TTL Value Research Articles

Malicious domain detection based on semi‐supervised learning and parameter optimization

AbstractMalicious domains provide malware with covert communication channels which poses a severe threat to cybersecurity. Despite the continuous progress in detecting malicious domains with various machine learning algorithms, maintaining up‐to‐date various samples with fine‐labeled data for training is difficult. To handle these issues and improve the detection accuracy, a novel malicious domain detection method named MDND‐SS‐PO is proposed that combines semi‐supervised learning and parameter optimization. The contributions of the study are as follows. First, the method extracts the statistical features of the IP address, TTL value, the NXDomain record, and the domain name query characteristics to discriminate Domain‐Flux and Fast‐Flux domain names simultaneously. Second, an improved DBSCAN based on the neighborhood division is designed to cluster labeled data and unlabeled data with low time consumption. Then, based on the clustering hypothesis, unlabeled data is tagged with pseudo‐label according to the cluster results, which aims to train a supervised classifier effectively. Finally, Gaussian process regression is used to optimize parameter settings of the algorithm. And the Silhouette index and F1 score are introduced to evaluate the optimization results. Experimental results show that the proposed method achieved a precise detection performance of 0.885 when the ratio of labeled data is 5%.

OSNA Total Tumor Load for the Prediction of Axillary Involvement in Breast Cancer Patients: Should We use Different Thresholds According to the Intrinsic Molecular Subtype? MOTTO Study.

To assess the impact of the molecular subtype (MS) on the total number of CK19 mRNA copies in all positive SLN (TTL) threshold, to predict non-SLN affectation, and to compare 5 years progression-free survival (PFS) according to the risk of recurrence (ROR) group by PAM50. Cohort with infiltrating breast cancer with intra-operative metastatic SLN detected by one-step nucleic acid amplification (OSNA) assay who underwent subsequent ALND. Logistic regression was used to assess a possible interaction between TTL and MS(Triple Negative, Her-2-Enriched, Luminal A, or Luminal B), or hormone receptors (HR: positive or negative) by immunohistochemistry (IMH). Cox regression was used to compare PFS and OS in the 3 ROR groups (high, medium, or low). TTL was predictive of non-SLN affectation in both univariate (OR [95% CI]: 1.72 [1.43, 2.05], P < .001) and multivariate (1.55 [95% CI: 1.04, 2.32], P = .030) models, but MS-IMH or HR-IMH, and their interactions with TTL were not (best multivariate model: HR + main effect OR 1.16 [95% CI: 0.18, 7.64], P = .874; interaction OR: 1.04 [0.7, 1.55], P = .835; univariate model: HR + main effect OR: 1.44 [95% CI: 0.85, 2.44], P = .180). PFS was lower in the high-risk ROR group (81.1%) than in the low-risk group (93.9%) (HR: 3.68 [95 CI: 1.70, 7.94], P < .001). our results do not provide evidence to support the utilization of subtype-specific thresholds for TTL values to make therapeutic decisions on the axilla. The ROR group was predictive of 5 years-PFS.

Detecting Network Scanning Through Monitoring and Manipulation of DNS Traffic

In this paper, we propose an approach for detecting internal and external network scanning attacks on enterprise networks. In our approach, an inline scan detection system (SDS) monitors the ingress and egress flows of an enterprise network subnet and detects scanning probes based on the correlation of flows with preceding DNS query/responses and reducing TTL values of DNS Resource Records (RR). Through rigorous evaluation, we show that our method is effective against both external and internal port scanners and network worms, its effectiveness is independent of scanning rate or technique, and its deployment incurs negligible overhead on DNS and network response times. While the idea of detecting scans by correlating network flows with preceding DNS query/responses has been proposed in the literature, this work extends the state-of-the-art by offering four contributions: 1) we show that without decreasing TTL values of RRs in DNS responses, attackers can piggyback on cached DNS records to bypass our detection; thus we incorporate a TTL reduction mechanism to enhance the effectiveness of this approach, especially against stealthy and adaptive scanners; 2) while prior works work against internal scanners, we use the relatively new extension of DNS protocol, ENDS0 Client Subnet (ECS) option, to expand this approach toward detecting external scanners; 3) we present a novel adaptive scanning technique, called DNS-cache-based scanning, that exploits local DNS cache to bypass prior detection methods, and shows that, while prior approaches fail to defeat this threat model, our approach is effective against this evolved threat model as well; and 4) contrary to existing work that focuses on defeating fast network scanning worms, this approach is effective against any scanning, including stealthy scanning that uses conservative timing profiles to evade detection.

