Traffic Attacks Research Articles

Anterior wrist and medial malleolus as the novel sites of tissue selection: a retrospective study on electric shock death through the hand-to-foot circuit pathway.

Our previous work demonstrated that characteristic changes could occur in the anterior wrist and medial malleolus in electric deaths through the hand-to-foot electric circuit pathway in an electric shock rat model. However, whether the same phenomenon occurs in humans is unknown. The aim of the present retrospective study was to ascertain whether the anterior wrist and medial malleolus could also be selected as the promising and significant sites in electric death through the hand-to-foot circuit pathway. Nineteen human cases from the autopsy and one clinical survivor who sustained a severe electric shock through the hand-to-foot circuit pathway were analyzed. Additional ten autopsy patients who died from traffic accidents and sudden cardiac attacks were used as the control group. Histopathological changes in the soft tissues of the anterior wrist and medial malleolus in all autopsy patients, as well as the electric current pathway of the survivor, were observed. The results showed that the nuclear polarizations in the anterior wrist and medial malleolus soft tissues of the electric death were extremely noticeable as compared with the controls. The most severe electrical injury in the survivor occurred in the anterior wrist. These findings suggest that the soft tissues of the anterior wrist and/or the medial malleolus as the narrowest parts of the limbs could be used as the complementary sites for tissue selection and considered as necessary locations for examinations to assess the electric death in medicolegal identification.

Agent Based Detection Mechanism to Outwit Distributed Denial of Service Attacks in Cloud Computing Environment

Distributed Denial of Service (DDoS) poses the highest rate of vulnerability to cloud computing in terms of availability with ability to destruct the Data-Center (DC) resources. The fortunate part of the attackers is these kinds of attacks are easier to launch the obscure flood towards victim DC and the unfortunate part of detection mechanism is to uncover the attack events and to protect the victim. In order to adapt and automate the detection mechanism in large scale network, agent based detection helps in improving the efficiency of detection. An increase in the network scale will also require the increase in agents deployed in the network to detect the vulnerability DDoS attack threats. This agent based DDoS Mechanism not only protects against huge DDoS flood, but also distinguishes the traffic characteristics by continuous traffic probing to classify the flash crowd traffic event and DDoS attack threat. Jade tool is used to simulate the experiment for our proposed detection scheme.

Towards Improving Security in VANET: Some New Possible Attacks and Their Possible Solutions

Vehicular ad hoc network (VANET) is taken more attention from the end user due to its potential safety and non-safety applications. The basic design objective of these applications to serve the users and provide safety of human lives during their journey. The role of the end user is more prominent for next generation vehicular networks. An attacker is one of type of end user, but their role in the network is negative and creates problems for other components of network. So in this paper, we will discuss two new types of attacks which are called road side traffic signal attack and also Internet attack in vehicular network. The authors will explain an attacker's behaviour and how he/she will launch an attack on a road side traffic signal and Internet services and create problems for other users of network. Through different scenarios, it will explain the effect of these attacks on other components of network. Trusted Platform module (TPM) is a security hardware module and it is provided the secure communication in network, so we will discuss in detail how this security module will handle these newly address attacks in network.

Security of grid structures under disguised traffic attacks

Models of rectangular grid structures were constructed in the form of a colored Petri net. The basic model consists of a matrix of switching nodes that deliver packets to computing nodes which are attached to the matrix borders and produce and consume packets. Since grid structures are often employed to solve boundary value problems, square and torus surfaces were studied and generalized to hypercube and hypertorus in multidimensional space using a grid node that aggregates switching and computing nodes. Traffic guns were added to the models to represent traffic attacks. Simulation in CPN Tools revealed simple and dangerous traffic gun configurations, such as a traffic duel, focus, crossfire, and side shot, which bring the grid to complete deadlock at less than 5 % of the grid peak load. Comparably low gun intensity targeted to induce deadlock areas within a grid (network) is a key characteristic of disguised traffic attacks. The aim of future work will be to develop counter-measures for these attacks.

