The recent tremendous development of the Internet and network technology has made our lives more convenient. However, problems such as cyberattacks and privacy concerns are also emerging. Cyberattacks such as DDoS, flooding attacks, and zero-day attacks are causing economic damage not only to enterprises and organizations but also to many users. Therefore, the importance of cyber security is increasing, and various devices are used to provide network security functions. The most representative network security device, the Network Intrusion Detection System (NIDS), analyzes the existing public dataset and applies it to intrusion detection. However, most public datasets for network security are unbalanced data with more benign data than malicious data. In order to design an effective NIDS, it is necessary to solve such data imbalance, and various sampling techniques are applied to solve the data imbalance problem. In this paper, a hybrid sampling method that combines undersampling and oversampling is applied to solve the data imbalance problem. Each sampling method generates sampled data and transforms each data into grayscale images to train a CNN-based detection model. As a result of the experiment, the hybrid sampling method outperforms the oversampling method. In particular, OSS-BSMOTE achieved the highest performance of 94.58% accuracy, 94.58% F1-Score (micro), and 91.36% F1-Score (macro).

Many people can use user-friendly internet services due to the development of IT and communication technologies. However, attackers perform attacks such as malware injection, DoS/DDoS, and system hacking to threaten end devices, personal information, and organizational assets. Security experts use anti-cyber-attack systems such as firewalls, anti-virus solutions, and intrusion detection systems (IDSs) to defend against various cyber threats. Also, many researchers work actively on machine learning-based detection models to protect and respond against advanced cyber-attacks. Therefore, we propose the stacked sparse autoencoder-deep convolutional neural network (SSAE-DeepCNN) model to detect network intrusions. Our proposed model is a semi-supervised learning model that combines stacked sparse autoencoder (SSAE) and deep convolutional neural network (DeepCNN). SSAE discovers new features from training data, and DeepCNN learns new features to detect network intrusions. We design various test scenarios to find the hyperparameters and structures of SSAE with the highest performance. We measure accuracy, F1-Score, prediction time, and hardware resource consumption to evaluate and compare models. The best scenario shows an accuracy of 93.5% by adding sparsity to SSAE's bottleneck. There is no significant difference in performance compared to when SSAE is not used, but resources used by GPU and CPU can be saved. In the future, we plan to improve the proposed model to get better performance.

With the development of various technologies such as high-speed Internet and SNS dissemination, there have been many fields that require processing of big data generated in real time. Accordingly, real-time streaming data processing technology has been developed, and representative platforms include Apache Storm, Apache Spark, and Hadoop. These processing technologies provide scalability to configure distributed systems using multiple servers because they vary in performance, such as throughput and processing speed, depending on the server environment, but the more the number of servers, the more difficult it is to manage. To solve this problem, a problem can be solved by using a docker, a kind of virtualization system that provides ease of expansion. However, there is a place to maintain a native environment without using Docker due to the problem that performance may be reduced, which is a disadvantage of all virtualization systems. In this paper, we build Apache Storm and Apache Spark, which are real-time data processing systems in Docker and Native environments and conduct performance measurements through experiments processing JSON-format data to verify how much performance decreases in Docker environments.

Recently , malware is widely distributed by combining recent technologies such as packing, encoding and obfuscation to bypass anti-virus software. These kinds of technologies allow malware to survive longer, infect various computers and devices for longer periods of time, create a number of mutated malware, and make experts spend longer to analyze malware. Packers disrupt the reverse engineering process, making it difficult for security researchers to analyze new or unknown malware. Thus, we need to analyze as many malware as possible by first detecting the packed malware and analyzing not-packed malware, and then unpack the packed malware. Previously, the packing detection methods were based on mainly signature and entropy detection. However, these methods have increased the undetected rate with the appearance of custom packers. Due to these problems, there have been many research efforts on machine learning-based malware packing detection and classification. In this paper, we present an extensive experimental comparison of these machine learning-based algorithms. In particular, we extract a total of 13 important features and considers eight machine learning algorithms to detect the packing of malware. Experimental results show that we can also detect well malware packed by custom packers which did not studied in previous studies.

