Improving Security of Duplicate Address Detection on IPv6 Local Network in Public Area

The fast growth of the Internet usage has caused problem on Internet protocol address space. To solve this problem, Internet Protocol version 6 (IPv6) was created to expand the availability of address spaces. An important part of the IPv6 suites is the Neighbour Discovery Protocol (NDP), which is geared towards substitution of Address Resolution Protocol in router discovery, and function redirection in Internet Protocol version 4 (IPv4). NDP includes the routing function which is determines which route a data packet will follow to arrive at its intended destination, and the address function which assigns unique addresses to each and every device connected to a network for identification purposes. NDP messages are broadly categorized into five types and each message type carries out distinct tasks, these messages are: Router Solicitation (RS), Neighbour Solicitation (NS), Router Advertisement (RA), Neighbour Advertisement (NA), and Redirect. NDP security vulnerabilities is openness of a network of computer, wherein there exists a lack of trust among users. Typically, huge numbers of NDP messages can be used to flood a network, resulting in disconnecting of the connected devices. Due to the limitations of existing defence mechanisms, NDP are still prone to network-based attacks and these vulnerabilities must be considered while creating an IPv6 network. In this thesis, we present a novel detection method for DDoS and Replayed attacks that are launched using NDP in IPv6. This detection method is a stream-based network representation, instead of packet-based representation. The proposed detection method makes use of Locally Weighted Learning machine learning techniques, with three different algorithms as its based learner Bayesian network, Decision tree and Naïve Bayes. LWL-Bayesian Network model achieved the highest detection rate of 96.48%. LWL-Naïve Bayes model is the next best model, with an accuracy rate of 96.024%, while the LWL-Decision Tree model had the lowest overall detection rate of 93%. Comparatively, all developed IDSs are capable of detecting DDoS and Replayed attacks based on NDP-based network traffic as well as the detection of anomalies. They all demonstrated strong predictive ability, however, the LWL-Bayesian Network model proved to have the best overall performance to develop a locally weighted IDS model among the three models. In short, the development of the detection models, has strong predictive capabilities, with high accuracy rate, does not overfit, has low computational costs, and uses less time for model development and attack detection.

SummaryThe fusion of drones with the Internet, termed the Internet of Drones (IoD), resembles the Internet of Things (IoT) paradigm. In IoD, drones necessitate unique identifiers similar to IPv6 addresses. This paper presents a novel approach for securing the duplicate address detection (DAD) process in the IoD environment. This paper focuses on addressing the security challenges posed by malicious drones in the DAD process. The proposed solution introduces a hidden DAD (H‐DAD) process, to mitigate attacks on the DAD process. In this scheme, drones transmit a transformed portion of their interface identifier (IID) while concealing the full IID, thus thwarting potential disruptions by malicious entities. We evaluated the effectiveness of the H‐DAD scheme through experimental analysis using Python with SimPy, comparing it with the Improved DAD, Secure DAD, and Standard DAD schemes. Our results demonstrate a notable improvement, with the Hidden DAD scheme achieving a 100% address success rate under attack. Moreover, it exhibits approximately 5% and 12% lower overhead and energy consumption, respectively, compared to the other schemes.

Hybridizing flower pollination algorithm with particle swarm optimization for enhancing the performance of IPv6 intrusion detection system

Internet Protocol version six (IPv6) is equipped with new protocols, such as the Neighbor Discovery Protocol (NDP). NDP is a stateless protocol without authentication that makes it vulnerable to many types of attacks, such as Router Advertisement (RA) and Neighbour Solicitation (NS) DoS flooding attacks. In these types of attacks, attackers send an enormous volume of abnormal NDP traffic, which causes congestion that degrades network performance. The expected behavior among these attacks is the existence of NDP traffic abnormalities. Thus, this research aims to propose a flow-based approach to detect abnormal NDP traffic behavior, which is considered an indicator of the presence of NDP-based attacks, such as RA and NS DoS flooding attacks. Also, the proposed approach relies on flow-based network traffic representation and adoption of the Entropy algorithm to detect the randomness in the network traffic. The proposed approach is evaluated in terms of detection accuracy, precision, recall, and F1-Score using a simulated dataset. The experimental result shows that the proposed approach obtained 98.1%, 55%, 100%, and 70.96% for average accuracy, precision, recall, and F1-Score, respectively, in detecting abnormal NDP traffic behavior caused by the RA DoS flooding attack. Meanwhile, the proposed approach obtained 99%, 91.3%, 100%, and 95.45% for average accuracy, precision, recall, and F1-Score, respectively, in detecting the abnormal NDP traffic behavior caused by the NS DoS flooding attack. Also, the proposed approach shows better results compared to other existing approaches.