Monitoring DDoS by Using SDN

To maintain high-quality and uninterrupted online services, and reduce intangible losses caused by network interruptions, the researchers of the present study developed a network monitoring mechanism, highlighting the importance of preventing malicious connections and attack behavior. To enable the early detection of network threats and reduce the load of end-terminal infiltration detection systems, the present study designed a mechanism that prevents malicious connections and attack behavior by monitoring network traffic volume. The mechanism is based on fuzzy control theory and supplemented by statistical theory. The traffic volume behavior and normal connection behavior of individual data transmissions are compared to establish normal transmission behavioral models, which serve as the network monitoring and warning functions of the proposed mechanism. The present study improves upon the internal network outcomes reported in studies presenting similar mechanisms. In a reinforced external network, the researchers conducted an experiment to improve the practicality of the proposed mechanism. Finally, the researchers adopted a software-defined networking defensive method for fending off traffic volume attacks, which achieved a 95% defense rate against traffic volume attacks, effectively mitigating the attack rate of distributed denial of service attacks.

It Leaks More Than You Think: Fingerprinting Users from Web Traffic Analysis

We show how, in real-world web applications, confidential information about user identities can be leaked through “non-intuitive communications”, in particular web traffic which appear to be not related to the user information. In fact, our experiments on Google users demonstrate that even Google accounts are vulnerable on traffic attacks against user identities, using packet sizes and directions. And this work shows this kind of non-intuitive communication can leak even more information about user identities than the traffic explicitly using confidential information. Our work highlights possible side-channel leakage through cookies and more generally discovers fingerprints in web traffic which can improve the probability of correctly guessing a user identity. Our analysis is motivated by Hidden Markov Model, distance metric and guessing probability to analyse and evaluate these side-channel vulnerabilities. Keywords: Side-channel leakages, User identities, Web applications, Google accounts. DOI: https://doi.org/10.18267/j.aip.70

산업제어시스템에서의 MITM 공격을 방어하기 위해 개선된 프로토콜

If the industrial control system is infected by malicious worm such as Stuxnet, national disaster could be caused inevitably. Therefore, most of the industrial control system defence is focused on intrusion detection in network to protect against these threats. Conventional method is effective to monitor network traffic and detect anomalous patterns, but normal traffic pattern attacks using MITM technique are difficult to be detected. This study analyzes the PROFINET/DCP protocol and weaknesses with the data collected in real industrial control system. And add the authentication data field to secure the protocol, find out the applicability. Improved protocol may prevent the national disaster and defend against MITM attacks.

Clustering-Based Pattern Abnormality Detection in Distributed Sensor Networks

We suggest a method of effectively detecting and classifying network traffic attacks by visualizing their IP (Internet protocol) addresses and ports and clustering the visualized ports based on their variance. The proposed approach first visualizes the IP addresses and ports of the senders and receivers into two-dimensional images. The method then analyzes the visualized images and extracts linear and/or high brightness patterns, which represent traffic attacks. Subsequently, it groups the ports using an improved clustering algorithm, allowing an artificial neural network to learn the extracted features and to automatically detect and classify normal traffic data, DDoS attacks, DoS attacks, or Internet Worms. The experiments conducted in this work prove that our suggested clustering-based algorithm effectively detects various traffic attacks.

Detecting an Anomalous Traffic Attack Area based on Entropy Distribution and Mahalanobis Distance

This paper deals with detecting an anomalous traffic area based on its distribution and distance measurements. On detecting anomalous traffic such as flooding attack traffic we should consider the packet attribute of the traffic. In order to identify that traffic, we compute entropy of selected packet attribute and Mahalanobis distance between normal and abnormal traffics. Chi-square test is used to evaluate the proposed method. Detection accuracy and performance are analyzed using real network traffic trace which consists the mostly backscatter of SYN flooding attack from LANDER project. The result of our proposed method indicates that it can show and offer significantly an accurate result.

Spektral Analysis of Honeypot Network Traffic

Traffic anomalies such as failures and attacks are commonplace in today’s computer networks. Identifying, diagnosing and treating anomalies in a timely fashion are a fundamental part of day to day network operations. In this paper we propose the design of using spectral analysis to study network traffic attack captured by honeypot. As sample attack we used yahoo messenger bots. We use the amount of packet traffic arrival in certain time frame and represent it into time series and spectral form.

