Misbehavior Detection and Mitigation on 5G Core Services in Kubernetes

Wireless sensor networks (WSNs) are increasingly being used for data monitoring and collection purposes. Typically, they consist of a large number of sensor nodes that are used remotely to collect data about the activities and conditions of a particular area, for example, temperature, pressure, motion. Each sensor node is usually small, inexpensive, and relatively easy to deploy compared to other sensing methods. For this reason, WSNs are used in a wide range of applications and industries. However, WSNs are vulnerable to different kinds of security threats and attacks. This is primarily because they are very limited in resources like power, storage, bandwidth, and processing power that could have been used in developing their defense. To ensure their security, an effective Intrusion detection system (IDS) need to be in place to detect these attacks even under these constraints. Today, traditional IDS are less effective as these malicious attacks are becoming more intelligent, frequent, and complex. Denial of service (DOS) attack is one of the main types of attacks that threaten WSNs. For this reason, we review related works that focus on detecting DoS attacks in WSN. In addition, we developed and implemented several Deep learning (DL) based IDS. These systems were trained on a specialized dataset for WSNs called WSN-DS in detecting four types of DoS attacks that affects WSNs. They include the Blackhole, Grayhole, Flooding, and Scheduling attacks. Finally, we evaluated and compared the results and we discuss possible future works.

IEEE Std 802.11i [1] has specified the security functionality of wireless local area networks (WLANs). However, two types of DoS attacks have been disclosed which could block the 4-way handshake procedure [2]. Some improvements over them have been investigated. But all of them have obvious drawbacks. In this paper, we address the security issue in WLANs and analyze the operations of the 4-way handshake protocol. Based on the insight of the protocol and the existing potential vulnerabilities under the DoS attacks, we propose an enhancement solution to protect the protocol from DoS attacks. Compared with other existing works, our solution is more effective and efficient. Colored Petri Nets (CPN) has been employed to formally verify our solution.

Nowadays, Network Address Translation (NAT) is widely used to allow multiple devices within a private network to make use of a less number of public IP addresses. NAT Overloading or Port Address Translation (PAT) is an extension of NAT that can translate both the IP address and the port number of a packet in order to identify which inside local address each packet belongs to. PAT is often used in a virtual environment, where multiple virtual machines are connected to the Internet by using the host machine's IP address. However, an apparent downside of PAT is the fact that when all of the ports are used, no more new outbound connection could be made from the local addresses. In this paper, we present Slow-port-exhaustion DoS Attack on a virtual network, a new type of DoS Attack that exploits some flaws of the TCP protocol. In this attack, a compromised internal virtual machine with a low amount of attack bandwidth can occupy host machine's ports for a long time and therefore makes other machines on the same virtual network could not connect to the external network. We created a virtual network with PAT implemented gateway and perform the experimental attack. In the analysis, we explore a gateway's behavior that could benefit this kind of attack. We also introduce some countermeasures against this kind of attack.

LDoS (low-rate denial-of-service) was a new type of DoS attack. In this paper, LDoS attack traffic was simulated on OPNET platform and generated by estimating the retransmission time out (RTO) of normal TCP flow based on the analysis of LDoS attack features, and the performance of targets under the attacking of LDoS was tested. We investigated the cache queue of target router for the purpose of detection and defense of LDoS attack. Test result show that two criterions -- packet percentage and threshold--can detect LDoS attack flows.

Jellyfish attack is type of DoS attack which is difficult to detect and prevent. Jellyfish attack is categorized as JF Reorder Attack, JF Periodic Dropping Attack and JF Delay Variance Attack. JF attack delay data packets for some amount of time before forwarding and after reception which results high end-to-end delay in the network. JF Attack disrupts whole functionality of transmission and reduces the performance of network. In this paper difference of receive time and sending time greater than threshold value then delay occur due to congestion or availability of JF nodes that confirm by checking load of network. This way detect and prevent jellyfish attack.

Denial of Service attacks are one of the most annoying day to day challenges for any security expert and IT professional. This is according to the attack nature. It can be run against any kind of network resources, whether exposed to the Internet or internally in a corporate network, regardless of the type of service it provides and its role in the network. There is no one complete solution or unified framework method against this type of attack. The most dangerous type of DoS attack is the DDoS type. The attack flow from many sources at the same time. In the context of mitigation from DDoS attack, the detection mechanisms are the first step in the way. Mechanisms like IPS and firewall are not effective because of the current challenging DDOS attack methods against application layer. The attackers use vulnerability in the application itself to disrupt the service it provides. Current mitigation techniques depend on preventing the attack traffic from reaching web servers. In this paper we study http application layer DDoS attacks against web servers. We propose new approach for mitigation that depends on absorbing the attack effects on the web server and increases server’s resistance against DDoS attacks.