The Internet of Things (IoT) is going to create a heterogeneous network of billions or trillions of connected things with self-aware, self-configuration capabilities that will exchange data with each other. This heterogeneous IoT network requires standard protocols, secure and energy-efficient wireless communication, and the allocation of unique identities such as IPv6 addresses. One of the key challenges in such a heterogeneous network is the maintenance of device location and unique identity to ensure the smooth functioning of location-aware applications. Hence, this paper presents a stateless spatiotemporal IPv6 addressing scheme called four-dimensional IP addressing (FDIPA). It is founded on the idea that two objects can not be in the same place at the same time. It uses the time and location information of the device to generate the target IPv6 address and assigns it to the device after verifying its uniqueness with the duplicate address detection (DAD) protocol. It not only maintains spatial and temporal information but also guarantees a unique identity for a large-sized network. Analytically, it is proved that FDIPA will always generate a unique identity if there is no technological limitation. However, the performance of FDIPA is evaluated based on metrics such as Assignment Success Rate (ASR), communication overhead, and total energy consumption in the assignment of a unique IPv6 address. The experimental results show that FDIPA achieves good ASR while keeping low energy consumption and less overhead in the network.

The adoption of Internet Protocol version 6 (IPv6) has increased due to the requirements for a larger address space and better suitability for modern networks, such as Internet of Things (IoT) networks, but it also introduces new security challenges. The Neighbor Discovery Protocol (NDP) that supports features like the router discovery and address resolution, is not secured due to its stateless and trust-based feature. The most notable one is the NDP Table Exhaustion attack that consists of overwhelming the network with forged Neighbor Solicitation (NS) and Neighbor Advertisement (NA) packets, inducing neighbor cache overload and denial-of-service (DoS). Current defenses, such as Secure Neighbor Discovery (SEND) or machine learning-based detection models, have significant computational overheads and cannot be adapted to resource-constrained networks, creating a gap in the overall security of IPv6. To address this problem, this research paper suggests a lightweight, flow-based detection framework that integrates an entropy-based analysis with rule-based thresholds to detect NS and NA flooding attacks. The system gathers traffic into flows, entropy checks on key fields such as source Internet Protocol (IP) and network prefix, and alerts on anomalies when the traffic moves out of the normal operation range. It had the average precision of 0.91, average recall of 0.88, and <tex xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">$F 1$</tex>-score of 0.87, but with minimal overhead and highly deployable in both enterprise and IoT networks.

One of the important issues in Mobile Ad Hoc NETworks (MANETs) is assignment of Internet Protocol (IP) addresses to nodes. Several address assignment schemes are discussed in Autoconf working group in Internet Engineering Task Force (IETF). These schemes are based on autonomously decentralized manner, and it may cause duplication of assigned IP addresses. The duplication of IP addresses disturbs route computation because routing protocols assume uniqueness of IP addresses. Therefore, a Duplicate Address Detection (DAD) scheme is needed. Weak DAD uses a unique key for the detection of duplicated IP addresses. This key is advertised together with the IP address in control messages for routing. By finding the conflict of keys, duplicated IP addresses are detected. This scheme can use a simple rule, but it requires large overhead because key size should be large enough to satisfy the uniqueness. In this paper, we propose a partial-key DAD for the reduction of control overhead. In the partial-key DAD, the original key is divided into several partial keys, and one of them is attached to each control message. We evaluate the performance of the partial-key DAD, and show that it can reduce the control overhead although the resolution time of duplicated IP addresses increases slightly.

The neighbor discovery protocol (NDP) is a stateless protocol facilitating link local communication in IPv6 networks. The nodes employ IPv6 NDP to locate other hosts/routers on the link, cover resolution of link layer addresses, duplicate address detections and track reachability status about paths to active nodes. However, link local communication using NDP is susceptible to some severe attacks, which if neglected leave the network vulnerable. Attackers can spoof source addresses of legitimate nodes by forging NDP messages and propel attacks like Denial of Service (DoS) and Man-in-the-Middle (MITM) leading to failure of IPv6 host initialization. To avert this, RFC 3971 advocates employing Secure Neighbor Discovery (SeND) to make the process inviolable. SeND fortifies message tampering, prevents IPv6 address theft, including protection against replay attacks and enable validation of routers on the link. Although SeND is a robust link layer security mechanism, its practical implementation is reported to have serious shortcomings like cryptographic algorithms which impact computational complexity including bandwidth utilization, as such negate their implementation and adoption. Moreover, the protocol itself fails to provide the confidentiality factor in the network. SeND also falls short of mature unabridged implementations in commercial operating systems and network devices. This paper revisits the protocol implementation and reviews its deployment challenges. This article also discusses some feasible proposals and recommendations for facilitating practical deployment of SeND in IPv6 networks including resource constrained devices like mobile phones.