Recently, due to the popularity of Bitcoin, interest in the blockchain which is the core technology of Bitcoin, has also increased. Blockchain is a distributed ledger technology that stores transaction information that occurs in P2P(Peer-to-Peer) networks on the ledger of all nodes in a different way than centralized method and verifies whether they are stored correctly. As a result of blockchain technology, not only Bitcoin but also various cryptocurrencies such as Ethereum, Litecoin, Ripple and Bitcoin Cash are being developed. Blockchain is used in various fields because of its features such as integrity and anonymity, but it is also used for illegal transactions and drug transactions. To solve these problems, monitoring system is needed to collect data from blockchain networks and detect abuse and illegal transactions. In this paper, we propose monitoring system for detecting and tracking illegal transactions by collecting and analyzing information in a blockchain network. In addition, we introduce an efficient storage system implemented by Apache Kafka and Apache Storm among the Blockchain monitoring systems.

Packing is the most common analysis avoidance technique for hiding malware. Also, packing can make it harder for the security researcher to identify the behaviour of malware and increase the analysis time. In order to analyze the packed malware, we need to perform unpacking first to release the packing. In this paper, we focus on unpacking and its related technologies to analyze the packed malware. Through extensive analysis on previous unpacking studies, we pay attention to four important drawbacks: no phase integration, no detection combination, no real-restoration, and no unpacking verification. To resolve these four drawbacks, in this paper, we present an all-in-one structure of the unpacking system that performs packing detection, unpacking (i.e., restoration), and verification phases in an integrated framework. For this, we first greatly increase the packing detection accuracy in the detection phase by combining four existing and new packing detection techniques. We then improve the unpacking phase by using the state-of-the-art static and dynamic unpacking techniques. We also present a verification algorithm evaluating the accuracy of unpacking results. Experimental results show that the proposed all-in-one unpacking system performs all of the three phases well in an integrated framework. In particular, the proposed hybrid detection method is superior to the existing methods, and the system performs unpacking very well up to 100% of restoration accuracy for most of the files except for a few packers.

Real-time data stream processing technologies such as Apache Storm and Apache Spark are being actively studied to deal with large-capacity data streams that generated rapidly in real time. Because it is difficult to use most real-time processing techniques alone, it is common to use it with a messaging system that supports input and output of data streams. Apache Kafka is a representative distributed messaging system, specialized in delivering large amounts of real-time log data. However, if the production rate of data in Kafka is faster than the consumption rate, data starvation problem may arise. In order to solve the starvation problem, a load shedding technique is needed to limit the incoming data and maintain system performance when the system is under load. Thus, in this paper confirmed the starvation problem that can occur in Kafka, and we designed and implemented a load shedding engine to solve this problem and proposed a solution to the starvation problem in Kafka based on the performance experiment.

Emergence of high-speed Internet and ubiquitous environment has led to a rapid increase of applications on the Internet and network traffic complexity. In order to provide reliable services and efficient management of network resources, it is essential to classify traffic with specific units. While various traffic classification methods are being studied, there is no single method to classify traffic completely yet. In this paper, we define the correlation model of network flow and propose a traffic grouping method based on it. The proposed correlation model of network flow for traffic grouping consists of the Similarity model and the Connectivity model. We define the Similarity model guideline and the Connectivity model guideline for the purpose of applying the proposed method effectively. By applying the proposed method to the actual application traffic classification, we demonstrate that the method has high accuracy and completeness.

In this paper we have done a feasibility study to develop a simulation model for Content Centric Network. Our goal is to form communities based on popular clustering algorithm on the simulated CCN network. Furthermore we aim to do a guided content delivery on CCN based on the community preferences. Though community formation and a guided delivery of content is not a new field. However an experimental simulation of these concepts on CCN network is novel. Basically we want to utilize CCN network and its advantages to implement a next generation CDN.

Today's network environment is becoming very complicated. Accordingly, traffic classification for network management becomes difficult. For the study of traffic classification, the development of automatic payload signature generation system was carried out very actively. However, the existing automatic payload signature generation system has problems such as semi-automatic system, disposable signature generation, false-positive signature generation and not up-to-date signature. Therefore, we propose the SigManager. SigManager performs all process such as traffic collection, signature generation, signature management and signature verification. The traffic collection stage automatically collects ground-truth traffic through TMA and TMS. The signature management stage removes unnecessary signatures and the signature generation stage generates the new signatures. Finally, the signature verification stage removes the false-positive signatures. We solved the problem of existing automatic signature generation system through this system. As a result of applying this system to campus network, we could maintain high completeness and low false-positive rate for 4 applications.

