Unknown Protocol Research Articles

The Effect of Ethambutol Therapy in terms of Visual Evoked Potential, Color Vision Test, and Contrast Sensitivity Test at the Subclinical Level

Abstract
 Introduction & Objectives : Ethambutol is one of the first-line drugs in the treatment of tuberculosis and known to induce optic neuropathy. However, there are unknown protocols for detecting subclinical level of toxicity. The aim of this study was to assess the difference in amplitude and latency of visual evoked potential (VEP), color vision, and contrast sensitivity in tuberculosis patients before and after taking ethambutol for 1 and 2 months.
 Methods : This was a prospective observational cohort study of 38 eyes of 19 newly diagnosed patients with category-1 tuberculosis being treated with ethambutol. All patients were given ethambutol for 2 months at a dose of 15 - 20 mg/kg body weight/day. The participants underwent complete eye and visual function examination including pattern-reversal VEP, color vision with Farnsworth Munsell D-15 test, and contrast sensitivity with LEA Low Contrast Flip Chart before and after 1 and 2 months of treatment. Wilcoxon test was employed for data analysis.
 Results : During the study, no changes in visual acuity was observed. The results showed that the latencies of VEP after 1 month (p = 0.000) and 2 months (p = 0.000) of treatment were significantly delayed. There was a significant difference in contrast sensitivity after 2 months (p = 0.014) of treatment. However, no significant difference was found in color vision and amplitude of VEP.
 Conclusion : Latency of VEP and contrast sensitivity test could prove useful in detecting subclinical and hence very useful for monitoring patients under ethambutol therapy for ocular toxicity.

Supervision and early warning of abnormal data in Internet of Things based on unsupervised attention learning

With the continuous development of artificial intelligence and big data, more and more communication protocols have appeared in the network connection. Because the network protocol content specification should not need to obtain the content of the common protocol by any means, it faces different attacks, which increases the complexity of network security detection to an unlimited extent. The absolute security analysis of the content of the relevant data protocol is not too limited. Based on the content of the unknown binary number protocol in the Internet of Things, this paper does the reverse research. To address the inefficiency, learning is focused on the inverse aspect of the content processing logic of the protocol for unsupervised execution attention. This paper proposes a method based on the name of the Dirichlet process mixture model normal field and the unknown protocol of the Internet of Things. It also establishes the behavioral criteria that process the logical inference least squares method to infer the content of the target protocol. Based on the original external characteristics of abnormal data in the Internet of Things, the neural network model of attention mechanism and the model checking of variational self-encoder are chosen. An innovative multi-dimensional spatial neural network model with a centralized control mechanism is taken to extract the spatial relevant information from the original external features, which are regarded as the intermediate external features. The intermediate extrinsic features are input to a variational self-encoder for computation and reconstruction. The experimental results verify that the time required by the proposed model is 45% less than that of the traditional structure. The flow processing improves by 36.7% compared with the optimization of the parameter control function. The specific method only relies on the original external characteristics of the Internet of Things traffic and can achieve better data anomaly detection and classification under the condition of not significantly improving the detection time. The abnormal data detection scheme of the Internet of Things designed in this paper not only fills the detection gap of the current mainstream Internet of Things system which lacks an autonomous supervision mechanism, but also effectively blocks external network intrusion and further improves the management authority verification system. It plays an indispensable role in the long-term stable operation of the Internet of Things platform.

Retracted: A Novel Distributed Denial of Service (DDoS) Detection Method in Software Defined Networks

The software Defined Networks (SDN) are the most promising solutions in solving challenges regarding complex network control. The SDNs are responsible for separating network control functions from the network switch. By applying SDNs, communication companies and operators can control and manage networks through one central controller unit therein with no need by applying hardware or the manufacture's guideline. Lack of complex DDoS attack detection, lack of rapid detection sensitivity on packet type attack, lack of methods in promoting detection attack to specific unknown protocols, lack of ability in detecting at switch level, lack of assessing attacks packet types, constitute drawbacks. Although is made in this article to overcome these drawbacks, consequently the GainRatioAttributeEval algorithm and Ranker method are applied. The datasets involved here are the ISCX-SlowDDoS2016, ISCX-IDS2012, CTU-10 and CTU-11.This proposed method is compared with similar methods and it is found that this method with 99.95% accuracy and 0.04 FPR for UNB-ISCX dataset and 99.84% accuracy and 0.1 FPR for CTU-13 dataset is better than others.

