SNMP-based Network Security Management

This paper presents Virtual-Machines-MIB, a MIB (Management Information Base) directed to virtual machines management through SNMP (Simple Network Management Protocol). Virtual-Machines-MIB aims to define a standard interface of virtual machines management, allowing the management of several virtual machines monitors, like Xen, KVM and VMWare, with a common SNMP management tool. Different from previous virtual machines management MIBs, which allows the manager to perform only monitoring operations, Virtual-Machines-MIB allows to perform control operations, like create, delete, restart, turn on, pause and shut down virtual machines. It is also possible to use the proposed solution to change a virtual machine's name, amount of RAM, virtual CPU's and virtual storage drives. Practical results are presented using ordinary SNMP management tools performing KVM and Xen management. To do this, SNMP agents which support Virtual-Machines-MIB were developed and installed on KVM and Xen hosts. These SNMP agents are based on NET-SNMP public domain's agent, that was extended to support Virtual-Machines-MIB using libvirt API.

Today few organizations have a thorough understanding of what is on their networks at any given time. This study tries to develop Computer and Network Asset Manager (CNAM) that is a network management application which helps large enterprises, and Small medium enterprises (SMEs) service providers, manage their data centers and IT infrastructure efficiently and cost effectively. CANM collects information on all hardware components of the network instruments that are on the network. In this project, a real-time network monitoring method is suggested for dynamic information to reduce the complexity and cost based on network management. In the proposed method, a Simple Network Management Protocol (SNMP) is first used to collect data for start interaction between equipment in the specific data center, to gather these data SNMP would need to request it from Management Information Base (MIB) that served as a database for stored information. Furthermore, to ensure data authenticity in the management station that fetches real-time data periodically from equipment, network engineer would have to manually key-in static information into CNAM when it was first launched. The SNMP would then pick up on this stored static information and automatically began collecting real-time data; this feature will be developed with the help of Model View Controller (MVC) pattern that is a software pattern for implementing user interfaces. It allows users to have interaction with the CNAM as well as input the related data. The object oriented approach shall be used to implement SNMP and MIB which represents system management information. Web Based Enterprise Management (WBEM) is required in order to transfer protocol like SNMP, as well as to enter the actual data manually for further authenticity with the real time data. This study would hopefully encourage companies to try an interactive solution for problem in managing their equipment in the data center.

The Remote network-MONitoring (RMON) standard is a valuable addition to the Simple Network Management Protocol (SNMP), providing network managers with important global network information. Unlike SNMP agents, RMON agents operate in promiscuous mode and process all packets traversing the local net. The RMON management information base (MIB) supplements the SNMP MIB-II standard MIB. We present common network problems that cannot be solved using existing MIB-II or RMON objects. To solve these problems, we develop extensions to the RMON matrix group to gather network layer statistics that result in a view of packet traffic beyond the local network. Our extensions increase the ability to analyze and solve network configuration problems and perform troubleshooting. We demonstrate our results by implementing and analyzing two “live” internetworking problems. Data collected from these experiments showed that network traffic patterns can be isolated by individual subnets, thus more easily identifying sources of congestion.

It is difficult to implement an efficient detection approach for Intrusion Detection Systems (IDS) and many factors contribute to this challenge. One such challenge concerns establishing adequate boundaries and finding a proper data source. Typical IDS detection approaches deal with raw traffics. These traffics need to be studied in depth and thoroughly investigated in order to extract the required knowledge base. Another challenge involves implementing the binary decision. This is because there are no reasonable limits between normal and attack traffics patterns. In this paper, we introduce a novel idea capable of supporting the proper data source while avoiding the issues associated with the binary decision. This paper aims to introduce a detection approach for defining abnormality by using the Fuzzy Rule Interpolation (FRI) with Simple Network Management Protocol (SNMP) Management Information Base (MIB) parameters. The strength of the proposed detection approach is based on adapting the SNMP-MIB parameters with the FRI. This proposed method eliminates the raw traffic processing component which is time consuming and requires extensive computational measures. It also eliminates the need for a complete fuzzy rule based intrusion definition. The proposed approach was tested and evaluated using an open source SNMP-MIB dataset and obtained a 93% detection rate. Additionally, when compared to other literature in which the same test-bed environment was employed along with the same number of parameters, the proposed detection approach outperformed the support vector machine and neural network. Therefore, combining the SNMP-MIB parameters with the FRI based reasoning could be beneficial for detecting intrusions, even in the case if the fuzzy rule based intrusion definition is incomplete (not fully defined).

