近些年来,分布式拒绝攻击DDoS(Distributed Denial of Service)因其实施简单、破坏力及危害性巨大,已经成为目前网络安全中最大的威胁之一,如何有效的防范DDoS攻击、减少DDoS攻击带来的危害已成为当前的研究热点。本文重点分析了基于包...近些年来,分布式拒绝攻击DDoS(Distributed Denial of Service)因其实施简单、破坏力及危害性巨大,已经成为目前网络安全中最大的威胁之一,如何有效的防范DDoS攻击、减少DDoS攻击带来的危害已成为当前的研究热点。本文重点分析了基于包标记算法的DDoS攻击源追踪技术,对于各种基于包标记算法的攻击源追踪技术进行了原理研究,并对其各自优缺点分别进行了分析与总结。根据各种基于包标记算法的攻击源追踪技术原理,给出了其算法流程。同时,通过模拟实验,对相关的基于流量模式匹配技术的攻击源追踪技术进行了对比与分析,验证了本文提出的算法的性能。展开更多
Sensor networks tend to support different traffic patterns since more and more emerging applications have diverse needs. We present MGRP, a Multi-Gradient Routing Protocol for wireless sensor networks, which is fully ...Sensor networks tend to support different traffic patterns since more and more emerging applications have diverse needs. We present MGRP, a Multi-Gradient Routing Protocol for wireless sensor networks, which is fully distributed and efficiently supports endto-end, one-to-many and many-to-one traffic patterns by effectively construct and maintain a gradient vector for each node. We further combine neighbor link estimation with routing information to reduce packet exchange on network dynamics and node failures. We have implemented MGRP on Tiny OS and evaluated its performance on real-world testbeds. The result shows MGRP achieves lower end-to-end packet delay in different traffic patterns compared to the state of the art routing protocols while still remains high packet delivery ratio.展开更多
The phenomenon of data explosion represents a severe challenge for the upcoming big data era.However,the current Internet architecture is insufficient for dealing with a huge amount of traffic owing to an increase in ...The phenomenon of data explosion represents a severe challenge for the upcoming big data era.However,the current Internet architecture is insufficient for dealing with a huge amount of traffic owing to an increase in redundant content transmission and the end-point-based communication model.Information-centric networking(ICN)is a paradigm for the future Internet that can be utilized to resolve the data explosion problem.In this paper,we focus on content-centric networking(CCN),one of the key candidate ICN architectures.CCN has been studied in various network environments with the aim of relieving network and server burden,especially in name-based forwarding and in-network caching functionalities.This paper studies the effect of several caching strategies in the CCN domain from the perspective of network and server overhead.Thus,we comprehensively analyze the in-network caching performance of CCN under several popular cache replication methods(i.e.,cache placement).We evaluate the performance with respect to wellknown Internet traffic patterns that follow certain probabilistic distributions,such as the Zipf/Mandelbrot–Zipf distributions,and flashcrowds.For the experiments,we developed an OPNET-based CCN simulator with a realistic Internet-like topology.展开更多
In order to identify any traces of suspicious activities for the networks security, Network Traffic Analysis has been the basis of network security and network management. With the continued emergence of new applicati...In order to identify any traces of suspicious activities for the networks security, Network Traffic Analysis has been the basis of network security and network management. With the continued emergence of new applications and encrypted traffic, the currently available approaches can not perform well for all kinds of network data. In this paper, we propose a novel stream pattern matching technique which is not only easily deployed but also includes the advantages of different methods. The main idea is： first, defining a formal description specification, by which any series of data stream can be unambiguously descrbed by a special stream pattern; then a tree representation is constructed by parsing the stream pattern; at last, a stream pattern engine is constructed with the Non-t-mite automata （S-CG-NFA） and Bit-parallel searching algorithms. Our stream pattern analysis system has been fully prototyped on C programming language and Xilinx Vn-tex2 FPGA. The experimental results show the method could provides a high level of recognition efficiency and accuracy.展开更多
Pattern matching is a fundamental approach to detect malicious behaviors and information over Internet, which has been gradually used in high-speed network traffic analysis. However, there is a performance bottleneck ...Pattern matching is a fundamental approach to detect malicious behaviors and information over Internet, which has been gradually used in high-speed network traffic analysis. However, there is a performance bottleneck for multi-pattern matching on online compressed network traffic(CNT), this is because malicious and intrusion codes are often embedded into compressed network traffic. In this paper, we propose an online fast and multi-pattern matching algorithm on compressed network traffic(FMMCN). FMMCN employs two types of jumping, i.e. jumping during sliding window and a string jump scanning strategy to skip unnecessary compressed bytes. Moreover, FMMCN has the ability to efficiently process multiple large volume of networks such as HTTP traffic, vehicles traffic, and other Internet-based services. The experimental results show that FMMCN can ignore more than 89.5% of bytes, and its maximum speed reaches 176.470MB/s in a midrange switches device, which is faster than the current fastest algorithm ACCH by almost 73.15 MB/s.展开更多