Differences in Body Balance According to Body Mass Classification among Brazilian Jiu-Jitsu Athletes.

Background: Body weight is an important aspect in the development of components of physical fitness that can affect athletic performance. The purpose of this study was to examine the differences in body balance of Brazilian Jiu-Jitsu (BJJ) athletes according to body mass classification: underweight/normal weight (UW/NW); overweight/obese (OW/OB). Material and Methods: The study was conducted among 69 BJJ athletes (age 23.26 ± 3.53) and 93 non-practicing adults (age 21.73 ± 2.32). This study was based on a quantitative assessment of body balance on the Zebris PDM platform during two tests, i.e., with eyes open and closed. Results: The total path of the center of pressure (COP TTL) was significantly higher in participants with UW/NW compared to those with OW/OB, both in participants from the study group and control group (p < 0.001). COP TTL was significantly lower in UW/NW BJJ athletes than in participants in the control group with the same BMI category (987.4 mm vs. 1238.5 mm and 1080.59 mm vs. 1280.70 mm, respectively) (p < 0.001). Conclusions. BJJ training is associated with a better balance in terms of COP TTL in the case of people with normal or underweight. The presence of excess body weight has a positive effect on lower COP TTL values in both practicing and non-practicing people.

In-Memory Caching for Enhancing Subgraph Accessibility

Graphs have been utilized in various fields because of the development of social media and mobile devices. Various studies have also been conducted on caching techniques to reduce input and output costs when processing a large amount of graph data. In this paper, we propose a two-level caching scheme that considers the past usage pattern of subgraphs and graph connectivity, which are features of graph topology. The proposed caching is divided into a used cache and a prefetched cache to manage previously used subgraphs and subgraphs that will be used in the future. When the memory is full, a strategy that replaces a subgraph inside the memory with a new subgraph is needed. Subgraphs in the used cache are managed by a time-to-live (TTL) value, and subgraphs with a low TTL value are targeted for replacement. Subgraphs in the prefetched cache are managed by the queue structure. Thus, first-in subgraphs are targeted for replacement as a priority. When a cache hit occurs in the prefetched cache, the subgraphs are migrated and managed in the used cache. As a result of the performance evaluation, the proposed scheme takes into account subgraph usage patterns and graph connectivity, thus improving cache hit rates and data access speeds compared to conventional techniques. The proposed scheme can quickly process and analyze large graph queries in a computing environment with small memory. The proposed scheme can be used to speed up in-memory-based processing in applications where relationships between objects are complex, such as the Internet of Things and social networks.

External validation of a prognostic model based on total tumor load of sentinel lymph node for early breast cancer patients

BackgroundA prognostic model based on the results of molecular analysis of sentinel lymph nodes (SLN) is needed to replace the information that staging the entire axilla provided. The aim of the study is to conduct an external validation of a previously developed model for the prediction of 5-year DFS in a group of breast cancer patients that had undergone SLN biopsy assessed by the One Step Nucleic Acid Amplification (OSNA) method.MethodsWe collected retrospective data of 889 patients with breast cancer, who had not received systemic treatment before surgery, and who underwent SLN biopsy and evaluation of all SLN by OSNA. The discrimination ability of the model was assessed by the area under the ROC curve (AUC ROC), and its calibration by comparing 5-years DFS Kaplan–Meier estimates in quartile groups of model predicted probabilities (MPP).ResultsThe AUC ROC ranged from 0.78 (at 2 years) to 0.73 (at 5 years) in the training set, and from 0.78 to 0.71, respectively, in the validation set. The MPP allowed to distinguish four groups of patients with heterogeneous DFS (log-rank test p < 0.0001). In the highest risk group, the HR were 6.04 [95% CI 2.70, 13.48] in the training set and 4.79 [2.310, 9.93] in the validation set.ConclusionsThe model for the prediction of 5-year DFS was successfully validated using the most stringent form of validation, in centers different from those involved in the development of the model. The external validation of the model confirms its utility for the prediction of 5-year DFS and the usefulness of the TTL value as a prognostic variable.