This paper proposes a system architecture design for the Internet of Things (IoT) implemented in temperature and relative humidity measurement using DHT 11 temperature and humidity sensor. Simple Network Management Protocol (SNMP) is used to manage different network devices and transfer information so that the ESP32 Wi-Fi microcontroller connected to the sensor can communicate with Open Platform Communication (OPC) server. In addition, the network variables are identified by Object Identifiers (OIDs) then collected to Management Information Base (MIB). These two elements are required by the SNMP monitoring tool for enabling the user to monitor network infrastructure and run troubleshooting. Data acquired from the ESP32 Wi-Fi microcontroller are accumulated on the OPC server using SNMP and subsequently transferred to the OPC Client such as Human Machine Interface (HMI) and OPC data logger. The OPC server has a ping channel feature to determine network latency measured as a round trip time – the time taken for data to get its destination and back again. Later on, the ESP32 microcontroller was also connected to a mobile application via Wi-Fi for displaying real-time data simultaneously with the HMI. The SNMP network latency test on the proposed system architecture design results in 126,33 ms for 13 minutes without a corrupt packet of data. The result indicates SNMP can be used as an alternative protocol for IoT data communication.

To develop a network management system (NMS) more easily, the authors developed an application programming interface (API) for configuring network devices. Because this API is used in a Java development environment, an NMS can be developed by utilizing the API and other commonly available Java libraries. It is thus possible to easily develop an NMS that is highly compatible with other IT systems. And operations that are generated from the API and that are exchanged between the NMS and network devices are based on NETCONF, which is standardized by the Internet Engineering Task Force (IETF) as a next-generation network-configuration protocol. Adopting a standardized technology ensures that the NMS developed by using the API can manage network devices provided from multi-vendors in a unified manner. Furthermore, the configuration items exchanged over NETCONF are specified in an object-oriented design. They are therefore easier to manage than such items in the Management Information Base (MIB), which is defined as data to be managed by the Simple Network Management Protocol (SNMP). We actually developed several NMSs by using the API. Evaluation of these NMSs showed that, in terms of configuration time and development time, the NMS developed by using the API performed as well as NMSs developed by using a command line interface (CLI) and SNMP. The NMS developed by using the API showed feasibility to achieve “autonomic network management” and “high interoperability with IT systems.”

Modern communication networks cannot get along without quality of service (QoS) assurance. QoS-support mechanisms offer preferential treatment for specific traffic classes that is required especially by real-time network applications. Unfortunately current QoS technologies have certain disadvantages and limitations and therefore they are not always able to guarantee the required QoS level. This paper introduces a quality of service support system that improves the most often used quality of service support technology called Differentiated Services (DiffServ). The system proposed utilizes the Simple Network Management Protocol (SNMP) for the acquisition of configuration information from the edge router of the DiffServ domain. This information is subsequently used to control the allocation of network resources within the QoS assurance process. In order to evaluate this system we used the OPNET Modeler simulation environment where we built a simulation scenario able to interact with real network components. For this purpose we implemented the SNMP protocol into the OPNET Modeler and used it for acquisition of management information, stored in the Management Information Base (MIB) of the network node. The paper describes in details the improved QoS-support mechanism and the simulation model able to cosimulate the behavior of both real and virtual network elements.