Packet Chunking for File Detection

Network-based intrusion detection and data leakage prevention systems inspect packets to detect if critical files such as malware or confidential documents are transferred. However, this kind of detection requires heavy computing resources in reassembling packets and only well-known protocols can be interpreted. Besides, finding similar files from a storage requires pairwise comparisons. In this paper, we present a new network-based file identification scheme that inspects packets independently without reassembly and finds similar files through inverted indexing instead of pairwise comparison. We use a content-based chunking algorithm to consistently divide both files and packets into multiple byte sequences, called chunks. If a packet is a part of a file, they would have common chunks. The challenging problem is that packet chunking and inverted-index search should be fast and scalable enough for packet processing. The file identification should be accurate although many chunks are noises. In this paper, we use a small Bloom filter and a two-level threshold strategy to solve the problems. To the best of our knowledge, this is the first scheme that identifies a specific critical file from a packet over unknown protocols. Experimental results show that the proposed scheme can successfully identify a critical file from a packet without packet reassembly.

A Sparse Protocol Parsing Method for IIoT Based on BPSO-vote-HMM Hybrid Model

With the development of the Industrial Internet of Things, industrial control systems have become more open and intelligent. However, large numbers of unknown protocols exist in IIoT, threatening the security of IIoT devices and systems. Protocol reverse engineering extracts the grammar and semantics of the protocol by monitoring and analyzing the traffic trace or the execution process of instructions, without the need for protocol description. As the executable programs are mainly integrated into the IIoT devices and the communication traffic is relatively sparse, the traditional protocol analyzing method is not suitable for the IIoT environment. This paper proposes an improved sparse protocol parsing method of IIoT protocol based on the BPSO-vote-HMM hybrid model. The binary particle swarm optimization algorithm is introduced to expand the captured IIoT protocol message sequence, solving the problems of sparse samples in IIoT and the low efficiency of the GA-based data expansion model. Besides, we improve on the parameter training part to improve the efficiency and get better model parameters by dividing the training set into several sub-sets, conducting the parameter update parallel, and inputting the results into a voter to generate the final parameter of HMM, which is used in protocol field prediction. Finally, by combining the BPSO-based data expansion model and the protocol field parsing model based on vote-HMM, a hybrid analytical model is constructed to improve the analytical accuracy in a gradual evolutionary manner. Through a series of comparative experiments, the improved protocol field parsing model has better performance on IIoT protocol.

Anomaly Detection Method for Unknown Protocols in a Power Plant ICS Network with Decision Tree

This study aimed to enhance the stability and security of power plant control network systems by developing detectable models using artificial intelligence machine learning techniques. Due to the closed system operation policy of facility manufacturers, it is challenging to detect and respond to security threats using standard security systems. With the increasing digitization of control systems, the risk of external malware penetration is also on the rise. To address this, machine learning techniques were applied to extract patterns from network traffic data produced at an average of 6.5 TB per month, and fingerprinting was used to detect unregistered terminals accessing the control network. By setting a threshold between transmission amounts and attempts using one month of data, an anomaly judgment model was learned to define patterns of data communication between the origin and destination. The hypothesis was tested using machine learning techniques if a new pattern occurred and no traffic occurred. The study confirmed that this method can be applied to not only plant control systems but also closed-structured control networks, where availability is critical, and other industries that use large amounts of traffic data. Experimental results showed that the proposed model outperformed existing models in terms of detection efficiency and processing time.

Allylsulfones through Palladium‐Catalyzed Allylic C−H Sulfonylation of Terminal Alkenes

AbstractTwo previously unknown protocols for Pd‐catalyzed allylic C−H sulfonylation of terminal alkenes have been developed. While the former consists of a direct Pd(II)‐catalyzed oxidative C−H allylic sulfonylation in the presence of sulfinate anions, the latter involves a sequential one‐pot Pd(II)‐catalyzed C−H allylic acetoxylation followed by a Pd(0)‐catalyzed sulfonylation. The scope of both protocols was studied on 25 examples.

Unknown Binary Protocol Recognition Algorithm Based on One Class of Classification and One‐Dimensional CNN

In order to solve the problem that there are a large number of unknown protocols on the network, which affect the network management and network security in varying degrees, an unknown binary protocol identification method is proposed. On the premise that the center cluster of unknown protocols is obtained by the clustering algorithm, the unknown protocols for network traffic are identified by combining one‐class of classification with one‐dimensional CNN classification technology. At first, a class of classification algorithm is used to select the unknown protocols, and then, the labeled protocol data obtained by clustering are used to train the one‐dimensional CNN model, and the classified binary protocol packets are directly used as the input of the one‐dimensional convolution neural network. After the classification of the CNN model, the unknown protocols are finally identified. The experimental results show that the proposed classification and recognition method is better than the traditional CNN and SVM algorithms, and the maximum frequency pooling is better than the traditional pooling method.