ESTIMATION OF THE ILL-INTENTIONED TRAFFIC EFFECT UPON FUNCTIONING OF COMPUTING GRIDS

A rectangular communication grid model was constructed in the form of a colored Petri net as a composition of submodes of terminal devices producing and consuming packets and communication devices switching packets for their delivery among terminal devices. The model was supplied with traffic guns simulating ill-intended traffic. Via simulation in CPN Tools it was shown that a traffic duel of a pair of guns brings the grid to a full deadlock with less than five percent of the peak load. Thus, the vulnerability of grids to traffic attacks was revealed. The future work is aimed to resist the attacks.

An Energy-Efficient Attack Detection Protocol for WSN

Traffic attack and false data aggregation attack are serious to wireless sensor networks. How to detect the two kinds of attack is a difficult problem. An energy-efficient attack detection protocol is proposed in this paper. The detection protocol uses linear prediction to establish easy ARMA(2,1) model for sensor nodes. In the detection protocol, different nodes play different roles, and use different monitor schemes. Virtual cluster head and monitor nodes are elected. Monitor nodes monitor cluster head, and member nodes are monitored by their cluster head. At the same time, secure data aggregation schemes are added to the protocol. Simulation shows that, the detection protocol can real-time predict traffic attacks, and insure correct data aggregation, but consume less energy.

일회성 세션 키 기반 HTTP DDoS 공격 방어기법

2009년 77DDoS 대란 이후 DDoS 공격은 사회적 위협으로 발전하고 있다. 이러한 위협에 대응하기 위해 다양한 DDoS방어기법이 연구되고 있으나, DDoS 공격기법 또한 더욱 정교해지고 있다. DDoS 공격의 형태는 과거 네트워크계층의 대용량 트래픽 공격에서 최근에는 애플리케이션 계층의 소량의 정교한 형태(Slow DDoS Attack)로 변하고 있으며 공격을 위한 공격에이전트 또한 더욱 지능화 되고 정상 PC와 구분이 모호하여 차단이 더욱 어렵게 되고 있다. 정상PC와 지능화된 공격에이전트 구분을 위해 최근 사용되는 사용자인증시스템(CAPTCHA)의 경우 인증과정에서 사용자의 개입이 필요하며, 특히 NAT 환경에서 IP 기반 차단 방법은 정상사용자의 트래픽까지 동시 차단될 수 있다. 본 논문에서는 HTTP 프로토콜에서 사용하는 쿠키를 활용한 일회성 세션 키 기반 인증방법을 적용하여 공격 에이전트와 정상 PC를 구분, HTTP DDoS 공격을 효과적으로 차단하기 위한 방어기법을 제안한다. DDoS attacks have became as a social threat since 2009 7.7 DDoS turmoil. Even though defence techniques have been developing to provide against those threats, they become much more sophisticate. In recent years, the attack form of DDoS is changing from high amount of traffic attack of network layers to highly sophisticate small amount of application layers. To make matters worse, attack agent for the attack has became very intelligent so that it is difficult to be blocked since it can't be distinguished from normal PCs. In the user authentication system(such as CAPTCHA) User intervention is required to distinguish normal PCs and intelligent attack agents and in particular, in a NAT environment, IP-based blocking method can be cut off the normal users traffic at the same time. This research examined defense techniques which are able to distinguish between agent and normal PC and effectively block ways the HTTP DDoS offense applying one-time session key based authentication method using Cookie which is used in HTTP protocol to protect web sever from sophisticate application layer of DDoS.

A Secure and Energy-Efficient Rooting Protocol for WSN

In directed diffusion rooting protocol, interest and exploratory data are disseminated by flooding, which will bring broadcast storm resulting in substantial energy consumption of wireless sensor networks. Grid-based directed diffusion rooting protocol can improve energy efficiency where geographic grids are constructed by self-organization of nodes using location information. Flooding of interest and exploratory data is limited in grid head nodes. But grid-based directed diffusion rooting protocol considers less about security. To adapt to environments with high security requirements, traffic attack detection and secure data aggregation schemes are added to grid-based directed diffusion rooting protocol. Simulation shows that the proposed schemes can real-time predict traffic attacks and improve accuracy of data aggregation results when networks are under attacks. At the same time, the protocol consumes less energy and extends lifetime of networks.

