, the mapping cache supports weak cache consistency by using the time-to-live (TTL) mechanism. However, a stale mapping could lead the packets to a wrong destination. In this paper, we first evaluate the performance of TTL by trace-driven simulation and the results indicate that maintaining strong mapping cache consistency has become an indispensable mechanism in the LISP network. Then we design the lease algorithm to realize the strong consistency and propose analytical models to decide the lease duration based on the state space overhead and the control message overhead, respectively. We present numerical results to estimate the mapping change frequency, to show the impact of different parameters on the lease duration and to explore the relationship between the state space and control message overhead. Finally, we do the trace-driven simulation to compare the lease algorithm to polling-every-time and invalidation in terms of the state space and control messages. The lease algorithm with an appropriate lease duration can balance the state space and the control message overhead while providing strong mapping cache consistency.

Performance analysis of geography‐limited broadcasting in multihop wireless networks

ABSTRACTIn multihop wireless networks, delivering a packet to all nodes within a specified geographic distance from the source is a packet forwarding primitive (geography‐limited broadcasting), which has a wide range of applications including disaster recovery, environment monitoring, intelligent transportation, battlefield communications, and location‐based services. Geography‐limited broadcasting, however, relies on all nodes having continuous access to precise location information, which may not be always achievable. In this paper, we consider achieving geography‐limited broadcasting by means of the time‐to‐live (TTL) forwarding, which limits the propagation of a packet within a specified number of hops from the source. Because TTL operation does not require location information, it can be used universally under all conditions. Our analytical results, which are validated by simulations, confirm that TTL‐based forwarding can match the performance of the traditional location‐based geography‐limited broadcasting in terms of the area coverage as well as the broadcasting overhead. It is shown that the TTL‐based approach provides a practical trade‐off between geographic coverage and broadcast overhead. By not delivering the packet to a tiny fraction of the total node population, all of which are located near the boundary of the target area, TTL‐based approach reduces the broadcast overhead significantly. This coverage‐overhead trade‐off is useful if the significance of packet delivery reduces proportionally to the distance from the source. Copyright © 2011 John Wiley & Sons, Ltd.

SocioNet: A Social-Based Multimedia Access System for Unstructured P2P Networks

Increasingly, peer-to-peer (P2P) network users expect to be able to search objects by semantic attributes based on their preferences for multimedia content. Partial match search (i.e., search through the use of multimedia content semantic information) has become an essential service in P2P systems. In this paper, we propose SocioNet, a social-based overlay that clusters peers based on their preference relationships as a small-world network. In SocioNet, peers mimic how people form a social network and how they query, by preference, their friends or acquaintances. Hence, SocioNet benefits from two desirable features of a social network: interest-based clustering and small-world properties (i.e., high cluster coefficient among all peers yet short path lengths between any two peers). To realize an interest-based small-world SocioNet, we also investigate the following practical design issues: 1) similarity estimation: we define a quantifiable similarity measure that enables clustering of similar peers in SocioNet; 2) distributed small-world overlay adaptation: peers maintain a small-world overlay under network dynamics; and 3) query strategy under the small-world overlay: we analyze appropriate settings for the Time-to-Live (TTL) value, for TTL-limited flooding, that provides a satisfactory success ratio and avoids redundant message overhead. We use simulations and a real database called AudioScrobbler [CHECK END OF SENTENCE], which tracks users' listening habits, to evaluate the performance of SocioNet. The results show that SocioNet assists peers in locating content at peers with similar interests through short path lengths, and hence, achieves a higher success ratio (than nonsmall-world interest-based overlays and noninterest-based small-world overlays) while reducing message overhead significantly.

Maintaining Strong Cache Consistency for the Domain Name System

Effective caching in the domain name system (DNS) is critical to its performance and scalability. Existing DNS only supports weak cache consistency by using the time-to-live (TTL) mechanism, which functions reasonably well in normal situations. However, maintaining strong cache consistency in DNS as an indispensable exceptional handling mechanism has become more and more demanding for three important objectives: 1) to quickly respond and handle exceptions such as sudden and dramatic Internet failures caused by natural and human disasters, 2) to adapt increasingly frequent changes of Internet Protocol (IP) addresses due to the introduction of dynamic DNS techniques for various stationed and mobile devices on the Internet, and 3) to provide fine-grain controls for content delivery services to timely balance server load distributions. With agile adaptation to various exceptional Internet dynamics, strong DNS cache consistency improves the availability and reliability of Internet services. In this paper, we first conduct extensive Internet measurements to quantitatively characterize DNS dynamics. Then, we propose a proactive DNS cache update protocol (DNScup), running as middleware in DNS name servers, to provide strong cache consistency for DNS. The core of DNScup is an optimal lease scheme, called dynamic lease, to keep track of the local DNS name servers. We compare dynamic lease with other existing lease schemes through theoretical analysis and trace-driven simulations. Based on the DNS dynamic update protocol, we build a DNScup prototype with minor modifications to the current DNS implementation. Our system prototype demonstrates the effectiveness of DNScup and its easy and incremental deployment on the Internet.

