Learning agent-based security schema mitigating man-in-the-middle attacks in fog computing

Multipath TCP (MPTCP) is a backward compatible extension of Transmission Control Protocol (TCP) designed to let an application send data over several TCP connections, usually called subflows. MPTCP presents several opportunities over legacy TCP, especially when these subflows follow disjoint paths: for instance bandwidth aggregation or seamless mobility across networks. While MPTCP is built as an extension of TCP, the scope of the modifications qualifies it almost as a new protocol. This means traditional TCP tools are not enough to analyze MPTCP performance. We thus develop and present an open source application able to analyze MPTCP specific metrics such as the aggregated goodput or inter-subflow retransmissions.

Multipath Transmission Control Protocol (MPTCP) is a new transmission protocol designed by The Internet Engineering Task Force (IETF) for multipath transmission. In order to realize the large-scale and rapid deployment of MPTCP, the design of MPTCP needs to ensure fairness with traditional Transmission Control Protocol (TCP). The IETF organization designed a congestion control algorithm for the network fairness of MPTCP, but did not consider the bottleneck fairness of MPTCP. In this paper, we propose a congestion control algorithm based on Dynamic Time Warping (DTW) and Bottleneck Bandwidth and Round-trip time (BBR), which takes the bottleneck fairness in consideration for higher transmission efficiency. The experiments validate that the proposed algorithm can improve the recognition rate of shared bottlenecks, increase bandwidth utilization, and ensure fairness at the bottleneck.

Today's laptops and mobile terminals are equipped with several network interfaces belonging to different access technologies. Users can benefit from multi-homing to access network services anywhere, at any time and from any network. Multipath TCP (MPTCP) is a modified version of Transmission Control Protocol (TCP) which allows a TCP connection to simultaneously send data over multiple paths. One of the objectives of MPTCP is to improve the throughput of TCP connection. A MPTCP connection over multiple paths should achieve a no worse throughput than a single TCP connection over the best constituent path. In this paper, we evaluate the performance of MPTCP in terms of throughput optimization and load sharing. The measurements show that the context of heterogeneous networks (Ethernet, Wifi and 3G) has a great impact on the MPTCP performances and reveal the need of an intelligent algorithm for interface selection in MPTCP.

A significant enhancement in recent communication systems is Satellite Communications. The performance improvement of the transmission control protocol (TCP) in satellite communications has been an active research area. Multipath TCP (MPTCP) ensures a robust solution than the regular TCP. However, the performance degradation in satellite networks due to the link asymmetry, high loss and high latency cannot distinguish the packet losses caused by network congestions from the losses properly. In this paper, a round-trip time detection-based algorithm is proposed using available bandwidth estimation (ABE) to mitigate the issue of blind decreasing of congestion window upon detecting the packet loss over lossy satellite networks. Experiments are done using the NS-2 network simulator to compare the various congestion control algorithms of both TCP and MPTCP over satellite networks. Simulations results from the experiments show that our proposed algorithm outperforms the existing algorithms which are mentioned in this article.

The contemporary world, dominated by information technologt (IT), necessitates sophisticated protection mechanisms against attacks that pose significant threats to individuals, companies, and governments alike. The unpredictability of human behavior, coupled with the scattered development of applications and devices, complicates supply chain maintenance, making it impossible to develop a system entirely immune to cyberattacks. Effective execution of many attack types hinges on prior network reconnaissance. Thus, hindering effective reconnaissance serves as a countermeasure to attacks. This paper introduces a solution within the moving target defense (MTD) strategies, focusing on the mutation of Internet protocol (IP) addresses in both edge and core network switches. The idea of complicating reconnaissance by continually changing IP addresses has been suggested in numerous studies. Nonetheless, previously proposed solutions have adversely impacted the quality of service (QoS) levels. Implementing these mechanisms could interrupt Transmission Control Protocol (TCP) connections and result in data losses. The IP address mutation algorithms presented in this study were designed to be fully transparent to transport layer protocols, thereby preserving the QoS for users without degradation. In this study, we leveraged the benefits of software-defined networking (SDN) and the Programming-Protocol-Ondependent Packet Processors (P4) language, which specifies packet processing methodologies in the data plane. Employing both SDN and P4 enables a dynamic customization of network device functionalities to meet network users’ specific requirements, a feat unachievable with conventional computer networks. This approach not only enhances the adaptability of network configurations but also significantly increases the efficiency and effectiveness of network management and operation.

Recently, requirement of ubiquitous availability and increase of mobile user driving traffic has become a serious problem. On the other hand, most mobile equipment have more than one network interface and a host can use multiple network interfaces simultaneously with multi-homing technology. Therefore, multiple paths are utilized for data transfer in one pair of terminals. This is a Con-current Multi-path Transfer (CMT). It makes acquire improved bandwidth and resilience just by modifying previous transport layer protocol like TCP (transmission control protocol). TCP is the most common transport layer protocol in Internet applications. Accordingly, IETF have proposed Multi-path TCP (MPTCP) that previous single-TCP with multi-homing technology. However, when transmit the packet using different two path which has dissimilar characteristic simultaneously, there is some throughput degradation compared to single-TCP that shows best performance. The reason is that out-of-ordered packet is generated because each path has different bandwidth, delay and packet loss rate. To solve these problems, this research proposes reordering considered packet scheduling algorithm at the sender. Main idea of the proposed scheme is estimating packet receiving time at the receiver and scheduling packet. By using proposed algorithm, the number of out-of-ordered packet in the receiver buffer is reduced. Therefore, performance degradation is also mitigated especially in the case that asymmetry between two path is severe.