A network protocol defines rules that control communications between two or more hosts on the Internet, whereas Protocol Reverse Engineering (PRE) defines the process of extracting the structure, attributes and data from a network protocol. Enough knowledge on protocol specifications is essential for security purposes, network policy implementation and management of network resources. Protocol Reverse Engineering is a complex process intended to uncover specifications of unknown protocols. The complexity of PRE, in terms of time consumption, tediousness and error-prone, has led to short and diverse outcomes of Protocols Reverse Engineering approaches. This paper, surveys outputs of 9 PRE approaches in three divisions with methodology analysis and its possible applications. Moreover, in the introductory part we provide a general PRE literature in great depth.

Recently, the risk of information disclosure is increasing significantly. Accordingly, privacy-preserving data mining (PPDM) is being actively studied to obtain accurate mining results while preserving the data privacy. We here focus on secure similar document detection (SSDD), which identifies similar documents of two parties when each party does not disclose its own sensitive documents to the another party. In this paper, we propose an efficient two-step protocol that exploits a feature selection as a lower-dimensional transformation, and we present discriminative feature selections to maximize the performance of the protocol. The proposed protocol consists of two steps: thefilteringstep and thepostprocessingstep. For the feature selection, we first consider the simplest one, random projection (RP), and propose its two-step solution,SSDD-RP. We then present two discriminative feature selections and their solutions:SSDD-LFwhich selects a few dimensions locally frequent in the current querying vector andSSDD-GFwhich selects ones globally frequent in the set of all document vectors. We finally propose a hybrid one,SSDD-HF, which takes advantage of bothSSDD-LFandSSDD-GF. We empirically show that the proposed two-step protocol significantly outperforms the previous one-step protocol by three or four orders of magnitude.

Service Function Chaining (SFC) consists of SFC data plane and control plane from the aspect of architecture. The standard document of I-D.ietf-sfc-control-plane-00 describes requirements for delivering information between SFC control elements and SFC functional elements. This paper defines requirements of management of SFC control plane and defines Yang data model of management operations performed in a SFC control plane based on the standardization documents of the SFC architecture and SFC control plane components and requirements.

Abstract Privacy preservation becomes an important issue in recent big data analysis, and many secure multiparty computations have been proposed for the purpose of privacy preservation in the environment of distributed nodes. As a secure multiparty computations of principal component analysis (PCA), in this paper, we propose S‐PCA, which compute PCA securely among the distributed nodes. PCA is widely used in many applications including time‐series analysis, text mining, and image compression. In general, we compute PCA after concentrating all data in a single server, but this approach discloses data privacy of each node. In contrast, the proposed S‐PCA computes PCA without disclosing the sensitive data of individual nodes. In S‐PCA, the nodes share non‐sensitive mean vectors first and compute covariance matrices and PCA securely using the shared mean vectors. In this paper, we formally prove the correctness and secureness of S‐PCA and apply it to an application of secure similar document detection. Experimental results show that the performance of S‐PCA is slightly worse than that of PCA due to guarantee of secureness, but it significantly improves the performance of secure similar document detection by up to two orders of magnitudes. Copyright © 2016 John Wiley & Sons, Ltd.

Recently, use of smart devices has continued to spread in parallel with their performance improvement. The proliferation of smart devices has led to an emergence of various services such as messengers, SNS and smart banking, and brought convenience in using the services. However, the threat called security vulnerabilities is being faced on the other side. The damages suffered from such a threat are personal information leakage, unreasonable charging, root permission acquisition and so on. In addition, it is said that Android, which is considered as the most vulnerable operating system among the smart devices' operating systems, has the greatest damage of malware codes. Accordingly, this paper proposes a technique to detect malicious codes based on Android devices by using the multivariate time-series analysis. A variety of resource information is integrated into a resource to organize data, and an autoregressive moving average model of the time-series models is used to carry out the modeling. The modeled data is matched with real data to detect malicious codes. The proposed method's validity and excellence is suggested through this experimental result.