Changing of Health Anxiety in Disadvantaged Population During the Pandemic

Abstract We have lived our lives in the spirit of the COVID-19 pandemic in the latest period, which demanded serious sacrifices in Hungary as well. By the spread of the epidemic, more and more and younger people fought with the disease, several people worried about their relatives’ and friends’ health. The period of the pandemic and the central provisions aiming at stopping the spread of the epidemic affected people in several different ways, but it has no doubt that confinement, restrictions and the lack of interactions had mental effects on everyone. Over the fear from becoming infected, the reorganization of the healthcare system also influenced people’s mental status, and increased their anxiety and health anxiety, since the care of pre-existing chronic diseases and the diagnostics and therapy of new acute diseases were performed based on a new unknown protocol. Our research examined the population’s health anxiety in a highly disadvantaged region of Hungary along more dimensions in the second and third wave of the pandemic. Our research goal was to get to know the level of health anxiety according to different settlement types, genders, ages and occupations, and to compare its change with the measured data of the option and willingness for vaccination. Our special goal was the assessment of the healthcare workers’ mental status and monitoring of its changes. For the on-line survey research, we used standard questionnaires also validated in Hungarian language: the Short Health Anxiety Inventory - Hungarian version (SHAI-H) (Köteles at al, 2011), the 5-item WHO Well-being Index (Susánszky et al, 2006) and the Adult Hope Scale - Hungarian version (AHS-H) (Martos et al, 2014). During data recording, we queried labour market status, relationship status and the size of the residential settlement besides the socio-demographic data (gender, age, education). There was one question about the respondent’s evaluation regarding his/her own health status and another about religiousness. There were further questions about COVID-19 infection or its suspicion in terms of the person’s own and immediate environment, the severity of the perceived symptoms and the form of the necessary health care. Data recording of this current cross-sectional research was performed in the end of November 2020 and in the beginning of December 2020 at first, and then in March 2021, the questionnaire was filled by 528 persons in the second wave and 515 persons in the third wave. Although the survey, the cohort study performed by on-line sampling is not representative, due to the size of the sample, data provide an informative picture about the mental status of the population of the North-eastern region of Hungary and its changes during the second and third wave of the pandemic. Results: The average age of the 528 persons involved in the first phase of the research was 39.4±13.1 years, the willingness to respond was similar in the second phase (N=515), and there was a small decrease in the average age (x=34.7±13.05 years). At the time of the first data recording, 16.7% of the respondents had undergone the COVID-19 infection, while this number was 24.1% in the second phase. At first, most of the people having been infected (50.4%) had mild symptoms, while 47.8% survived the disease with medium strength symptoms. When we asked about the wider environment, they reported essentially more infections: the infection could have been detected in all the respondents’ households. 22.7% of those living in one household had at least one member and 77.3% had more than one infected family members. The severity of the course of the infection was different: 32% judged it very mild, 60.9% said it was medium, 3.1% of them needed hospitalization, and the course of the infection was fatal in the environment of 3.5% of the respondents. In the second phase of the research, most of the people having been infected (45.1%) had mild symptoms, while 52.6% suffered from medium strength symptoms. 37% of those living in one household had at least one member and 63% had more than one infected family members. The severity of the course of the infection was different: 26.5% judged it very mild, 58% said it was medium, 9% of them needed hospitalization, and the course of the infection was fatal in the environment of 4.5% of the respondents. Overall, the pandemic influences the population’s mental status and health anxiety in an obviously negative way in the examined region, it shows correlation with subjective health status, and we do not know its long-term effects at this time.

MARS: Automated Protocol Analysis Framework for Internet of Things

Internet of Things (IoT) devices generate a massive quantity of network traffic every moment, which undoubtedly poses an urgent demand for an accurate and efficient network protocol analysis tool in cyberspace management and security. However, the existing popular methods have limitations, such as incomplete functionality and insufficient accuracy. For example, the large number of novel network applications brings unprecedented protocols for protocol analysis, which greatly limit the analysis capabilities of existing tools. In this article, we devise an automated protocol analysis framework for IoT devices called <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MARS</i> to solve these problems. To the best of our knowledge, this is the first unified framework including all three analysis stages: 1) classifying protocol; 2) analyzing the protocol phase; and 3) parsing the protocol field. At each stage, we provide effective solutions to solve the corresponding tasks and improve the efficiency of protocol analysis. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MARS</i> can also deal with unknown protocols that are common in IoT scenarios but are rarely concerned by previous works. Finally, we develop a distributed computing engine to ensure the high throughput and processing speed of the whole framework for the huge amount of network traffic. The evaluation on a variety of different protocols shows the superiority of our <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">MARS</i> over previous works in terms of comprehensiveness and accuracy.