근거리 통신망에서의 DDoS 봇넷 탐지 시스템 구현

단일 공격과 달리 DDoS 공격들은 네트워크에 분산된 봇넷이 동시에 타겟 서버에 공격을 개시한다. 이 경우 타겟 서버에서는 정상적인 사용자의 편의를 고려해야 하기 때문에 DDoS로 간주되는 패킷에 대하여 접속거부 조치를 취하기 어려운 점이 있다. 이를 고려하여 본 논문에서는 사용자 네트워크단위로 DDoS 공격을 탐지하고 네트워크 관리자가 조치를 취할 수 있도록 하여 전체적으로 봇넷의 규모를 줄여서 타겟 서버의 부담을 줄일 수 있는 DDoS 봇넷 탐지 시스템을 구현 하였다. 본 논문에서 제안한 DDoS 봇넷 탐지 시스템은 공격 트래픽의 시간 단위 흐름을 분석하고 수집한 이상상태에 대한 데이터베이스를 바탕으로 공격을 탐지 하도록 프로그램을 구현하였다. 그리고 패킷들의 평균개수와 표준편차를 이용하여 현재 트래픽의 임계치(Threshold)를 계산하고 이 임계치를 이용하여 DDoS 공격 여부를 판단하였다. 공격의 대상이 되는 서버를 중심으로 이루어졌던 봇넷 탐지 단위를 DDoS 봇에 감지된 공격 모듈이 속한 네트워크 단위 탐지로 전환함으로써 DDoS 공격에 대한 적극적인 방어의 개념을 고려해 볼 수 있었다. 따라서 DDoS와 DoS 공격의 차이점이라 할 수 있는 대규모 트래픽 흐름을 사전에 네트워크 관리자가 차단함으로써 봇넷의 규모를 축소시킬 수 있다. 또한, 라우터 장비 이하의 네트워크 통신에서 트래픽 공격을 사전에 차단할 수 있다면 타겟 서버의 부담뿐만 아니라 WAN 통신에서 라우터의 네트워크 부하를 상당부분 감소시킬 수 있는 효과를 얻을 수 있을 것으로 기대한다. Different Different from a single attack, in DDoS Attacks, the botnets that are distributed on network initiate attacks against the target server simultaneously. In such cases, it is difficult to take an action while denying the access of packets that are regarded as DDoS since normal user's convenience should also be considered at the target server. Taking these considerations into account, the DDoS botnet detection system that can reduce the strain on the target server by detecting DDoS attacks on each user network basis, and then lets the network administrator to take actions that reduce overall scale of botnets, has been implemented in this study. The DDoS botnet detection system proposed by this study implemented the program which detects attacks based on the database composed of faults and abnormalities collected through analyzation of hourly attack traffics. The presence of attack was then determined using the threshold of current traffic calculated with the standard deviation and the mean number of packets. By converting botnet-based detection method centering around the servers that become the targets of attacks to the network based detection, it was possible to contemplate aggressive defense concept against DDoS attacks. With such measure, the network administrator can cut large scale traffics of which could be referred as the differences between DDoS and DoS attacks, in advance mitigating the scale of botnets. Furthermore, we expect to have an effect that can considerably reduce the strain imposed on the target servers and the network loads of routers in WAN communications if the traffic attacks can be blocked beforehand in the network communications under the router equipment level.