With the increased frequency and intensity of denial-of-service (DoS) attacks on critical cloud-hosted services, resource adaptation schemes adopted by the cloud service providers (CSPs) need to be intelligent. Specifically, they need to be adaptable to attack behavior and be dynamic to curb resource over-utilization. The concept of moving target defense (MTD) has recently emerged as an effective and agile defense mechanism against DoS attacks that particularly target cloud-hosted applications. However, the existing surveys that seek to explore this space either focus more on MTD for generic cyberattack mitigation or on DoS attack defense on cloud systems. In this survey, we particularly provide an in-depth analysis on how MTD can help recover critical cloud assets in the face of DoS attacks and how emerging programmable technologies such as software-defined networking (SDN) can be leveraged to achieve that goal. Unlike existing surveys, we categorize DoS attacks on cloud platforms based on their working mechanism. We also discuss the non-MTD-based DoS defense strategies for both cloud and non-cloud infrastructures in order to highlight the pros and cons of MTD-based strategies. We introduce MTD working mechanisms and present how existing research is envisioning MTD’s application in mitigating DoS attacks, both with and without SDN. We also take an in-depth look at the testbed implementations and resilience and performance evaluations of MTD approaches. Finally, we articulate the existing challenges in MTD for DoS mitigation in cloud systems and how these challenges are shaping the future research in this domain.

With the growing demand of Internet services, network operators have put significant efforts to improve network error resilience and efficiency. Since there exist different wired/wireless technologies for Internet access such as digital subscriber line (DSL), Ethernet, and worldwide interoperability for microwave access (WiMax), a mobile host can use multiple access networks simultaneously with multipath transmission. Taking the advantage of heterogeneous environment, multipath transmission through the Internet can improve service reliability and network flexibility. Ensuring a reliable end-to-end connection oriented communication with satisfactory quality of service (QoS) and maintaining congestion control and flow control are the main responsibilities of the Transmission Control Protocol (TCP), the dominant transport layer protocol in the Internet. In this paper, we survey the state-of-the-art of multipath transmission techniques for QoS provisioning in wireless Internet access, focusing on the end-to-end transport layer protocols. The main challenges for the design of multipath TCP are reviewed, and the existing transport layer congestion control schemes are categorized. Multipath TCP and stream control transmission protocol (SCTP)-based transport layer protocols are discussed, and their limitations and/or impractical assumptions are addressed. Open research issues on the development of an effective, efficient, and practical multipath TCP protocol are summarized.

Intent-Based Networking (IBN) is an emerging networking paradigm while Moving Target Defense (MTD) is an active security technique. In this paper, the Intent-based Moving Target Defense (INMTD) framework using Software Defined Networks is proposed. INMTD is the first effort in exploiting IBN for the design of an efficient Moving Target Defense (MTD) framework. INMTD uses the concept of shadow servers in order to counter the first stage of cyber-attacks, i.e. reconnaissance attacks targeted against servers running in SDN networks. INMTD comprises of an MTD application running on an SDN controller. The MTD application has reconnaissance detection, MTD movement, and MTD monitoring modules. The MTD application is integrated with the intent-based northbound API of SDN controller. INMTD not only provides protection against probing attacks, but it also provides high availability due to shadow servers. The proposed framework was implemented using Mininet and ONOS SDN controller. The proposed framework was assessed in terms of defender cost, attacker’s effort, and introduced complexity in the system. The results substantiate the efficient protection against reconnaissance attacks at lower computational cost.

Network functions virtualization (NFV) offers an alternative way to design, deploy, and manage networking services. This paper presents the implementation and deployment of a virtualized network function to solve MP-TCP’ shared bottlenecks problem. MP-TCP (MultiPath-TCP) is a protocol that allows hosts that have several interfaces to send data through multiple paths in the network. An MP-TCP connection is divided into several TCP connections called subflows that may follow different paths, in this way effective connection rates and resilience can be increased. However, in a scenario where MP-TCP is used with hosts having a single network interface, created subflows follow the same path even if several are available; this generates the problem known as a shared bottleneck. A solution to this problem is implemented as a SDN (Software Defined Networking) module that is integrated into OpenDayLight’s framework which is used as the SDN controller. This solution is then deployed as a NFV over a cloud infrastructure implemented with OpenStack over a high-end physical server. The deployment of the NFV is automated to a certain degree using Ansible, a DevOps tool. Finally, results of the tests of the SDN solution to MP-TCP’s shared bottlenecks and its operation as a NFV using a completely virtualized network are reported.