Design of TTL Based Routing Algorithm on UTAR Network on Chip Communication Architecture

XY adaptive routing protocol is a routing protocol used on UTAR NoC communication architecture. This routing algorithm adapts shrotest-path first algorithm, which will forward will not be able to work optimally if the closest route no longer have enough bandwidth to continue the packet. Packet will be stored inside the router and forwarded to the nearest router when closest route has enough bandwidth. This paper suggest TTL based routing algorithm to resolve this issue. TTL based routing algorithm adapts XY adaptive routing protocol by adding several parameters on RTL UTAR NoC and additional bit in each packet sent by router. This additional bit and parameter will be used by TTL based algorithm as additional factors in choosing alternative routes inside the communication architecture. Use of TTL on TTL based routing different from use of TTL on communication network. Packets that carry TTL value that equal to Maximum TTL will be route using XY adaptive routing protocol. TTL based routing algorithm has shown better performance compared to XY adaptive routing on some of the experiment done using MSCL NoC Traffic Pattern Suite. This research also proves that TTL based routing algorithm cannot work optimally on small-scaled architecture.

Design adaptive Subnetting Hybrid Gateway MANET Protocol on the basis of Dynamic TTL value adjustment

Mobile ad hoc Network is infrastructure less wireless network and decentralized way, and then for a large network number of nodes dynamically therefor the connection established between source node to destination node is really challenging. The challenge is interconnecting ad hoc network to the internet seems from the needs to inform ad hoc nodes about available gateways in an extremely challenging scenario while a making a minimum consumption of the source network resources. Then an efficient gateway discovery of an ad hoc network becomes one of the central factors to enable the economic consumption of hybrid ad hoc network in future mobile and wireless network. In mobile ad hoc network have multihop nature of MANET therefore several reachable gateways for mobile node at any period of time. If the mobile node receives gatways advertisement from more than one gateway. It has to determine which gateway to use for connecting to the net. Most existing protocol choose the gateway which is closer in terms of the number of physical hops. This paper has focused on design an efficient and adaptive subnetting hybrid gateway discovery mechanism on the basis of dynamic TTL value adjustment such that congestion and unnecessary overhead is reduced. Selecting the gateway on the basis of one and two parameters will increase the performance and throughput of the network. The main objective of adaptive gateway discovery to determine the optimal TTL value in terms of number of hops to determine the proactive area, nodes outside this area follow the reactive approach. Consequently, for achieving a good trade off between performanceand network operating expense.

An event based technique for detecting spoofed IP packets

Distributed Denial of Service (DDoS) attacks are one of the prominent network security attacks. In DDoS attack several machines send large amount of network traffic to the victim using spoofed IP address. Unfortunately there is no reliable technique to detect spoofed IP packets. In this paper we argue that, a proactive detection of spoofed IP packets will help in predicting DDoS attacks. In this paper we describe an event based detection method to identify spoofed IP packets. Our method works by proactively probing received packets for genuineness. Active probing technique uses inconsistencies in TTL values of received packets to decide whether the first packet was spoofed or genuine. We enumerate several possible spoofing scenarios with our detection method in place and identify its type based on the response to probing. Further, we study limitations of event based method and discuss ways to overcome those. We design and experiment with all spoofing scenarios in a real network setup and report the results. With few optimizations done to the probing strategy, the overhead incurred can be minimized considerably, which makes the proposed technique useful for detecting DDoS attacks.

Flow Based Approximation Technique to Restrict Client Side Scripts from Phishing Attacks for Enhanced Internet Security using Fuzzy Rule Sets