다중 클래스 SVM을 이용한 트래픽의 이상패턴 검출

본 논문에서는 네트워크 트래픽 데이터를 시각화하고, 시각화된 데이터에 다중 클래스 SVM을 적용함으로써 트래픽의 공격을 자동으로 탐지하는 새로운 방법을 제안한다. 본 논문에서 제안된 방법은 먼저 송신자와 수신자의 IP와 포트 정보를 2차원의 영상으로 시각화한 후, 시각화된 영상으로부터 트래픽의 공격을 의미하는 라인과 명암값이 높은 패턴을 추출한다. 그리고 송신자와 수신자 포트의 분산도 값을 구하고, ISODATA 군집화 알고리즘을 이용하여 군집의 개수와 엔트로피 특징 값을 추출한다. 그런 다음, 위에서 추출한 여러 특징 값들을 다중클래스 SVM(Support Vector Machine)에 적용하여 네트워크 트래픽의 공격이 정상 트래픽, DDoS, DoS, 인터넷 웜, 그리고 포트 스캔인지의 여부를 효과적으로 탐지 및 분류한다. 본 논문의 실험에서는 제안된 다중 클래스 SVM을 활용한 방법이 네트워크 트래픽의 공격을 보다 효과적으로 탐지하고 분류한다는 것을 보여준다. This paper suggests a new method of detecting attacks of network traffic by visualizing original traffic data and applying multi-class SVM (support vector machine). The proposed method first generates 2D images from IP and ports of transmitters and receivers, and extracts linear patterns and high intensity values from the images, representing traffic attacks. It then obtains variance of ports of transmitters and receivers and extracts the number of clusters and entropy features using ISODATA algorithm. Finally, it determines through multi-class SVM if the traffic data contain DDoS, DoS, Internet worm, or port scans. Experimental results show that the suggested multi-class SVM-based algorithm can more effectively detect network traffic attacks.

Dependable wireless sensor networks for reliable and secure humanitarian relief applications

Disasters such as flooding, earthquake, famine and terrorist attacks might occur any time anywhere without prior warnings. In most cases it is difficult to predict when a disaster might occur however, well-planned disaster recovery procedures will reduce the intensity of expected consequences. When a disaster occurs, infrastructure based communications are most likely to be crippled, worsening the critical situation on hand. Wireless ad hoc and sensor network (WASN) technologies are proven to be valuable in coordinating and managing rescue operations during disasters. However, the increasing reliance on WASNs make them attractive to malicious attackers, especially terrorist groups, in a bid to hamper rescue operations amplifying the damage and increasing the number of casualties. Therefore, it is necessary to ensure the fidelity of data traffic through WASN against malicious traffic disruption attacks. In this paper, we first demonstrate how WASN can be used in a well-planned disaster recovery effort. Then, we introduce and analyze one of the most severe traffic disruption attacks against WASNs, called Identity Delegation, and its countermeasures. Its severity lies in its capability to evade detection by even state-of-the-art intrusion detection techniques such as the neighbor monitoring based mechanisms. Through identity delegation, an adversary can drop packets, evade detection, and frame innocent nodes for dropping the traffic. We introduce a technique to mitigate identity delegation attack, dubbed Sadec, and compare it with the state-of-the-art mitigation technique namely Basic Local Monitoring (BLM) under a wide range of network scenarios. Our analysis which is validated by extensive ns-2 simulation scenarios show that BLM fails to efficiently mitigate packet drop through identity delegation attacks while Sadec successfully mitigates them. The results also show that Sadec achieves higher delivery ratios of data packets compared to BLM. On the other hand, the results show similar behavior in framing probabilities between Sadec and BLM. However, the desirable features of Sadec come at the expense of higher false isolation probabilities in networks with heavy traffic load and poor communication links.

CTAC: Control traffic tunneling attacks’ countermeasures in mobile wireless networks

Multihop wireless ad hoc and sensor networks open the door for great networking opportunities especially in scenarios where it is infeasible or expensive to deploy significant networking infrastructure. However, the open communication media and the lack of networking infrastructure make these networks vulnerable to a wide range of security attacks. A particularly devastating attack is the control traffic tunneling attack, where a malicious node records control traffic at one location and tunnels it to a colluding node, possibly far away, which replays it locally. One of the control traffic attacks’ incarnations is the wormhole attack that can be used to prevent route establishment by preventing nodes from discovering legitimate routes that are more than two hops away. These attacks have been addressed by many researchers, however, most of the presented work is either limited to static scenarios, require expensive hardware or suffer from high overhead and performance degradation. In this paper, we present a scalable countermeasure for the control traffic tunneling attack, called CTAC, which alleviates these drawbacks and efficiently mitigates the attack in both static and mobile networks. CTAC uses trusted nodes called cluster heads (CH) for global tracking of node locations and profile keeping. Local monitoring is used to detect and isolate malicious nodes locally. Additionally, when sufficient suspicion builds up at a CH, it enforces a global isolation of the malicious node from the whole network. The performance gain, the relatively low overhead, and the positive impact of CTAC on the data traffic fidelity are brought out through analysis and extensive simulation using ns-2. The results show that CTAC achieves higher detection ratio and faster isolation time while considerably decreases the overhead energy and the end-to-end delay compared to the state-of-the art schemes.