Space-ground integrated networks (SGINs) have been recently regarded as a promising way to provide resilient, dependable as well as efficient data transmission in the high-speed railway (HSR) scenario. Applying multipath transmission control protocol (MPTCP) to SGIN can realize data transmission simultaneously via terrestrial and satellite networks. However, since the existing congestion control (CC) mechanisms of MPTCP fail to distinguish between adverse influences (such as packet loss and/or round-trip time increase) caused by congestion and those caused by handovers, it suffers severe performance degradation in the HSR scenario where handover frequently occurs. In this article, we first present the SGIN oriented HSR (SGIN-HSR) with MPTCP. Then leveraging cross-layer information (i.e., reference signal received power), we design a novel cross-layer aided MPTCP CC mechanism targeted at SGIN-HSR based on deep reinforcement learning, which is referred to as HSR-CC, to alleviate performance degradation problems induced by handover. The experimental results show that HSR-CC significantly enhances the goodput and outperforms state-of-the-art MPTCP CC algorithms in SGIN-HSR environments where handover frequently occurs.

MP-TCP (MultiPath-Transmission Control Protocol) was designed to use multiple interfaces in hosts; it uses several subflows (a set of regular TCP connections) to increase the performance compared to TCP. However, when a host has only one network interface but several subflows are created, they follow the same path to their destination generating bottlenecks and MP-TCP advantages are lost. This paper presents a solution to the shared-bottleneck problem using SDN (Software Defined Networking). A plugin for OpenDayLight is developed for implementing Dijkstra's Algorithm to find paths and assign them to new subflows avoiding bottlenecks. The solution supports concurrent MP-TCP connections. Results of tests obtained using the implemented plugin in several topologies are presented.

Multipath Transmission Control Protocol (MPTCP) enables multi-homed devices to establish multiple simultaneous routes for data transmission. Congestion Control (CC) is a fundamental mechanism for implementing and designing MPTCP. The Internet of Things (IoT) networks generate a massive volume of heterogeneous traffic with high dimensional states and diverse QoS characteristics. The existing MPTCP CC algorithms are unable to perform efficiently under highly mobile and dynamic IoT environments. We propose a novel model-free SDN-based adaptive actor-critic deep reinforcement learning framework based on a fuzzy normalized neural network to address the issue of CC for MPTCP in the IoT networks. In the proposed method, an agent can learn efficiently and better approximate the state-action value function of the actor and the action function of the critic to adjust the sub-flows congestion windows size adaptively according to the dynamic condition of a network. Simulation results show that the proposed scheme outperforms the state of the art schemes in terms of the goodput under highly-dynamic IoT environments.

Adversary sophistication in the cyber domain is a constantly growing threat. As more systems become accessible from the Internet, the risk of breach, exploitation, and malice grows. To thwart reconnaissance and exploitation, Moving Target Defense (MTD) has been researched and deployed in various systems to modify the threat surface of a system. Tools are necessary to analyze the security, reliability, and resilience of their information systems against cyber-attack and measure the effectiveness of the MTD technologies. Today's security analyses utilize (1) real systems such as computers, network routers, and other network equipment; (2) computer emulations (e.g., virtual machines); and (3) simulation models separately. In this paper, we describe the progress made in developing and utilizing hybrid Live, Virtual, Constructive (LVC) environments for the evaluation of a set of MTD technologies. The LVC methodology has been most rooted in the Modeling & Simulation (MS) work of the Department of Defense. With the recent advances in virtualization and software-defined networking, Sandia has taken the blueprint for LVC and extended it by crafting hybrid environments of simulation, emulation, and human-in-the-loop. Furthermore, we discuss the empirical analysis of MTD technologies and approaches with LVC-based experimentation, incorporating aspects that may impact an operational deployment of the MTD under evaluation.

Cloud computing data services have extremely high requirements for transmission performance in high-concurrency and heterogeneous network environments, while traditional single-path transmission mechanisms are difficult to fully utilize the multi-link resources in the cloud-edge collaborative architecture. This paper proposes a deep reinforcement learning (DRL) strategy for cloud-edge multi-path transmission in cloud computing data services. By constructing a state-action-reward model, it realizes dynamic perception and decision optimization of link bandwidth, latency, packet loss rate, and congestion level. The method includes: (1) establishing a cloud-edge collaborative multi-link environment model and performing real-time sampling and normalization of link feature parameters; (2) designing an agent based on a double deep Q-network (DDQN) to learn the policy of transmission path and data allocation ratio; (3) improving learning efficiency through a prioritized experience replay mechanism; and (4) combining an adaptive reward function to achieve a balance between throughput and latency in the system. Experiments were conducted in simulated and real-world deployment environments. Compared with the traditional Multipath Transmission Control Protocol (MPTCP) and the optimization scheme without reinforcement learning, the proposed method improves the average throughput by about 28.3% and reduces the end-to-end latency by about 15.4% compared with MPTCP, while achieving a link utilization of 92%, demonstrating superior dynamic decision-making and self-optimization capabilities.