文摘近些年来,分布式拒绝攻击DDoS(Distributed Denial of Service)因其实施简单、破坏力及危害性巨大,已经成为目前网络安全中最大的威胁之一,如何有效的防范DDoS攻击、减少DDoS攻击带来的危害已成为当前的研究热点。本文重点分析了基于包标记算法的DDoS攻击源追踪技术,对于各种基于包标记算法的攻击源追踪技术进行了原理研究,并对其各自优缺点分别进行了分析与总结。根据各种基于包标记算法的攻击源追踪技术原理,给出了其算法流程。同时,通过模拟实验,对相关的基于流量模式匹配技术的攻击源追踪技术进行了对比与分析,验证了本文提出的算法的性能。
基金supported by National Key Technologies Research and Development Program of China under Grant No.2014BAH14F01National Science and Technology Major Project of China under Grant No.2012ZX03005007+1 种基金National NSF of China Grant No.61402372Fundamental Research Funds for the Central Universities Grant No.3102014JSJ0003
文摘Sensor networks tend to support different traffic patterns since more and more emerging applications have diverse needs. We present MGRP, a Multi-Gradient Routing Protocol for wireless sensor networks, which is fully distributed and efficiently supports endto-end, one-to-many and many-to-one traffic patterns by effectively construct and maintain a gradient vector for each node. We further combine neighbor link estimation with routing information to reduce packet exchange on network dynamics and node failures. We have implemented MGRP on Tiny OS and evaluated its performance on real-world testbeds. The result shows MGRP achieves lower end-to-end packet delay in different traffic patterns compared to the state of the art routing protocols while still remains high packet delivery ratio.
基金supported by Basic Science Research Program through the National Research Foundation of Korea(NRF)funded by the Ministry of Education(2014R1A1A2057796)and(2015R1D1A1A01059049)
文摘The phenomenon of data explosion represents a severe challenge for the upcoming big data era.However,the current Internet architecture is insufficient for dealing with a huge amount of traffic owing to an increase in redundant content transmission and the end-point-based communication model.Information-centric networking(ICN)is a paradigm for the future Internet that can be utilized to resolve the data explosion problem.In this paper,we focus on content-centric networking(CCN),one of the key candidate ICN architectures.CCN has been studied in various network environments with the aim of relieving network and server burden,especially in name-based forwarding and in-network caching functionalities.This paper studies the effect of several caching strategies in the CCN domain from the perspective of network and server overhead.Thus,we comprehensively analyze the in-network caching performance of CCN under several popular cache replication methods(i.e.,cache placement).We evaluate the performance with respect to wellknown Internet traffic patterns that follow certain probabilistic distributions,such as the Zipf/Mandelbrot–Zipf distributions,and flashcrowds.For the experiments,we developed an OPNET-based CCN simulator with a realistic Internet-like topology.
基金This work is supported by the following projects： National Natural Science Foundation of China grant 60772136, 111 Development Program of China NO.B08038, National Science ＆ Technology Pillar Program of China NO.2008BAH22B03 and NO. 2007BAH08B01.
文摘In order to identify any traces of suspicious activities for the networks security, Network Traffic Analysis has been the basis of network security and network management. With the continued emergence of new applications and encrypted traffic, the currently available approaches can not perform well for all kinds of network data. In this paper, we propose a novel stream pattern matching technique which is not only easily deployed but also includes the advantages of different methods. The main idea is： first, defining a formal description specification, by which any series of data stream can be unambiguously descrbed by a special stream pattern; then a tree representation is constructed by parsing the stream pattern; at last, a stream pattern engine is constructed with the Non-t-mite automata （S-CG-NFA） and Bit-parallel searching algorithms. Our stream pattern analysis system has been fully prototyped on C programming language and Xilinx Vn-tex2 FPGA. The experimental results show the method could provides a high level of recognition efficiency and accuracy.
基金supported by China MOST project (No.2012BAH46B04)
文摘Pattern matching is a fundamental approach to detect malicious behaviors and information over Internet, which has been gradually used in high-speed network traffic analysis. However, there is a performance bottleneck for multi-pattern matching on online compressed network traffic(CNT), this is because malicious and intrusion codes are often embedded into compressed network traffic. In this paper, we propose an online fast and multi-pattern matching algorithm on compressed network traffic(FMMCN). FMMCN employs two types of jumping, i.e. jumping during sliding window and a string jump scanning strategy to skip unnecessary compressed bytes. Moreover, FMMCN has the ability to efficiently process multiple large volume of networks such as HTTP traffic, vehicles traffic, and other Internet-based services. The experimental results show that FMMCN can ignore more than 89.5% of bytes, and its maximum speed reaches 176.470MB/s in a midrange switches device, which is faster than the current fastest algorithm ACCH by almost 73.15 MB/s.