선형패턴과 명암 특징을 이용한 네트워크 트래픽의 이상현상 감지

최근 들어, 네트워크 트래픽 공격에 대한 탐지 기술의 필요성이 꾸준히 증가되고 있는 실정이다. 본 논문에서는 네트워크 트래픽 데이터의 헤더파일에서 송신자의 IP와 포트, 그리고 수신자의 IP와 포트 정보를 2차원의 영상으로 시각화하고 분석하여 이상패턴을 효과적으로 분석하는 새로운 방법을 제안한다. 제안된 방법에서는 먼저 송신자와 수신자의 IP 정보를 받아들여 4개의 2차원 영상을 생성하고, 포트 정보를 받아들여 1개의 2차원 영상을 생성한다. 그런 다음, 각 영상 내의 트래픽 데이터를 분석하여 패턴의 주요 특징을 추출하는데, 트래픽의 공격을 나타내는 선형 패턴과 높은 명암값을 가지는 패턴을 추출하여 트래픽의 유형이 정상 트래픽, DDoS, 그리고 DoS인지를 자동으로 검출한다. 성능을 비교 분석하기 위한 실험에서는 제안된 네트워크 트래픽의 이상현상 검출 방법이 기존의 방법에 비해서 보다 우수하다는 것을 보여준다. Recently, the necessity for good techniques of detecting network traffic attack has increased. In this paper, we suggest a new method of detecting abnormal patterns of network traffic data by visualizing their IP and port information into two dimensional images. The proposed approach first generates four 2D images from IP data of transmitters and receivers, and makes one 2D image from port data. Analyzing those images, it then extracts their major features such as linear patterns or high intensity values, and determines if traffic data contain DDoS or DoS Attacks. To comparatively evaluate the performance of the proposed algorithm, we show that our abnormal pattern detection method outperforms the existing algorithm in terms of accuracy and speed.

통합 보안 시스템에서의 효율적인 보안 정책 관리 모델

본 논문에서는 기존의 단일 보안 시스템의 Firewall과 IPS 시스템의 문제점 분석을 통하여 통합보안 시스템 강화가 비용 대비 효율적임을 나타내었다. 문제점 분석 결과 Firewall과 IPS 의 처리 시간 지연과 효율성 부재를 나타냈다. 따라서 개별 Firewall과 IPS 시스템과 통합 시스템으로 성능 평가를 하였다. 평가 결과 기존 시스템 보다 제안한 통합보안시스템이 응답 처리 시간에서는 평균 5배 이상 성능을 나타났고, 초당 세션 처리에서도 5배 이상 그리고 CPU 처리 성능에서는 6배의 처리 속도가 우수함을 나타냈다. 또한 여러 보안 정책들을 수용하였고, 유해 트랙픽 처리에서도 높은 성능을 나타났다. 결론적으로 본 논문에서는 통합 보안 시스템이 개별 시스템 강화 보다 경제적 측면, 관리적 측면, 물리적 측면, 시간적 측면, 공간적 측면 등 여러 측면에서 효율적임을 강조하였다. This paper showed that the integrated system to fortify security was much more efficient than the respective system through the analysis of problems from Firewall and IPS system in the existing security systems. The results of problem analysis revealed that there were the delay of processing time and lack of efficiency in the existing security systems. Accordingly, their performance was evaluated by using the separated Firewall, IPS system, and the integrated system. The result of evaluation shows that the integrated security system this paper suggested is five times faster than the existing one in terms of processing speed of response. This paper demonstrated the excellence of the proposed security system is also more than fivefold in session handling per second and six times process speeding in the CPU processing performance. In addition, several security policies are applied, and it provided a fact that it gave an excellent performance when it comes to protecting from harmful traffic attacks. In conclusion, this paper emphasized that fortifying the integrated security system was more efficient than fortifying the existing one considering in various respects such as cost, management, time, space and so on.