Basic Security Concepts - Why is Computer and Network Security Important. Background and History. The Security Trinity. Information Security. Risk Assessment. Security Models. Basic Terminology. More Basic Terminology. Threats, Vulnerabilities and Attacks - Protocols. The OSI Reference Model. TCP/IP Protocol Suite. Useful Web Sites. Search Engines. Mailing Lists. Encryption, Digital Signatures and Certification - Cryptography. Stream Ciphers. Breaking Ciphers. Block Ciphers. Encryption. Public Key Cryptosystems. Message Integrity. Authentication. Digital Signatures. Competing Standards. Digital Certificates. Limitations of Digital Certificates. Certificate Authorities. Public Key Infrastructure. The Future. The Limitations of Encryption. Kerberos - How Kerberos Works. Kerberos- Limitations. Encryption on the WWW - The World Wide Web. Secure Sockets Layer (HTTPS). Secure HTTP (SHTTP). Microsoft's Internet Explorer. Viewing Digital Certificates with Internet Explorer. Viewing the Encryption Strength of IE5. Viewing Certification Authorities with IE5. Netscape Navigator. Viewing Digital Certificates with Navigator. Authenticode Certificates. E-Mail - E-Mail Issues. E-Mail Issues. Secure E-Mail Protocols. Web-Based E-Mail Services. Security of Stored Messages. Identity: Spoofing and Hiding. E-Mail as a weapon. E-Mail Policies. E-Mail Privacy. Auto-Responses. Operating System Security -- Passwords. Password Attacks. Onetime Passwords. Access Control. Data Redundancy. General Recommendations. Modems. Useful Tools. LAN Security - LAN Guidelines. Controlling End-User Access. Concurrent Logins. Available Disk Space. Restrictions to Location or Workstation. Time/Day Restrictions. Access to Directories and Trustee Rights. File Attributes. Other Privileges. Single Sign-On. Policy-Based Network Management. Honeypot Systems. Network Segmentation. Static IP Addresses vs. DHCP. Media and Protocols - Network Media. Plenum Cabling and Risers. WANs. Redundancy and Alternative Connections. Routers and SNMP - Router Issues. SNMP. Virtual Private Networks - Encryption on the Network. Node-to-Node Encryption. End-to-End Encryption. Where to Encrypt. Virtual Private Networks. PPTP. L2TP. IPSec. SOCKS. Firewalls - Firewalls Pros and Cons. Types of Firewalls. Packet Filters vs. Proxies. Firewall Configurations. Restricting Users' Access to the Internet. Firewall Products. Personal Firewalls. Biometrics - Identification and Authentication. Biometric Identification and Authentication. Biometric Identification Reliability. Backup Authentication. Environmental Conditions. User Acceptance. Security of the Biometric System. Interoperability. Costs vs. Savings. Policies and Procedures - Policies vs. Procedures. Information Security Policy Objectives. Developing Security Policies. Policy and Procedure Manuals. Policy Awareness & Education. Policy Enforcement. Policy Format. Security Policy Suggestions. Information Protection Team. Crisis Management Planning. Sources for Information Policies. Auditing and Intrusion Detection - What is an Audit. Operational Security Audits. System Security Auditing. Activity and Usage Auditing. Audit Mistakes. Deficiencies of Traditional Audit Techniques. Intrusion Detection. Intrusion Detection Systems. Host-Based Intrusion Detection Systems. Network-Based Intrusion Detection Systems. Knowledge-Based Intrusion Detection Systems. Statistical-Based Intrusion Detection Systems. Defense In-Depth Approach . Future Directions. Crisis Management Planning - Crisis Management. Disaster Recovery Planning. Computer Security Incident Response Plan. Browser Security - Cookie Files. Cache Files. Autocomplete.