Internet protocol (IP) auto-configuration in mobile ad hoc networks (MANETs) has attracted much attention. Efficient duplicate address detection (DAD) schemes should be devised to provide each node with its unique address in the network. Generally, DAD schemes can be categorized into two classes: 1) active DAD and 2) passive DAD (PDAD). In this paper, we focus on PDAD schemes over on-demand ad hoc routing protocols. Specifically, we have three goals: 1) improving the accuracy of detecting address conflicts; 2) improving the successful detection success ratio; and 3) reducing the time taken to detect these conflicts. Unlike current approaches, we propose several schemes that exploit additional information, such as sequence number, location, and neighbor knowledge. Simulation results show that our approaches achieve better accuracy and shorter time to detect conflict addresses when compared with existing schemes.

2 - IPv6 Multicasting

The handover technology is one of the most important technologies for the quality of real-time operation. In Hierarchical Mobile IPv6 (HMIPv6), duplicate address detection (DAD) process is necessary for confirming uniqueness of IPv6 address when Mobile Node moves to a new network. It is desirable to reduce DAD delay especially if nodes wish to run real-time application on the mobile IPv6 networks. In this paper, an enhance handover scheme in hierarchical MIPv6 networks by utilizing Passive Duplicate Address Detection (PDAD) to identify duplicate addresses is proposed. Using PDAD, a node examines incoming routing protocol packets to develop hints about address controversies. The simulations are performed using NS-2 to compare the handoff performance. The results show that the proposed scheme can get better performance in terms of packet loss and handoff delay

It is important to analyze link status changes in mobile ad hoc networks (MANETs) since the wireless channel is affected by multiple sources of interference. Scalability is a major research topic in the development of MANET routing algorithms, since the network resource of MANET is limited due to the contention-based wireless communication channel. This paper proposes to adopt a dominant pruning (DP) algorithm, instead of using the conventional blind flooding in AAPs, to reduce the broadcasting redundancy in MANET address auto-configuration protocol (AAP) in the status of link change. A novel method to enable AAP to attain routing capability, by suggesting new messages, is proposed. Simulation demonstrates that the performance improves when the conventional AAPs such as Strong DAD, Weak duplicate address detection (DAD) with proactive routing protocols (WDP), Weak DAD with on demand routing protocols (WDO) and MANET conf are replaced with the proposed algorithms.

Scalability is a major research topic in the development of MANET routing algorithms. The network resource of a mobile ad hoc network (MANET) is limited, due to the contention-based wireless communication channel. Instead of using the conventional blind flooding in AAPs, this paper proposes to adopt a dominant pruning (DP) algorithm to reduce the broadcasting redundancy in MANET address autoconfiguration protocol (AAP). A novel method to enable AAP to enhance routing capability by suggesting new messages is proposed. Simulation demonstrates that performance improves when the conventional AAPs, such as strong DAD, weak duplicate address detection (DAD) with proactive routing protocols (WDP), weak DAD with on demand routing protocols (WDO) and MANETconf, are replaced by the proposed algorithms.

The paper proposes an IPv6 address configuration scheme for wireless sensor networks. In the scheme, one wireless sensor network is divided into multiple clusters and the scheme creates the IPv6 address formats for the cluster heads and the cluster members respectively. Based on the proposed IPv6 address format, the scheme proposes to adopt the division method of the hash function to allocate the IPv6 addresses for the cluster heads and cluster members and to utilize linear probing to deal with assigned address collision. From the perspectives of duplicate address detection cost, address configuration cost and address configuration delay time, the paper analyzes and compares the performances of Strong DAD, MANETConf and the proposed scheme. Analytical results demonstrate the effectiveness and efficiency of the proposed scheme. Copyright © 2010 John Wiley &amp; Sons, Ltd.

Duplicate Address Detection (DAD) is one of the most interesting features in IPv6. It allows nodes to connect to a network by generating a unique IP address. It works on two Neighbor Discovery (ND) messages, namely, Neighbor Solicitation (NS) and Neighbor Advertisement (NA). To verify the uniqueness of generating IP, it sends that IP address via NS message to existing hosts. Any malicious node can receive NS message and can send a spoof reply, thereby initiates a DoS attack and prevents auto configuration process. In this manner, DAD is vulnerable to such DoS attack. This study aims to prevent those malicious nodes from sending spoof reply by securing both NS and NA messages. The proposed Advanced Bits Security (ABS) technique is based on Blake2 algorithm and introducing a creative option called ABS field that holds the hash value of tentative IP address and attached to both NA and NS message. We expect the ABS technique can prevent spoof reply during DAD procedure in link local network and can prevent DoS attack