An Efficient Worm Defense System Based Signature Extraction

Recent worm increasingly threaten the availability of Internet. It is difficult to catch variety of 0day worms promptly with current signature matching approach because most signatures are developed manually. Several recent efforts to automatically extract worm signatures from Internet traffic have been done, but the efficiency is an unsolved problem especially in real high-speed network. We propose a binary clustering algorithm and a leaves preferred policy to improve the front traffic filter, which can reduce the traffic to be processed and enhance its purity. A position-aware signature generation method based bloom filter is proposed to bring better performance and more accurate signature for content-based defense. Both trace data and tcp dump data are used to test the prototype system and experiment results show the system can efficiently filter through suspicious traffic with high purity, which is no more than 25% of entire traffic, and extract more accurate signature, which can well support popular defense system such as Snort.

We develop a direct finite-element solver of linear (optimal) complexity to extract broadband circuit parameters such as S-parameters of arbitrarily shaped 3-D interconnects in inhomogeneous dielectrics. Numerical experiments demonstrate a clear advantage of the proposed solver as compared with existing finite-element solvers that employ state-of-the-art direct sparse matrix solutions. A linear complexity in both CPU time and memory consumption is achieved with prescribed accuracy satisfied. A finite-element matrix from the analysis of a large-scale 3-D circuit in multiple dielectrics having 5.643 million unknowns is directly factorized in less than 2 hours on a single core running at 2.8 GHz.

Event detection over RFID event streams is one of the most important applications of RFID based monitoring systems. Event detection over data stream extracts meaningful complex patterns from high volume, fast speed and real time raw event streams. This research aims to detect RFID event patterns by introducing context information to reduce event instances effectively. Context of an RFID application is modeled and merged into event query optimization framework. Context information is further applied into evaluation of pattern detection. Experimental results show that context information can optimize complex event detection process both on CPU time and memory consumption.

Traditional Distributed Denial of Service (DDoS) attacks usually flood network targets with malicious traffic. Recently, new types of DDoS attacks have emerged and target specifically network security devices, mainly firewalls and intrusion prevention systems (IPS). In contrast to traditional DDoS attacks, these emerging attacks use a low volume of malicious traffic. This paper is concerned solely with an emerging denial of firewalling attack (DoF), called the BlackNurse attack. The attack uses specially formatted ICMP error messages to overwhelm targeted firewalls' CPUs. This paper offers detailed insights into the understanding of DoF attacks and classifying them according to the targeted firewall resources, traffic volume, and attack effect. This paper also concentrates on the BlackNurse attack principles, practical attack generation, and its general effect on impacted firewalls and the networks. The performance evaluations are conducted on commercial grades, namely, Juniper NetScreen SSG 20 and Cisco ASA 5540 firewalls. The pros and cons of the available attack mitigations are discussed. OS screening features on Juniper NetScreen SSG 20 are used, for an example, to test their effectiveness in thwarting the attack. Furthermore, this paper proposes a novel mechanism to defend against the BlackNurse attack using an early rejection rule with dynamic activity time duration that depends on current and previous attack statistics and severity parameters. The evaluation is conducted to simulate the proposed mechanism defense against novice and expert BlackNurse attackers.

A tunable hybrid memory allocator

Intrusion Prevention Systems (IPSs) are processes that are handled as add-ons to the Intrusion Detection Systems (IDSs) in order to effectively resist and prevent invasions in IoT devices. In this paper, a comparative study on various Machine learning (ML) based Intrusion Prevention System (IPS) has been proposed on UNSW-NB15 dataset by applying various ML methods for classification. For Intrusion Prevention System, two level classifiers for dropping of packets are implemented. Level 1 classifier comprises of Decision Tree (DT) whereas Level 2 classifier uses Random Forest (RF). The proposed IPS automatically adapts to system changes and further reduces training time and increases the accuracy of the system and acts as a lightweight Second Line of Defense System for an IoT Network. In this system, threshold value is calculated by finding the average time of execution of all of the data in the training set.