The SSL/TLS, one of the most popular encryption protocol, was developed as a solution of various network security problem while the network traffic has become complex and diverse. But the SSL/TLS traffic has been identified as its protocol name, not its used services, which is required for the effective network traffic management. This paper proposes a new method to generate service signatures automatically from SSL/TLS payload data and to classify network traffic in accordance with their application services. We utilize the certificate publication information field in the certificate exchanging record of SSL/TLS traffic for the service signatures, which occurs when SSL/TLS performs Handshaking before encrypt transmission. We proved the performance and feasibility of the proposed method by experimental result that classify about 95% SSL/TLS traffic with about 90% accuracy for every SSL/TLS services.

Today, the number of applications using network service has been increasing. Also, many applications have changed their traffic pattern frequently due to various reasons. Nevertheless, network managers tend to stay with old signatures. But they should update with new signatures to detect the modified application traffic. The extraction of signature is work to demand a lot of time. And it is difficult to continuously and timely extract the new signature for all applications. In this paper, we propose a noble signature management system which automatically extract new signatures detecting the modified traffic and delete old signatures no longer used. The proposed system analyzes traffic with existing signatures and extracts new signature automatically for updated traffic. For automatic generation of new signatures, we uses a sequence pattern algorithm. Also, the proposed system analyze usage of the old signatures to remove them when they are not used any more. We proved the feasibility and applicability of the proposed system by showing that that detection rate of all application was increased.

As usage of mobile increased, target of attackers has changed from PC to Mobile environment. In particular, various attacks have occurred in android platform because it has feature of open platform. To solve this problem, researches of machine learning-based malware detection continually have progressed. However, as version of Android platform continuously is updated, some feature that used in existing research could not collect any more. Therefore, we propose Linux kernel-based novel feature in order to detect malware in higher than android version 4.0. In addition, we perform feature selection to select optimal feature about foregoing feature. This way is able to improve performance of malware detection system. In experiment, by performing android malware detection through support vector machine classifier which has showed relatively good performance in existing studies, we show novel feature feasibility and validity.

Except for phone call service, the latest smartphone is capable of various multi functions including internet through a variety of network interfaces such as 3G/4G/WI-Fi, which has been encouraging the advent of various smartphone applications. However, appearances of various applications and unlimited data plans have caused a drastic increase of smartphone traffic. For solving rapidly-increasing smartphone traffic, domestic mobile communications providers promoted a free Wi-Fi alternate routing strategy which is provided in the houses and public areas or network evolution to 4G network. For stable operation of network and guarantee of service quality corresponding to the explosively increasing smartphone traffic, however, fundamental analysis through monitoring on the smartphone traffic must be carried out. This study measures smartphone traffic by developing a smartphone traffic log information collection agents and loading it in the smartphone. Based on the above, this study suggests the result of analysis on the features of various aspects of smartphone traffic.

Internet traffic volume has been increasing rapidly due to popularization of various multimedia services such as P2P, streaming and online games other than simple Web browsing. In addition, management of increased Internet traffic is regarded as important to provide stable services guaranteeing QoS (Quality of Service) and security. In particular, for the HTTP traffic, its amount used is also on the rise due to an increase of smart devices, and utilized for a variety of purposes. Therefore, analysis and management on HTTP traffic is getting more important. This paper proposes an analysis method for each site at a server side and application levels at a client side in a server/client model of HTTP traffic. It could understand characteristics of HTTP traffic and prepare an efficient management method for the future increasing HTTP traffic through the integrated analysis in the HTTP traffic's server/client respect. It would like to prove validity of the HTTP traffic analysis method proposed in this paper by collecting traffic of campus networks to apply the proposed methodology.

Machine to Machine (M2M), communication between the machines without or with the least-human involvement, is going to be an important part of life. Healthcare is one of the areas on which M2M is going to play major roles. At present time, healthcare sensors monitor patient information and notify remote doctors. However, if we can integrate more intelligence in healthcare sensors, then these can sense patient's emergency condition by themselves and can notify doctor before severe condition. In this context, we have developed intelligent mobile sensor agents in a healthcare scenario in a M2M context. This sensor agent can sense blood pressure of a patient and can notify remote doctor, with the help of an intelligent adapter and a manager in a M2M healthcare scenario.