Defense Against Spoofed IP Traffic Using Hop-Count Filtering

IP spoofing has often been exploited by Distributed Denial of Service (DDoS) attacks to: 1)conceal flooding sources and dilute localities in flooding traffic, and 2)coax legitimate hosts into becoming reflectors, redirecting and amplifying flooding traffic. Thus, the ability to filter spoofed IP packets near victim servers is essential to their own protection and prevention of becoming involuntary DoS reflectors. Although an attacker can forge any field in the IP header, he cannot falsify the number of hops an IP packet takes to reach its destination. More importantly, since the hop-count values are diverse, an attacker cannot randomly spoof IP addresses while maintaining consistent hop-counts. On the other hand, an Internet server can easily infer the hop-count information from the Time-to-Live (TTL) field of the IP header. Using a mapping between IP addresses and their hop-counts, the server can distinguish spoofed IP packets from legitimate ones. Based on this observation, we present a novel filtering technique, called Hop-Count Filtering (HCF)-which builds an accurate IP-to-hop-count (IP2HC) mapping table-to detect and discard spoofed IP packets. HCF is easy to deploy, as it does not require any support from the underlying network. Through analysis using network measurement data, we show that HCF can identify close to 90% of spoofed IP packets, and then discard them with little collateral damage. We implement and evaluate HCF in the Linux kernel, demonstrating its effectiveness with experimental measurements

TTL Prediction Schemes and the Effects of Inter-Update Time Distribution on Wireless Data Access

Modern mobile networks, such as GPRS and UMTS, support wireless data applications. One successful example is the ever popular i-Mode in Japan. Wireless data services (wireless Internet) become more important as more and more customers of handheld devices enjoy the convenience of the ubiquitous computing. To improve the effective wireless data access, the time-to-live (TTL) management for data entries becomes important due to its use in effective caching design. In this paper, we study three TTL prediction schemes and investigate the effects of the inter-update time distribution on the wireless data access. Performance analysis is carried out via simulations as well as analytical modeling. We expect our results will be useful for the future wireless data access systems, in which transmission power for mobile devices is more limited.

Analysis and evaluation of expiration-based hierarchical caching systems

This paper investigates some fundamental properties and performance issues of the expiration-based caching systems. We focus on the hierarchical caching systems based on the time-to-live (TTL) expiration mechanism, and present a basic model for such systems. By analyzing the intrinsic timing behavior in this model, we derive some important performance metrics from the perspectives of caching systems and end users, respectively. We use network simulation results to further substantiate the efficacy of our analysis. Our results show some basic properties and trade-offs for a hierarchical caching system based on the weak consistency mechanism.

Algorithms and protocols for stateless constrained-based routing

Quality of service (QoS) routing has generally been addressed in the context of reservation-based network services (e.g. ATM, IntServ), which require explicit (out of band) signaling of reservation requests and maintenance of per-flow state information. It has been recognized that the processing of per-flow state information poses scalability problems, especially at core routers. To remedy this situation, in this paper we introduce an approach for stateless QoS routing in IP networks that assumes no support for signaling or reservation from the network. Instead, our approach makes use of the currently unused two bits in the DiffServ (DS) byte of the IP packet header. Simple heuristics are used to identify a low-cost delay-constrained path. These heuristics essentially divide the end-to-end path into at most two ‘superedges’ that are connected by a ‘relay node’. Routers that lie on the same superedge use either the cost metric or the delay metric (but not both) to forward the packet. Standard hop-by-hop forwarding is performed with respect to either metric. Two different approaches are presented for implementing the relay-based forwarding. In the first approach, a probing protocol is used to identify the relay node and the routing metrics of the superedges. Tunneling and packet encapsulation are then used to forward packets from the source node to the relay node and then from the relay node to the destination node. The second approach does not require probing, but instead relies on the time-to-live (TTL) field in the header of the IP packet. Simulations are presented to evaluate the cost performance of the various approaches.

Modeling frequently accessed wireless data with weak consistency

To reduce the response times of wireless data access in a mobile network, caches are utilized in wireless handheld devices. If the original data entry has been updated, the cached data in the handheld device becomes stale. Thus, a mechanism is required to predict when the cached copy will expire. This paper studies a weakly consistent data access mechanism that computes the time-to-live (TTL) interval to predict the expiration time. We propose an analytic model to investigate this TTL-based algorithm for frequently accessed data. The analytic model is validated against simulation experiments. Our study quantitatively indicates how the TTL-based algorithm reduces the wireless communication cost by increasing the probability of stale accesses. Depending on the requirements of the application, appropriate parameter values can be selected based on the guidelines provided in this paper.