With successful machine learning applications in many fields, researchers tried to introduce machine learning into intrusion detection systems for building classification models. Although experimental results showed that these classification models could produce higher accuracy in predicting network attacks on the offline datasets, compared with the operational intrusion detection systems, machine learning is rarely deployed in the real intrusion detection environment. This is what we call the last mile problem with the machine learning approach to network intrusion detection, the discrepancy between the strength and requirements of machine learning and network operational semantics. In this paper, we aim to bridge the aforementioned gap. In particular, an LCC-RF-RFEX feature selection approach is proposed to select optimal features of the specific type of attacks from dataset, and then, an intrusion-specific approach is introduced to convert them into detection patterns that can be used by the nonmachine-learning detector for the corresponding specific attack detection in the real-world network environment. To substantiate our approach, we take Snort, KDDCup’99 dataset, and Dos attacks as the experimental subjects to demonstrate how to close the last-mile gap. For the specific type of Dos attacks in the KDDCup’99 dataset, we use the LCC-RF-RFEX method to select optimal feature subset and utilize our intrusion-specific approach to generate new rules in Snort by using them. Comparing performance differences between the existing Snort rule set and our augmented Snort rule set with regard to Dos attacks, the experimental results showed that our approach expanded Snort’s detection capability of Dos attacks, on average, reduced up to 25.28% false-positive alerts for Teardrop attacks and Synflood attacks, and decreased up to 98.87% excessive alerts for Mail bomb attacks.

Code dissemination protocols provide a convenient way to update program images via wireless communication. Due to the open environment in which Wireless Sensor Networks (WSNs) are typically deployed, it is important that a code dissemination protocol ensures that a program image update can be authenticated as coming from a trusted source. In some applications it is also required that the data be kept confidential in spite of the possibility of message interception. Authentication and confidentiality are implemented through cryptographic operations which may be expensive in power consumption, making a protocol with these features vulnerable to attack by an adversary who transmits forged data, forcing nodes to waste energy in identifying it as invalid i.e., a signature-based DoS attack). Additionally, in multi-hop dissemination protocols, each sensor node is required to broadcast its program image when requested by its neighbors. An adversary could repeatedly send spurious program image requests to its neighbors, making them exhaust their energy reserves i.e., request-based DoS attack). In this paper, we present a new approach to achieve confidentiality in multi-hop code dissemination. We propose counter-measures against both types of DoS attacks mentioned above. To our knowledge, we are the first to integrate confidentiality and DoS-attack-resistance in a multi-hop code dissemination protocol. Our approach is based on Deluge, an open source, state-of-the-art code dissemination protocol for WSNs. In addition, We provide a performance evaluation in terms of latency and energy consumption in our scheme, compared with the original Deluge and the existing secure Deluge.

The denial of service attack is the most powerful damaging attacks used by hackers to harm a business or organization. This attack is one of most dangerous cyber-attacks. It causes service outages and the loss of millions, depending on the time of attack. In past few years, the use of the attack has enlarged due to the accessibility of free tools. This tool can be blocked simply by having a good firewall, but an extensive and clever DoS attack can avoid most of the restrictions. A Denial of Service attacks against Web sites occur when a hacker attempts to make the Web server, or servers, unavailable for legitimate users and finally, to take the service slowing them down. This is attained by flooding the server's request queue with fake requests. After this, server will not be capable to handle the requests of genuine users. For some time, it was thought that these types of attacks were generally used against large companies, government sites, and activist sites as a form of protest to interrupt their Web presence. In general, there are two forms of the DoS attack. The first form is on that can crash a server. The second form of DoS attack only floods a service. Online Vulnerability Scanner is a tool which is capable to detect DoS Attack in Web application and compare its performance. We proposed an aegis algorithm which can be used to moderate DoS attack in Web application Vulnerability.

In this paper a new useful model for advertisements dissemination is presented, Using virtual currency to incent nodes disseminate Ads and dynamic window strategy to defend a type of DoS attacks, in which the goal of the adversary is to exhaust the energy of the nodes and to increase their response time to broadcast messages. Besides, the method can also prevent malicious nodes disseminating Ads repeatedly to earn virtual currency. The dynamic window scheme is robust in both incentive and security.

