Flow-Based Approach to Detect Abnormal Behavior in Neighbor Discovery Protocol (NDP)

The fast growth of the Internet usage has caused problem on Internet protocol address space. To solve this problem, Internet Protocol version 6 (IPv6) was created to expand the availability of address spaces. An important part of the IPv6 suites is the Neighbour Discovery Protocol (NDP), which is geared towards substitution of Address Resolution Protocol in router discovery, and function redirection in Internet Protocol version 4 (IPv4). NDP includes the routing function which is determines which route a data packet will follow to arrive at its intended destination, and the address function which assigns unique addresses to each and every device connected to a network for identification purposes. NDP messages are broadly categorized into five types and each message type carries out distinct tasks, these messages are: Router Solicitation (RS), Neighbour Solicitation (NS), Router Advertisement (RA), Neighbour Advertisement (NA), and Redirect. NDP security vulnerabilities is openness of a network of computer, wherein there exists a lack of trust among users. Typically, huge numbers of NDP messages can be used to flood a network, resulting in disconnecting of the connected devices. Due to the limitations of existing defence mechanisms, NDP are still prone to network-based attacks and these vulnerabilities must be considered while creating an IPv6 network. In this thesis, we present a novel detection method for DDoS and Replayed attacks that are launched using NDP in IPv6. This detection method is a stream-based network representation, instead of packet-based representation. The proposed detection method makes use of Locally Weighted Learning machine learning techniques, with three different algorithms as its based learner Bayesian network, Decision tree and Naïve Bayes. LWL-Bayesian Network model achieved the highest detection rate of 96.48%. LWL-Naïve Bayes model is the next best model, with an accuracy rate of 96.024%, while the LWL-Decision Tree model had the lowest overall detection rate of 93%. Comparatively, all developed IDSs are capable of detecting DDoS and Replayed attacks based on NDP-based network traffic as well as the detection of anomalies. They all demonstrated strong predictive ability, however, the LWL-Bayesian Network model proved to have the best overall performance to develop a locally weighted IDS model among the three models. In short, the development of the detection models, has strong predictive capabilities, with high accuracy rate, does not overfit, has low computational costs, and uses less time for model development and attack detection.

Hybridizing flower pollination algorithm with particle swarm optimization for enhancing the performance of IPv6 intrusion detection system

Internet Protocol Version six (IPv6) is an ultimate solution for the Internet address depletion problem. It is developed not only to solve the addressing problem but also introduce some improvements on networking infrastructure. One of the improvements is the availability of Neighbor Discovery Protocol (NDP). Duplicate address detection (DAD) is one of the functions of NDP to make sure a generated IPv6 address is unique. However, since the NDP is not supported by a security mechanism, the DAD is vulnerable to DoS attack. Attacker can fail the detection process that causes on failing of IPv6 address configuration. The NDP standard suggested using IPSec or SeND to protect the NDP. However, the two security mechanisms introduced high computation due to the usage of cryptography algorithm. Further, its implementation in IPv6 local network is not trivial. This paper proposes a lightweight security mechanism based on distributed trust management that integrates hard security and soft security to secure the DAD in IPv6 called Trust-ND. The experimental result showed it could save the processing time of SeND mechanism up to 65.44 ms in sender and 23.53 ms in receiver. It also saves the available bandwidth up to 21.504 Kbps from the SeND mechanism.

The adoption of Internet Protocol version 6 (IPv6) has increased due to the requirements for a larger address space and better suitability for modern networks, such as Internet of Things (IoT) networks, but it also introduces new security challenges. The Neighbor Discovery Protocol (NDP) that supports features like the router discovery and address resolution, is not secured due to its stateless and trust-based feature. The most notable one is the NDP Table Exhaustion attack that consists of overwhelming the network with forged Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packets, inducing neighbor cache overload and denial-of-service (DoS). Current defenses, such as Secure Neighbor Discovery (SEND) or machine learning-based detection models, have significant computational overheads and cannot be adapted to resource-constrained networks, creating a gap in the overall security of IPv6. To address this problem, this research paper suggests a lightweight, flow-based detection framework that integrates an entropy-based analysis with rule-based thresholds to detect NS and NA flooding attacks. The system gathers traffic into flows, entropy checks on key fields such as source Internet Protocol (IP) and network prefix, and alerts on anomalies when the traffic moves out of the normal operation range. It had the average precision of 0.91, average recall of 0.88, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$F 1$</tex>-score of 0.87, but with minimal overhead and highly deployable in both enterprise and IoT networks.