PSO-based feature extraction of unknown protocol data frame

PSO-based feature extraction of unknown protocol data frame

An Unknown Protocol Identification Method for Industrial Internet

This paper focuses on the problem of protocol identification in the industrial internet and proposes an unknown protocol identification method. We first establish an industrial internet protocol detection model to classify known protocols, unknown protocols, and interference signals and then store the unknown protocols for manual analysis. Based on the Eps-neighborhood idea, we further develop an Eps-neighborhood hit algorithm and propose an identification method to identify unknown protocols, where the supervised learning classification of unknown protocol detection is realized. Finally, extensive experimental results are provided to illustrate our theoretical findings. It indicates that the proposed method has an average screening accuracy of 94.675% and 95.159% for unknown protocols encoded in binary and ASCII, respectively, while the average screening accuracy of known protocols in binary and ASCII encoding is 94.242% and 94.075%.

Sub-messages extraction for industrial control protocol reverse engineering

The Industrial Internet of Things (IIoT) connects various industrial devices and processes for smart manufacturing purposes. The industrial devices and processes may employ standard or private communication protocols. Protocol Reverse Engineering (PRE) can infer the format of the unknown protocol by analyzing traffic traces. Existing work in the field mainly focuses on Internet protocol only, handling text messages. PRE for industrial control protocols is difficult and particularly designed for IIoT for real-time interconnection among industrial devices. Given the phenomenon that many consecutive sub-messages are often embedded in a lengthy message payload and have a similar format, a novel sub-messages extraction algorithm is proposed in this work by using template iteration as an intermediate step to form a full message format inference framework. An improved evaluation criterion is also proposed to evaluate the sub-messages extraction results. We carry out our algorithm on three standard industrial control protocols and two unknown protocols. Experiments show that adding our sub-messages extraction in PRE for IIoT can greatly improve the accuracy of the overall protocol format inference compared with the existing work.

Unsupervised Binary Protocol Clustering Based on Maximum Sequential Patterns

With the rapid development of the Internet, a large number of private protocols emerge on the network. However, some of them are constructed by attackers to avoid being analyzed, posing a threat to computer network security. The blockchain uses the P2P protocol to implement various functions across the network. Furthermore, the P2P protocol format of blockchain may differ from the standard format specification, which leads to sniffing tools such as Wireshark and Fiddler not being able to recognize them. Therefore, the ability to distinguish different types of unknown network protocols is vital for network security. In this paper, we propose an unsupervised clustering algorithm based on maximum frequent sequences for binary protocols, which can distinguish various unknown protocols to provide support for analyzing unknown protocol formats. We mine the maximum frequent sequences of protocol message sets in bytes. And we calculate the fuzzy membership of the protocol message to each maximum frequent sequence, which is based on fuzzy set theory. Then we construct the fuzzy membership vector for each protocol message. Finally, we adopt K-means++ to split different types of protocol messages into several clusters and evaluate the performance by calculating homogeneity, integrity, and Fowlkes and Mallows Index (FMI). Besides, the clustering algorithms based on Needleman–Wunsch and the fixed-length prefix are compared with the algorithm presented in this paper. Compared with these traditional clustering methods, we demonstrate a certain improvement in the clustering performance of our work.

Retracted] Dynamic Analysis of Network Protocol Hiding Behavior Based on Perceptual Mining

This paper analyzes the typical abnormal behaviors such as hidden and invisible attacks of network protocols and proposes a new method to perceive and mine the abnormal behaviors of protocols so as to evaluate the operational security of protocols. Aiming at the problems of long latency and difficulty to expose the hidden behavior of network protocols, a scheme combining dynamic stain analysis and instruction clustering analysis is proposed. The proposed method cannot only quickly distinguish the hidden behavior but also accurately grasp the hidden behavior instruction sequence. Experimentation results show that the proposed method can mine unknown protocols for abnormal behavior with high accuracy.