Traditionally telecom networks are monolithic in nature and vertically integrated. Single entity takes care of network deployment as well as service delivery. Internet service provider takes care of identity, access, transport, core and backhaul functions. Such monolithic and vertical integrated architecture lack technical innovation and economic competition. Monolithic architectures are also prone to proprietary interface implementations which leads to non-interoperability among communication layers, leading to cost inefficiency and network non-scalability. Whereas open and disaggregated network architecture induces innovation, competition, scalability and cost efficiency. There is multiple industry led efforts to transform telecom networks into open, disaggregated and federated architecture. Open RAN in cellular world and OpenRoaming in Wi-Fi world are few of the noticeable efforts. In India, WANI (Wi-Fi Access Network Interface) is one such disaggregated and federated public Wi-Fi initiative where identity, access, core and backhaul functions are unbundled and offered by independent entities, evolving the ecosystem as a federation. Interoperability among these functions is ensured through a secure exchange of well-defined federation protocols i.e., wani tokens. Disaggregation and federation also add up the network complexity. Enabling roaming in such disaggregated and federated network poses multiple technical challenges. Roaming in telecom network enables a compelling business case for the service providers as well as improve network usability for the end users. In this paper, we present current WANI technical framework, learning from initial deployment, existing technical gaps, ongoing efforts to standardize the architecture and a novel architecture choice for efficient roaming in such network.

The advancement in communication technologies has enabled ad hoc networks to collect large volumes of information. This information is vulnerable to various types of attacks amongst which false information dissemination and on-off attacks offer biggest threats to the networks. As the data in ad hoc networks depends on the events, it is necessary for any detection mechanism to first determine the true events. Then the information about these events can be used to judge the behavior of the senders. Therefore, in this work, the correct event is first learned using information from different sources including the observations of the receiver itself. This information is later used to learn the behavior of the senders. The learned behavior combined with the opinions of the neighbors about the sender allows the detection of malicious and honest nodes. In this work, a logistic trust model is used to combine the observed behavior and opinions. It is observed that logistic trust results in a high accuracy of over 99% and a low error of less than 1% even when the events are changing rapidly. It is also shown that the scheme can detect malicious majority and identify true events with high probability.

Location spoofing is a proven and powerful attack against Vehicle-to-everything (V2X) communication systems that can cause traffic congestion and other safety hazards. Recent work also demonstrates practical spoofing attacks that can circumvent application layer sanity checks. In this paper, we propose three novel physical layer plausibility checks that leverage the received signal strength indicator (RSSI) of basic safety messages (BSMs). These plausibility checks have multi-step mechanisms to improve not only the detection rate, but also to decrease false positives. These checks can be run independently by each vehicle and do not rely on the assumption that the majority of vehicles is honest. We comprehensively evaluate the performance of these plausibility checks using the VeReMi dataset (which we enhance along the way) for several types of attacks. We show that the best performing physical layer plausibility check among the three considered achieves an overall detection rate of 83.73% and a precision of 95.91%, far outperforming recently proposed machine learning-based misbehavior detection methods operating at the application layer.

This paper explains how the commonly occurring DOS and Brute Force attacks on computer networks can be efficiently detected and network performance improved, which reduces costs and time. Therefore, network administrators attempt to instantly diagnose any network issues. The experimental work used the SNMP-MIB parameter datasets, which are collected via a specialised MIB dataset consisting of seven types of attack as noted in section three. To resolves such issues, this researched carried out several important contributions which are related to fault management concerns in computer network systems. A central task in the detection of the attacks relies on MIB feature behaviours using the suggested SFCM method. It was concluded that the DOS and Brute Force fault detection results for three different clustering methods demonstrated that the proposed SFCM detected every data point in the related group. Consequently, the FPC approached 1.0, its highest record, and an improved performance solution better than the EM methods and K-means are based on SNMP-MIB variables.

Software-defined networking (SDN) is a network technology that aims to make the network more flexible and centralized. The main aim of the architecture is decoupling of network and control plane which enables the network control to be programmed and hence the forwarding devices are abstracted from higher application services. However, before this technology evolves on a large scale, it is important to understand the vulnerabilities associated with it. The agenda for this paper is to study the different types of attacks on the three layers of the OpenFlow protocol and the possible mitigation strategies to reduce the impact of those attacks on the network, implement SDN network which consists assorted topologies connecting numerous hosts, switches, and controllers. The implemented framework monitors the various events occurring in the network, identifies malicious events causing DoS attack, and mitigates the same. Through implementation, we elaborate different ways of making SDN more secure.