2 - IPv6 Multicasting

Currently, most anomaly detection approaches in industrial control systems (ICSs) use network event logs to build models, and current unsupervised machine learning methods rarely use spatiotemporal correlations and other dependencies between multiple variables (sensors/actuators) in a system to detect anomalies. Most of the existing anomaly detection technologies simply compare the current states with the predicted normal range. Due to the highly dynamic characteristic of industrial control systems, it is insufficient to simply compare the current states with the predicted normal range. As a result, these approaches have low detection rates for unknown or new types of attacks. In view of these shortcomings, this paper presents a network model for predicting sensor/controller parameters in industrial control systems. To predict the parameter values of the sensors and controllers more accurately, the 1D convolutional neural network (1D_CNN) and gated recurrent unit (GRU) are combined to fully learn the spatiotemporal correlation and other dependencies between the parameter values of the sensors and controllers at each moment. An abnormal state detection method based on the calculation of the statistical deviation is proposed to realize the anomaly detection of industrial control systems. The model is validated on the Secure Water Treatment (SWaT) dataset. The precision, recall and F1 scores are used to evaluate the effectiveness of this method in anomaly detection on the SWaT dataset. The experimental results show that the average precision and recall of this method are 0.99 and 0.85, respectively, and that the average F1 score is 0.91. The experimental results show that the proposed method can be successfully applied to anomaly detection systems in industrial control systems with lower false positive rates.

The neighbor discovery protocol (NDP) is a stateless protocol facilitating link local communication in IPv6 networks. The nodes employ IPv6 NDP to locate other hosts/routers on the link, cover resolution of link layer addresses, duplicate address detections and track reachability status about paths to active nodes. However, link local communication using NDP is susceptible to some severe attacks, which if neglected leave the network vulnerable. Attackers can spoof source addresses of legitimate nodes by forging NDP messages and propel attacks like Denial of Service (DoS) and Man-in-the-Middle (MITM) leading to failure of IPv6 host initialization. To avert this, RFC 3971 advocates employing Secure Neighbor Discovery (SeND) to make the process inviolable. SeND fortifies message tampering, prevents IPv6 address theft, including protection against replay attacks and enable validation of routers on the link. Although SeND is a robust link layer security mechanism, its practical implementation is reported to have serious shortcomings like cryptographic algorithms which impact computational complexity including bandwidth utilization, as such negate their implementation and adoption. Moreover, the protocol itself fails to provide the confidentiality factor in the network. SeND also falls short of mature unabridged implementations in commercial operating systems and network devices. This paper revisits the protocol implementation and reviews its deployment challenges. This article also discusses some feasible proposals and recommendations for facilitating practical deployment of SeND in IPv6 networks including resource constrained devices like mobile phones.

Artificial grassland mapping using artificial grassland detection index of vegetation growth in the Three-River Headwaters region

In this article, we present a new method based on the securisation of an IPv6 (Internet Protocol version 6) address obtaining with the SLAAC (Stateless Address Autoconfiguration) method in the domestic network. The particularity of our domestic network is the presence of several Multihoming Internet service providers. The peripherals of the Home Network domain, especially routers are in charge of the relay of auto configuration messages coming from various routers of internet access providers. Our method allows the routers of the Home Network domain to filter the announcements of autoconfigurations called RA (Router Advertisements) according to the IPv6 addresses sources contained in the messages of autoconfiguration. The decision to relay or reject these announcements is based on a trusted table built from the addressing information obtained from the NDP protocol. Our method also aims to optimize the traffic in the Home Network domain by organizing routers to give them specific roles for the relay of information for autoconfiguration.

Study question Can tracking cell division and predicting human embryo cleavage stages be automated in time-lapse videos (TLV) using AI object detection methods? Summary answer We developed software predicting blastomere count and tracking cell cleavages up until 4-5 stage. The software employs object detection technique called YOLOv5 to detect cells. What is known already Embryo morphology plays an important part in determining viability. Parameters such as number of cells present following fertilization, abnormal cell division (reverse/direct) and evaluating cleavage stages have correlation with pregnancy rates. However, continuous manual evaluation can be time-consuming, and automation will assist in embryo viability assessment. YOLOv5 has proven to accurately detect objects in videos. YOLOv5 uses mean average precision (mAP) as a metric to quantify the portions of frames in videos having the correct count of the objects. Study design, size, duration We have developed a software that uses YOLOv5 to detect cells present in frames of TLV, then marks each cell boundary with different colored circular overlays using OpenCV. We trained YOLOv5 to detect objects: cell, morula and blastocyst using 150 images of different cell-stages, morula, blastocyst. For object cell mAP was 0.65. Annotated location of objects in images and YOLOv5 predictions were reviewed by embryologists. We evaluated the software on TLV from 11 patients. Participants/materials, setting, methods After YOLOv5 detects cells in frames of TLV, our software computes cell count and assigns each cell a different color which is maintained until cell division into daughter cells. Later, daughter cells were also assigned different colors. If the frame has a preceding frame, software calculates detected cells' proximity with each cell in the preceding frame and copies color scheme provided proximity is within some threshold. The software provides TLV with colored overlays as output. Main results and the role of chance In starting frames of TLV with single cell, software accurately detected 1-cell (high precision=0.99, high recall=0.83, high F1-score=0.90). We observed some misclassification between 1-cell and morula. The reason could be that compacted morula looks like 1-cell. Best performance is observed for 2-cells (high precision=0.91, high recall=0.98, high F1-score=0.95). 4-cells were sometimes misclassified with 3 or 5-cells (high precision=0.88, low recall=0.59, high F1-score=0.71). One reason for the misclassification can be that overlapping between cells increases with number of cells. 3-cell and 5-cell are confused with other stages, still cleavage stage detection is better than random: 3-cell (average precision=0.43, high recall=0.83, average F1-score=0.49), 5-cell (average precision=0.44, average recall=0.40, average F1-score=0.40). For cell-stages&amp;gt;5, YOLOv5 detects less cells than actual count and software predicts cleavage later than actual by 9-10 frames on average. The proximity threshold used was 0.10 for cell-count&amp;lt;4 and 0.05 for count&amp;gt;4. In 5 TLV, overlay color for cells changes abruptly between frames, possibly because once YOLOv5 detected a stage, in consecutive frames less cell-number was recorded, and then again reported correct count. Sometimes, software selected the wrong parent for daughter cells (incorrect colored overlay). 2 TLV had direct and reverse cleavages and software could detect these two patterns. Limitations, reasons for caution Overall, our software can precisely detect cells, cell divisions and cleavage stages up to 4-cell stages. We hypothesize that training YOLOv5 on a bigger dataset and including several focal plane information will enable our software to detect overlapping cells and cleavage stages &amp;gt; =5. Wider implications of the findings Object detection proved to be pragmatic for ART and tracking cell division using our software will reduce time consumed in manual annotations, easier prediction of abnormal cleavages and more objective assessments. Qualitative evaluation by embryologists resulted in the overall verdict that this is useful and promising for further development. Trial registration number not applicable