In this paper, we have devised a reinforcement learning algorithm, which helps in enabling autonomic control loops in Policy based Autonomic Network Management (PBANM). We have proposed two autonomic control loops for optimal configuration and policy optimization in PBANM system. Simulations are performed to validate our proposal.

Machine to Machine (M2M) technology has the potential to increase the revenue, decrease the costs and improve the customer services of an organization. We have analyzed the management requirements of M2M systems, which are based on existing M2M network use cases and services. The most important characteristics including sleeping devices, low power lossy area networks, heterogeneous networks, device intelligence, mobility, two way communication, network dynamics, time sensitivity of data and data volume of M2M systems have been comprehensively investigated and reflected in management requirements discussed in this paper. The main management functionalities are fault, configuration, mobility, QoS and security management.

To reduce frequent changes and upgrades of management systems, we need a guideline of OSS's architecture and development methods of the OSSs. TMF has proposed NGOSS technology-neutral architecture (TNA) which describes major concepts and architectural details of the NGOSS architecture in a technologically neutral manner. The NGOSS TNA can be mapped onto appropriate technology-specific architectures (TSAs) using specific technologies such as XML, Java and CORBA Web services, which is a distributed and services-oriented computing technology, can be applied to NGOSS TSA. In this paper, we examine the architectural requirements of TNA, and provide a design of Web services- based TSA in accordance with the TNA requirements.

Today, we are witnessing more distributed systems on enterprise networks and on the Internet. In general, a distributed system is composed of many subsystems. It is difficult to effectively manage the configuration information of distributed systems because they may be deployed with different software components and run on heterogeneous computing platforms. In addition, the configuration information of a subsystem has complex relations with the information of other subsystems, so it is difficult to provide automatic reconfiguration of related subsystems. To overcome the difficulties, we propose a management information model that considers the relations among subsystems and the Simple Object Access Protocol (SOAP) as a communication method. This paper presents the design and implementation of X-CONF (XML-based configuration management system) for a distributed system. For validation, we have developed the X-CONF for NG-MON, which is a distributed and real-time Internet traffic monitoring and analysis system.

Embedded Web servers are widely used today for IP-based element management. We present a new management architecture that combines this technology with XML, DOM, and XPath to unify element management and network management. XML is used for both management information modeling and manager-agent communication. By taking advantage of modern Web technologies, the proposed architecture provides a method to develop management applications efficiently and to manage network devices effectively. We also explain how legacy SNMP agents are integrated into our proposed architecture.

An embedded Web server (EWS) is a Web server that runs on an embedded system with limited computing resources and serves embedded Web documents to a Web browser. By embedding a Web server into a network device, it is possible for an EWS to provide a powerful Web-based management user interface constructed using HTML, graphics and other features common to Web browsers. When applied to embedded systems, Web technologies offer graphical user interfaces which are user-friendly, inexpensive, cross-platform, and network-ready. This paper explores the topic of an efficient and lightweight embedded Web server for Web-based network element management. We present the architecture of an embedded Web server that can provide a simple but powerful API. We also present the design and implementation of POS-EWS, which is an embedded Web server that we have developed for Web-based network element management. As well, we present the results of POS-EWS's performance evaluation and EWS optimization methods in a commercial Internet router.

In this paper we introduce interface mechanisms for use between embedded management applications and embedded Web servers, and provide a guideline for choosing an efficient interface mechanism. Also we provide effective integration mechanisms for each interface mechanism for the sake of cost-effective development of Web-based network element management.

Local number portability (LNP) is an intelligent network (IN) service, which provides end users the ability to change local telephone service providers without changing their telephone numbers. LNP is a key service for increasing competition in the local telephone marketplace. To implement LNP, a number portability administration center (NPAC) is needed to manage the LNP databases. Service providers also must implement the carrier-level system and update their existing IN components to provide LNP. In this paper, we present our work on applying the TMN and CORBA technology to the service management of the intelligent network, particularly the LNP. We propose a TMN-based LNP system architecture and present a design and implementation of a NPAC service management system using CORBA.