Wireless Sensor Networks (WSNs) have attracted significant research interest in recent years because of their suitability to a wide range of real world applications. The envisioned Internet Protocol (IP) support for WSNs requires interoperability with existing management solutions, like Simple Network Management Protocol (SNMP), in order to provide remote management functionality and assure the correct operation of the WSN. It is essential to provide a network management system that is interoperable with standard network management solutions, customizable, and extensible to various WSN applications. In this paper we present work in progress on our EmNetS Network Management Protocol (EMP), a lightweight and SNMP-compliant IP-based WSN (IP-WSN) management solution. We present detailed operational architecture and a Management Information Base (MIB) which is extensible to IP-WSN applications. We also present implementation details and preliminary results from our laboratory testbed.

Two alternative customer network management (CNM) access configurations for the user's network management station to access a public carrier's CNM system using the simple network management protocol (SNMP) are described. In addition, a management information base containing UNI management information is developed along with CNM service capabilities that enable permanent virtual connection (PVC) service users to manage their access to and use of the B-ISDN transport network and services. The CNM service capabilities support proactive management tools that alert PVC service users to developing problems in their communications network of which the B-ISDN network and services are parts and enable users to take corrective action to avoid a network collapse.< <ETX xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">&gt;</ETX>

SHAMAN (Spreadsheet-based Hierarchical Architecture for MANagement) is a novel management framework developed at the University of Delaware; it extends the traditional flat SNMP (simple network management protocol) management model to a hierarchical architecture. Effective management of battlefield networks requires such a hierarchical management architecture wherein managers can dynamically delegate management tasks to intermediate managers. The SHAMAN framework includes a spreadsheet-based intermediate manager with a scripting language and MIB (management information base), a polling subsystem and an event model; a prototype implementation of the system is available (see http://www.cis.udel.edu//spl sim/shaman). Our research has explored several applications of the SHAMAN system to tactical battlefield networks for the US Army. Described applications include a location management application, an application to reconfigure the dynamically changing topology of tactical internets, and another application to interface with OPNET simulations of battlefield networks.

This document describes the View-based Access Control Model (VACM) for use in the Simple Network Management Protocol (SNMP) architecture. It defines the Elements of Procedure for controlling access to management information. This document also includes a Management Information Base (MIB) for remotely managing the configuration parameters for the View-based Access Control Model. This document obsoletes RFC 2575.

Since the Internet of Things (IoT) will be entwined with everything we use in our daily life, the consequence of security flaws escalates. Smart objects will govern most of the home appliances and car engines yielding potential disaster scenarios. In this context, successful attacks could lead to chaos and scary scenarios (www.darkreading.com). Unprotected personal information may expose sensitive and embarrassing data to the public and attacks may threaten not only our computers and smart devices, but our intimacy and perhaps our lives too. Because persons and objects will be bonded with each other, user consent becomes critical. Therefore, thing, object, and user Identity will be the focus of future IoT security solutions, yielding a Trust, Security, and Privacy (TSP) paradigm, which may constitute the Achilles' heel of IoT. While security issues are quite straightforward, mainly from background knowledge, privacy issues are far more complex. Privacy constitutes a rather challenging task, even for the m...

There have been several attempts in the past to secure the Simple Network Management Protocol (SNMP). Version 3 of the SNMP protocol introduced a User-based Security Model (USM) which comes with its own user and key-management infrastructure. However, many operators are reluctant to introduce a new user and key management infrastructure just to secure SNMP. This paper describes how the Secure Shell (SSH) protocol can be used to secure SNMP and it provides a performance analysis of a prototype implementation which compares the performance of SNMP over SSH with other secure and insecure versions of SNMP.

With the rapid development of machine learning and Internet technology, the combination of the two methods is well appreciated recently.An anomaly and intrusion detection system is a mechanism that monitors network or system activities for malicious activities.Intrusion detection and prevention systems are primarily focused on identifying possible incidents, logging information about them and reporting attempts.As far as other usages of Intrusion detection and prevention systems are concerned, such as identifying problems with security policies and deterring individuals from violating security policies.Anomaly detection systems are becoming an important addition to the security infrastructure of nearly every organization.In this paper, we propose a novel mechanism for real-world traffic and research there cases with theoretical analysis.