The most commercial activities are performed online through internet and highly depend on the internet services. The internet threats grow because of internet technology usage in many fields. There exists huge number of internet attacks and these attacks phish the information and perform various malicious activities to degrade the service provided. Most financial organizations accept user sensitive information like security codes and passwords through online and send them through a secure channel. But still these informations are stealed by malicious user to perform various attacks. The user does not know about the background process and they simply submit their details and wait for the result. The organizations have the responsibility to protect the user valuable information from malicious nodes or programs. There are many security measures present right now but lags with the classification accuracy and struggles with false positive results. To overcome all this, we propose a new approach which works based on the flow of packets and identify the malicious nodes and their packets to restrict the client side scripts. The proposed approach monitors the foreground and background processes which access the network interface. While a new process which accesses the gateway will be monitored and will be checked to find out the malicious packets. Every time a packet received, a log generated and it is called web log or traffic using which later processes will be done. The packet feature is extracted and generate log accordingly. The generated log is used to compute the flow approximation. The flow approximation which identifies distinct processes and their parent id, computes set of rules which specify the process id and process group id, process name, packet flow rate, memory, bandwidth, hop count and ttl values. Based on the log generated, the fuzzy rules are generated to perform flow approximation. The proposed approach has produced efficient results compared to existing works and has increased ratio of attack detection and reduces the time complexity.

ENHANCEMENT IN REVISITING DYNAMIC QUERY PROTOCOL IN UNSTRUCTURED PEER-TO-PEER NETWORK

The Peer to peer architecture run over internet are widely used in unstructured topology. Random walk based and control flooding resource query algorithms are widely used in peer to peer network. In this paper we consider searching of file in ad hoc network. We propose Enhanced Selective Dynamic Query algorithm. The main aim of this algorithm is to minimize traffic cost and response latency for resource query response. When user want to search a query first history table is referred. If query is present in history table next searching is not required otherwise optimal combination of integer TTL value and set of neighbor for next query round is calculated in network by using knapsack for next query. This algorithm tries to achieve best tradeoff between traffic cost and response latency.

Scheduling and Dropping Policies in Delay Tolerant Network

Sometimes end to end connectivity may not exist between the nodes, sometimes it is too expensive to connect all the networks and sometimes due to some catastrophic effect, exchanging of messaging are difficult, so it can cause delays from hours to days, hence networking of this type of situation is called as Delay Tolerant Network. As no end to end connectivity between the nodes so it require buffer at each node to store incoming messages. The network uses a store-carry-forward mechanism, while sending a message from one node to another node. Messages which are stored at each node carry along with him until it reaches to the next node and then forward. Here two scheduling policies are named as PRIORITY+ algorithm and FACTOR algorithm. PRIORITY+ algorithm considers a priority of message with different routing algorithm. FACTOR algorithm considers the TTL value with priority of that particular message. Algorithms can achieve better delivery ratios with less overhead and latency ratio.

A Topology Adjustment Algorithm for P2P Systems

In order to improve the Peer-to-Peer (P2P) network resource locating efficiency and isolate malicious peers, a topology adjustment algorithm for unstructured P2P networks is proposed. TTL (time-to-live) value for each neighbor has been set up and adjusted; specific information on the query path is recorded; a topology adjustment algorithm is given. The topology adjustment algorithm is evaluated by peer shortest path, simulation and analysis show that the topology adjustment algorithm can isolate malicious peers to the network edge, and improve service quality of P2P networks.

GBC-TD: Gateway Based Congestion and Traffic Distribution Model for Load Sharing in WMN