Objective The risk of gastric cancer can be predicted by gastroscopic manifestation recognition and the Kyoto Gastritis Score. This study aims to validate the applicability of AI approaches for recognizing gastroscopic manifestations according to the definition of Kyoto Gastritis Score, with the goal of improving early gastric cancer detection and reducing gastric cancer mortality. Methods In this retrospective study, 29013 gastric endoscopy images were collected and carefully annotated into five categories according to the Kyoto Gastritis Score, i.e. atrophy (A), diffuse redness (DR), enlarged folds (H), intestinal metaplasia (IM), and nodularity (N). As a multi-label recognition task, we propose a deep learning approach composed of five GAM-EfficientNet models, each performing a multiple classification to quantify gastroscopic manifestations, i.e. no presentation or the severity score 0–2. This approach was compared with endoscopists of varying years of experience in terms of accuracy, specificity, precision, recall, and F1 score. Results The approach demonstrated good performance in identifying the five manifestations of the Kyoto Gastritis Score, with an average accuracy, specificity, precision, recall, and F1 score of 78.70%, 91.92%, 80.23%, 78.70%, and 0.78, respectively. The average performance of five experienced endoscopists was 72.63%, 90.00%, 77.68%, 72.63%, and 0.73, while that of five less experienced endoscopists was 66.60%, 87.44%, 70.88%, 66.60%, and 0.66, respectively. The sample t-test indicates that the approach’s average accuracy, specificity, precision, recall, and F1 score for identifying the five manifestations were significantly higher than those of less experienced endoscopists, experienced endoscopists, and all endoscopists on average (p < 0.05). Conclusion Our study demonstrates the potential of deep learning approaches on gastric manifestation recognition over junior, even senior endoscopists. Thus, the deep learning approach holds potential as an auxiliary tool, although prospective validation is still needed to assess its clinical applicability.

5 - Neighbor Discovery and Stateless Address Autoconfiguration

Real driving environment EEG-based detection of driving fatigue using the wavelet scattering network

Private approximate nearest neighbor search for on-chain data based on locality-sensitive hashing

Abstract. This study explores the enhancement of UNet-based semantic segmentation for photovoltaic (PV) panels in remote sensing images by integrating attention mechanisms. Given the critical role of solar energy in achieving global sustainability, accurate PV panel detection is essential for effective energy management. Using the high-resolution PV01 dataset, which includes UAV-captured rooftop PV samples, we evaluate the impact of four distinct attention modules: Convolutional Block Attention Module (CBAM), Squeeze-and-Excitation Networks (SE-Net), Efficient Channel Attention (ECA-Net), and Coordinate Attention (CA) on segmentation performance. Comparative analysis demonstrates that UNet models with SE and CA modules substantially outperform the baseline, achieving the highest scores in Average Accuracy (AA), Average Precision (AP), Average Recall (AR), mean Intersection over Union (mIoU), and Average F1-score (AF). In particular, UNet + SE achieved an AA of 0.9809, AP of 0.9756, AR of 0.9629, AF of 0.9692, and mIoU of 0.9403, highlighting the efficacy of attention mechanisms in refining feature representations and advancing PV panel segmentation, thereby contributing to large-scale solar energy monitoring and deployment.