To calculate scattering of a vegetation field consisting of a large number of plants, an improved fast version of the hybrid method (FHM) combining fast multiple scattering theory (FMST) and a numerical electromagnetic approach has been developed. In the HM, we use a library of T-matrices and the Foldy–Lax (FL) equation to calculate the electromagnetic field interactions outside of the cylinders enclosing the individual plants. To improve CPU time and memory requirements, the FL equation is solved by a triplet of fast Fourier transforms (FFTs) consisting of two FFTs solving 2-D FFTs of spatial distribution of plants and one 1-D FFT for solving the transformation of the order of cylindrical waves in the translation addition theorem. The triple FFTs minimize the CPU time and the memory requirement for computing translation addition matrix, which has been the bottleneck of large-scale simulations in the HM. To account for nonperiodic distribution of scatterers in a corn field, the premultiplication and the postmultiplication processes were applied to the FHM. The proposed method is validated at L-band (1.4 GHz) for 100 corn plants of height 1.25 m occupying an area of 9.54 by 9.54 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\text{m}^{2}$ </tex-math></inline-formula> . On a standard laptop, the CPU time is less than 6 min and the memory consumption is less than 710 Mbytes. The CPU time and the memory requirements are orders of magnitude more efficient than those required for solving the problem with a commercial software or using the previous version of the HM.

Relative contribution of Na+/K+ homeostasis, photochemical efficiency and antioxidant defense system to differential salt tolerance in cotton (Gossypium hirsutum L.) cultivars

Today automatic meshing of CAD geometry is the most common method of FEM mesh generation. However, to get results of acceptable accuracy with universal meshing algorithms it is necessary to use rather small-sized elements which leads to high memory and CPU time consumption. Furthermore, the irregularity of automatically generatated meshes makes it difficult to create well-defined local areas with different material properties. A solution for this problem is the application of predefined building blocks (FEM-Features) which contain algorithms for a problem-adapted mesh generation. These building blocks may be realised as in an object-oriented modelling system. By employing interface objects, it is easy to combine design objects to form complex geometries. The technique is explained by an example.

This paper describes the activities carried out for the development and the use of CRFD codes and related procedures for the design of industrial furnaces. The objective is to predict the emission of pollutants, such as nitrogen oxides, in combustion flue gases. This prediction may be correctly accomplished using a detailed kinetic mechanism, which cannot be directly implemented on CRFD codes due to actual computational limits (both in terms of memory and CPU time consumption). A new approach has been developed: analysing the 3D CRFD flow fields, an “equivalent” chemical reactors network model is extracted with corresponding residence time distributions and overall reactor properties, and the detailed kinetic calculation is performed on this simpler scheme. The approach has been successfully applied to different scale of furnaces such as pilot plants and industrial boilers, low- NOx burners and glass furnaces. In the papers a description of the CRFD codes is given, and the methodology to extract a chemical ideal reactor network from CFRD fields is presented. Finally, an application of the procedure on the Monfalcone #3 steam generator is discussed.

Human can easily recognize visual objects with lost information: even losing most details with only contour reserved, e.g. cartoon. However, in terms of visual perception of Deep Neural Networks (DNNs), the ability for recognizing abstract objects (visual objects with lost information) is still a challenge. In this work, we investigate this issue from an adversarial viewpoint: will the performance of DNNs decrease even for the images only losing a little information? Towards this end, we propose a novel adversarial attack, named AdvDrop, which crafts adversarial examples by dropping existing information of images. Previously, most adversarial attacks add extra disturbing information on clean images explicitly. Opposite to previous works, our proposed work explores the adversarial robustness of DNN models in a novel perspective by dropping imperceptible de-tails to craft adversarial examples. We demonstrate the effectiveness of AdvDrop by extensive experiments, and show that this new type of adversarial examples is more difficult to be defended by current defense systems.