Как и почему было закрыто издательство «Всемирная литература» (по материалам из Архива А.М. Горького ИМЛИ РАН)

The article is devoted to the final period of the Gorky’s publishing house “World Literature” and the circumstances of its closure in January 1925. The article presents hithertho unknown protocols of the Editorial Board meetings from A.M. Gorky Аrchive of the IWL RAS, notes from the diary of K.I. Chukovsky and the A.L. Volynsky archive of in RGALI. The work of the publishing house reached the top in 1923, when Gorky was abroad and the management of the publishing house was transferred to A.N. Tikhonov. The main opponent of the publishing house and Tikhonov personally was I.I. Ionov, the brother-in-law of G.Е. Zinoviev and Gorky’s main enemy. Initially, “World Literature” was created as an autonomous publishing house, located in the department of the People’s Commissariat of Education (Narkompros), but later it was subordinated to the State Publishing House (Gosizdat), which was responsible for publishing books and material support of the publishing house. Lenin, Vorovsky and Lunacharsky were the patrons of Gorky and Tikhonov, Zinoviev supported Ionov, and the victim of their struggle, which unfolded after Lenin’s death in January 1924, ultimately became “World Literature,” which was transferred under the control of the State Publishing House.

An Efficient Interaction Protocol Inference Scheme for Incompatible Updates in IoT Environments

Incompatible updates of IoT systems and protocols give rise to interoperability problems. Even though various protocol adaptation and unknown protocol inference schemes have been proposed, they either do not work where the updated protocol specifications are not given or suffer from inefficiency issues. In this work, we present an efficient protocol inference scheme for incompatible updates in IoT environments. The scheme refines an active automata learning algorithm, L*, by incorporating a knowledge base of the legacy protocol behavior into its membership query selection procedure for updated protocol behavior inference. It also infers protocol syntax based on our previous work that computes the most probable message field updates and adapts the legacy protocol message accordingly. We evaluate the proposed scheme with two case studies with the most popular IoT protocols and prove that it infers updated protocols efficiently while improving the L* algorithm’s performance for resolving the incompatibility.

A progressive learning method on unknown protocol behaviors

Reverse analyzing of unknown protocol behaviors keeps being a tough nut in Protocol Reverse Engineering (PRE), which infers specifications of unknown protocols by observable information, especially when only transmitted messages are available. This paper proposes a novel protocol state machine model Stochastic Protocol finite-state Transducer (SPT) to describe the message interaction rules between communicating terminals in a probabilistic way attempting to simulate behavior rules of unknown protocols in certain implementation. Together with a state related field recognition and compensation method, a progressive SPT learning algorithm of unknown protocols named Sptia-PL, is designed and implemented to reconstruct the SPT of target protocol with the ability to predict succeeding behaviors. By updating the SPT progressively, the proposed method is able to learn continuously in linear time and remain the established model in optimal condition during the whole learning process. This strategy thoroughly avoids the state explosion problem existing in most state machine learning methods of PRE. Experiments on two open and three local collected datasets of FTP, SMTP and POP3 prove the rationality of SPT model and effectiveness of Sptia-PL algorithm by an average Accuracy over 0.94 and a Coverage close to 0.99. The small computing cost O(N) of this method and high confidence of results outperforms all the known state-of-the-art methods significantly.

R-gram: Inferring message formats of service protocols with relative positional n-grams

Automatically discovering message formats of unknown service or system protocols from network traces has become important for a variety of applications, such as emulating the behavior of an unknown protocol in service virtualization, or enabling deep packet inspection in network security. Among existing schemes, the keyword extraction based approaches have been shown to be effective. Inspired by the template structure of protocol messages, recent works leverage the positions of keywords to extract message keywords more accurately. However, these methods are deficient for messages with large variations in length. To address this problem, we propose R-gram, which exploits the relative positions of keywords in messages, allowing the keywords to be robustly detected in variable length messages. It first extracts the common template of the messages in a given message trace with a fast sampling technique, and segments each message into blocks according to the relative positions of the common keywords in the template. It then identifies message keywords in each block by using a new concept and technique — relative positional n-gram (r-gram in short). Finally, the message keywords are used to separate all the messages into type-specific clusters and consequently derive the message format for each cluster. We have implemented and evaluated R-gram on real-world service traces containing either textual or binary protocol messages. Our experimental results show that R-gram is more accurate and robust than existing state-of-the-art tools in protocol message format extraction. Furthermore, R-gram is efficient for processing large-scale message traces.

Protocol State Machine Reverse Engineering with a Teaching-Learning Approach

In this work, we propose a novel solution to the problem of inferring the state machine of an unknown protocol. We extend and improve prior results on inferring Mealy machines, and present a new algorithm that accesses and interacts with a networked system that runs the unknown protocol in order to infer the Mealy machine representing the protocol's state machine. To demonstrate the viability of our approach, we provide an implementation and illustrate the operation of our algorithm on a simple example protocol, as well as on two real-world protocols, Modbus and MQTT.