Effective communication can be categorized by its approaches used to handles the uncertainties and especially in wireless medium. Wireless mesh network is one of the ad-hoc networks having huge applicability with variety of protocols supporting different routing situations. Load balancing over the gateway is one of the key issues related to optimal routing in WMN. In case of multiple networks inter communication; WMN suffers from the gateway selection problem and its load distribution commonly taken as NP-Hard complexity. Mainly these gateway nodes are having the maximum traffic flows due to their central locations and bridge functionality, also the traffic distribution is uneven at those gateways. This paper proposes a novel GBC-TD (Gateway Based Congestion and Traffic Distribution) model from overcoming the above issues of gateway selection problem by using a load balancer through relaying information, TTL values and flag bits status. The approach is capable of distributing the load over the network. At the primary level of work the approach is proving its efficiency and will shows its strong presence in near future. Index Terms: WMN (Wireless Mesh Network), Routing, Load Balancing Gateway Selection, Congestion, Traffic Divergence, GBC-TD (Gateway Based Congestion and Traffic Distribution); I. INTRODUCTION Wireless medium is gaining popularity these days due to their wide applicability in several areas such as: healthcare, transportation, military, telecommunication etc. Wireless mesh network is a ad-hoc network consists of mesh routers and clients. Here each node will acts as a router as well as client. The transmission is of supportive communication in which the nodes transfer the packets with the help of some other node in the range of source to destination. Since the deployment effort required with WMN is very less thus taken as most effective means for establishing the communication is disaster affected areas. Thus in such cases where the number of routers or intermediately nodes are less the traffic flow form them is very high causes congestion at their gateways. Hence a new mechanism has to be designed for resolving those load balancing issues of underutilized and over-utilized mesh nodes. Distribution of traffic from those nodes can be made after analysis of traffic patterns which might be affected by different parameters such as: mesh router location, channel assignment, scheduling and transmissions etc. In most of the cases of static networks the topology is fixed so as the gateway selection and connections diverts the network performance factors. Largely there are some problems which continuously affects such situations and includes the problems of congestion, load balancing, gateway selection, and flow and topology control. Consider wireless mesh network having routers and a base station, which is directly connected to external network by some gateway node. Now the in above situation the node transmitting the maximum number of packets between two different networks is taken as a gateway node. Here the base station is located at some central position after gateway selection is performed from the existing mesh nodes with larger relaying data. These selected gateways are collaborated by a common communication channel between them. In this the managing node is termed as a base station and is located at the centre of the wireless mesh network. This station chooses a certain number of wireless mesh routers as sink or gateways, and creates connections among them. The purpose of this work is to effortlessly and promptly discover the candidate gateways that maximize the system throughput with solvable optimization issues. It also includes number of evaluating parameters and involves intense computation load values. The performance of the proposed scheme is evaluated by numerical analysis, and demonstrated through computer simulations. In future the results show that our proposed scheme can determine the appropriate candidate gateway with high accuracy when there is a certain variance in the amount of traffic generated by users at each wireless mesh router. II. BACKGROUND Ad-hoc network provides wide area of applicability and range of communication options for several technologies to ease the networking usages. These technologies still suffers from many issues and challenges to make this communication more effective, performance oriented and secure. Among them routing is considered to be a major task required for such improvements. Routing involves source to destination communication via

CTV: Consistent Trust Value through Data Drop Monitoring Parameters Based Malicious Behaviour Detection in MANET

Growth of wireless technologies with its increased user demands of applications makes this area more vulnerable for attackers and intruders. The attacker continuously trying to affects the communication and getting the benefits from gamming the network with higher data drop rates. Among them, the most famous and dangerous attacks is blackhole by which a node starts dropping a data and behaving as a normal node. During the last few years various solutions are provided for overcoming the active and passive blackhole detection and termed as malicious node detections. Any node, affecting the actual performance or operation of network will be termed as malicious node and blackhole is its one category. The existing mechanism only detects the static blackhole attacks but is not capable to detect sudden change in the behavior of node from legitimate to malicious. Thus this paper proposes a CTV (Consistent Trust Value) mechanism based on some of the performance parameter analysis such as PDR, throughput, delays and TTL values by which timely triggered and normal blackhole node is detected with higher accuracy. By regular analysis those improper behaviour is detected in timely manner and reduces the probability of data drops. At the initial level of evaluation the approach is proving its strong presence among the existing methods. Index Terms: MANET (Mobile Ad-Hoc Network), AODV, Routing, Attacks, Timely Triggered Blackhole, CTV (Consistent Trust Value), Reliable Path;

Client Based System on Wireless Sensor Network for Efficient Packet Transmission

Wireless sensor networks are vulnerable to the node distributor dividend, and several distributed protocols has been transfer the data in secure .Where MD5 algorithm that implements adaptive TTL, piggybacking, and perfecting, and provides near strong consistency guarantees. Cached data items are assigned adaptive TTL values that correspond to their update rates at the data source. Expired items as well as non expired ones but meet certain criteria are grouped in validation requests to the data source, which in turn sends the cache devices the actual items that have changed, or invalidates them, based on their request rates. In DHTbased protocol can detect node distributor dividend with high security level to transfer the data. Protocol of this type initial nodes send claiming messages containing a neighbor-list along with a maximum hop limit to randomly selected neighbors then, the subsequent message transmission is regulated by a probabilistic directed technique to approximately maintain a line property through the network as well as to incur sufficient randomness for better performance on communication.