Currently, the internet serves as the predominant means of communication and is utilized by a vast number of individuals worldwide. Simultaneously, the commercial aspect of the internet is contributing to a rise in susceptibility to cybercrimes, leading to a significant surge in the occurrence of distributed Denial of Service (DDoS) assaults over the last decade. DoS/DDoS assaults primarily target network resources such as network bandwidth, CPU time, memory consumption, web servers, and network switches. Network security is an essential and crucial problem in the modern interconnected society. Numerous studies have been undertaken by multiple researchers thus far in order to identify this attack. However, there is still room for improvement in past investigations. This paper presents a novel approach for detecting and simulating DoS/DDoS attacks in modern networking environments, introducing a new paradigm. It is done in a controlled environment. The primary focus of this work is to simulate an attacker's perspective of a DoS/DDoS attack by repeatedly sending huge SYN flood packets to a specific target or network server using the hping3 tool. On the server side, the proposed attacker detector script continuously monitors incoming network connections on the network server using the netstat command. It identifies potential DoS/DDoS attacks by analyzing the connection count and comparing connections count with an assumed threshold. This experiment results in 61% CPU usage and 7.1% memory consumption while a DDoS attack triggers on the target server. Additionally, the proposed script performs statistical analysis and displays warning messages on the console when suspicious activity is detected on the network server. Wireshark is also utilized in this work to detect anomalous network traffic patterns in order to identify distributed denial-ofservice (DDoS) attacks that are targeting a network server. Additionally, it offers the capability to block the IP address of the attacker if the configuration allows for it. This proposed approach efficiently identifies DDoS activity in real-time network traffic, further helping to improve network security.

Edge computing promises a dramatic reduction in the network latency and the traffic volume, where many edge servers are placed at the edge of the Internet. Furthermore, those edge servers cache data to provide services for edge users. The data sharing among those edge servers can effectively shorten the latency to retrieve the data and further reduce the network bandwidth consumption. The key challenge is to construct an efficient data indexing mechanism no matter how the data is cached in the edge network. Although this is essential, it is still an open problem. Moreover, existing methods such as the centralized indexing and the DHT indexing in other fields fail to meet the performance demand of edge computing. This paper presents a COordinate-based INdexing (COIN) mechanism for the data sharing in edge computing. COIN maintains a virtual space where switches and data indexes are associated with their coordinates. Then, COIN distributes data indexes to indexing edge servers based on those coordinates. The COIN is effective because any query request from an edge server can be responded when the data has been stored in the edge network. More importantly, COIN is efficient in both routing path lengths and forwarding table sizes for publishing/querying data indexes. We implement COIN in a P4 prototype. Experimental results show that COIN uses 59% shorter path length and 30% less forwarding table entries to retrieve data indexes compared to using Chord, a well-known DHT solution.

In this work the resonant frequencies in spheroidal metallic cavities loaded with isotropic and anisotropic material, are studied. For the case of isotropic infills, an extended bound-ary condition integral equation method (referred hereafter as extended integral equation) is employed while, a local point tech-nique is developed for anisotropic loadings. The anisotropy used in this work is of uniaxial type while prolate and oblate spheroidal cavities are studied. The extended integral equation is based on numerical integration of the involved special functions along the generating curve of the spheroidal surface. On the contrary, the local point technique satisfies the requisite boundary condition at a predefined set of points on the generating curve without the necessity to apply integration techniques. The emerging hybrid modes are examined and discussed. In particular, the spheroidal cavity spectrum for isotropic infills is extracted and compared by both the extended integral equation and the local point technique. Concerning uniaxial loaded cavities, the resonant frequencies are calculated solely by the local point technique. To validate these results, we utilize the HFSS commercial software. The local point technique turns out to be computationally efficient in terms of CPU time and memory consumption, as compared to the commercial solver. Various numerical results are presented and discussed.

For a variety of multiscale electromagnetic (EM) problems, mesh densities that are more than sufficient for the frequency of interest have to be adopted in order to maintain the integrity of multiscale geometrical features. The adoption of the overly fine mesh, or locally overly fine mesh, would render the multi-level fast multiple method (MLFMM) inefficient during the matrix-vector multiplication (MVP), both in terms of CPU time and memory consumption. Similar issue occurs also in wideband analyses. In this paper, we proposed a hierarchical multi-level fast multipole method (H-MLFMM) based on the skeletonalization technique to address effectively the EM scattering from targets with multiscale features. Numerical examples demonstrate the accuracy and applicability of the H-MLFMM algorithm.