Using abnormal TTL values to detect malicious IP packets

In general, an IP packet passes through less than 30 routers before it reaches a destination host. According to our observations, some IP packets have an abnormal time-to-live (TTL) value that is decreased by more than 30 increments from the initial TTL. These packets are likely to be generated by special software. We assume that IP packets with strange TTL values are malicious. This study investigates this conjecture through several experiments, and the results show that malicious packets can be discriminated from legitimate ones by observing only TTL values.

Improvement of QoS Contained by AODV Routing Protocol On the Basis of Varying Queue Length and Dynamic TTL Value in MANET

A Mobile ad-hoc network (MANET) is a network, self-configuring, proficient of self-directed functioning, quickly deployable and operates without infrastructure. MANET operates without any centralized administration. The nodes are self configuring, independent, quickly deployable. Nodes are movable since topology is dynamic and they have restricted computing resources. We know that routing protocols make an important role for improving Quality of Service (QoS) in Mobile Ad hoc Network. The reactive AODV routing faces problems like long route, time delay, mobility and many other while routing. In this work the quality of AODV routing protocol has been improved to enhance the routing capability. In this paper the performance of normal AODV routing protocol are improves on the basis of QoS. Here we consider the particular TTL Value and dynamic threshold value for established the connection in long route and also measure the varying queue length technique by that if the node buffer size is full then no packet is drop form queue, it means the size of queue is varying according to data. The dynamic TTL value established the connection with long route receiver and the varying queue minimizes the packet loss. The quality of Routing protocols should integrate QoS metrics in route finding and maintenance, to support end-to-end QoS. The performance of improves AODV protocol is measures on the basis of performance metrics.

An adaptive probabilistic marking scheme for fast and secure traceback

IP traceback can be used to find direct generator(s) and path(s) of attacking traffic. Probabilistic marking schemes, as one type of IP traceback technologies, have been most studied, but they are difficult to fast reconstruct attacking path(s) and defend against spoofed marks generated by attacking source(s). In this paper, we present Adaptive Probabilistic Marking scheme (APM). In APM, when each packet enters the first-hop router, its TTL value is set to a uniform value, and when it is forwarded by routers in the network, each intermediate router decreases the TTL value by one. Consequently, each intermediate router may infer the router-level hop number that each packet has already traveled, and then correspondingly marks the packet with the probability inversely proportional to the router-level hop number. APM is focused on the probability with which a router marks a packet, and APM can cooperate with other probabilistic marking schemes. NS2 simulation experiments prove that, in APM, the time for the victim to receive necessary marks for the path reconstruction is reduced by more than 20% compared with existing probabilistic marking schemes, and spoofed marks cannot reach the victim and influence the traceback process.

P2P 스트리밍 시스템을 위한 TTL 기반 피어 그룹핑 기법

본 논문에서는 P2P 기반의 IPTV 시스템에서 TTL을 이용해서 지역성을 반영하는 피어 그룹핑 기법을 제안한다. 이 기법은 두 피어 사이의 경유 라우터 수를 최소화하도록 이웃 피어를 선정하여 중간 라우터들이 전송해야 하는 데이터 양이 감소한 만큼 네트워크 대역폭을 절약할 수 있다. 또한 본 논문에서 제안하는 TTL 기반의 피어 그룹핑 기법이 기존의 RTT 기반의 기법에 비해 성능이 향상되는 것을 보이기 위해 다양한 시뮬레이션 시험을 수행하였다. 실험 결과는 본 논문에서 제안하는 TTL 기반의 피어 그룹핑 기법이 전체 라우터들이 전송하는 데이터 및 제어패킷 용량뿐만 아니라 지터 비율도 감소시킬 수 있다는 것을 보인다. In this paper, we propose a new peer grouping scheme to consider locality among peers using TTL values in P2P-based IPTV systems. This scheme can select neighbor peers to minimize the number of intermediate routers between each pair of peers. Thus, it can save the network bandwidth as much as the amount of data that the reduced number of routers should transmit In addition, we have conducted various simulation experiments to show that our proposed TTL-based peer grouping scheme can outperform the conventional RTT-based grouping scheme. The experimental results show that our proposed scheme can reduce the jitter ratio as well as the number of data and control packets that all routers should transmit.