Abstract Precision Time Protocol, PTP, is one of the most accurate protocols for maintaining clock synchronization in industrial and distributed systems and networks. Besides, profiteering or malicious intentions of the network attackers have led to various types of cyber-attacks on different network parts. Time-Delay Attack, TDA, is a well-known network attack that disrupts synchronization. This paper studies a new TDA detection algorithm to maintain and secure the benefits of PTP in industrial networks. We show that through adding new efficient paths and innovative computations based on End-to-End computing, the reliability and security of PTP increase significantly while the incurred traffic overhead remains negligible. Mathematical analysis and simulations confirm the effectiveness and advantages of the proposed algorithm, especially in case of the variety of attacks detected in the network and the location of their occurrence.

Caching is a fundamental web technique for reducing Page Load Time (PLT) by reusing previously fetched resources. We highlight the drawbacks of the current caching approach, especially in the context of high-speed networks where latency, rather than bandwidth, is the primary bottleneck for web performance. We discuss how the current design of web caching suffers from inefficiencies, particularly due to the latency involved in re-validation requests, which diminishes the potential benefits of caching. To address this inefficiency, we present a novel solution in which web servers proactively provide clients with the latest validation tokens for resources during the initial step of page loading, allowing browsers to use unchanged cached content without unnecessary round trips. This method significantly reduces PLT, with preliminary evaluations showing a 30% improvement.

Abstract The network security analyzers use intrusion detection systems (IDSes) to distinguish malicious traffic from benign ones. The deep learning-based (DL-based) IDSes are proposed to auto-extract high-level features and eliminate the time-consuming and costly signature extraction process. However, this new generation of IDSes still needs to overcome a number of challenges to be employed in practical environments. One of the main issues of an applicable IDS is facing traffic concept drift, which manifests itself as new (i.e. , zero-day) attacks, in addition to the changing behavior of benign users/applications. Furthermore, a practical DL-based IDS needs to be conformed to a distributed (i.e. , multi-sensor) architecture in order to yield more accurate detections, create a collective attack knowledge based on the observations of different sensors, and also handle big data challenges for supporting high throughput networks. This paper proposes a novel multi-agent network intrusion detection framework to address the above shortcomings, considering a more practical scenario (i.e., online adaptable IDSes). This framework employs continual deep anomaly detectors for adapting each agent to the changing attack/benign patterns in its local traffic. In addition, a federated learning approach is proposed for sharing and exchanging local knowledge between different agents. Furthermore, the proposed framework implements sequential packet labeling for each flow, which provides an attack probability score for the flow by gradually observing each flow packet and updating its estimation. We evaluate the proposed framework by employing different deep models (including CNN-based and LSTM-based) over the CIC-IDS2017 and CSE-CIC-IDS2018 datasets. Through extensive evaluations and experiments, we show that the proposed distributed framework is well adapted to the traffic concept drift. More precisely, our results indicate that the CNN-based models are well suited for continually adapting to the traffic concept drift (i.e. , achieving an average detection rate of above 95% while needing just 128 new flows for the updating phase), and the LSTM-based models are a good candidate for sequential packet labeling in practical online IDSes (i.e. , detecting intrusions by just observing their first 15 packets).

Large-scale services are deployed in data centers using clusters of servers, and load balancers (LB) are responsible for distributing requests for a service among its servers. Layer-4 (L4) LBs process requests faster than Layer-7 (L7) ones, but they cannot provide session-persistent load balancing, and therefore, they direct connections of an application-level session to different servers. On the other side, L7 LBs can direct all requests of an application-level session to the same server, but they have a very limited capacity because they act as a reverse-proxy and process requests at the application layer. We present “Yuz”, a stateless session-persistent load balancer that does not act as a reverse-proxy. Yuz works near layer 4, and it makes use of TLS session data instead of processing incoming requests at the application level. Our evaluations show that the request rate that can be handled by cluster-based services equipped with Yuz is twice as high as when the clusters use the best existing load balancers. Yuz also significantly reduces the average and tail of the clusters’ response time. Moreover, while each of the existing session-persistent LBs works only for a specific application, Yuz provides an application-independent session-persistent load balancing.

A Load balancer is an essential component of a clustered web-server system which distributes requests among servers. Layer-4 load balancers process requests faster than Layer-7 ones, but they cannot provide session-persistent load balancing. On the other side, layer-7 load balancers, which are known as reverse-proxies, can direct all requests of an application-level session to the same server, but they impose a high processing cost due to processing requests at the application level. We propose a session-persistent load balancing approach which uses TLS session data instead of processing at the application level. It outperforms existing approaches in terms of transaction rate and response time.

One of the most important practices of cybercrime investigations is to search a network traffic history for an excerpt of traffic, such as the disclosed information of an organization or a worm's signature. In post-mortem investigations, criminals and targets are detected by attributing the excerpt to payloads of traffic flows. Since it is impossible to store the high volume of data related to long-term traffic history, payload attribution systems (PASs) based on storing a compact digest of traffic using Bloom filters have been presented in the literature. In these systems, querying the stored digest for an excerpt results in a low number of suspects instead of certain criminals. In this paper, we present a different PAS which is based on simple and widespread digital signal processing techniques. Our traffic digesting scheme has been inspired by DSP-based compression algorithms. The proposed payload attribution system, named DSPAS, not only results in a low false positive rate but also outperforms previous schemes in response to wildcard queries which are essentially applicable for complex excerpts, such as the signature of polymorphic worms. Our theoretical analysis and practical evaluations show that the DSPAS results in a significantly lower false positive rate and also a lower processing time for wildcard queries in comparison to previous works. Moreover, our PAS can prevent a malicious insider from evading the PAS by its ability to find strings similar to a queried excerpt.

Payload attribution systems (PAS) are one of the most important tools of network forensics for detecting an offender after the occurrence of a cybercrime. A PAS stores the network traffic history in order to detect the source and destination pair of a certain data stream in case a malicious activity occurs on the network. The huge volume of information that is daily transferred in the network means that the data stored by a PAS must be as compact and concise as possible. Moreover, the investigation of this large volume of data for a malicious data stream must be handled within a reasonable time. For this purpose, several techniques based on storing a digest of traffic using Bloom filters have been proposed in the literature. The false positive rate of existing techniques for detecting cybercriminals is unacceptably high, i.e., many source and destination pairs are falsely determined as malicious, making it difficult to detect the true criminal. In order to ameliorate this problem, we have proposed a solution based on compressed bitmap index tables and traffic downsampling. Our analytical evaluation and experimental results show that the proposed method significantly reduces the false positive rate.

Routers and routing protocols are critical parts of a network infrastructure. OSPF is one of the most important routing protocols, and therefore its vulnerabilities can be very destructive. This makes its security analysis critical. There are many reported and potential vulnerabilities in OSPF protocol. Considering the complexity and the ambiguity of its description in RFC 2328, it is very valuable to design a formal model of the protocol and analyze the vulnerabilities of its critical parts. In this paper, some challenging parts of OSPF protocol along with attack scenarios are modeled by means of Colored Petri Net in CPN Tools environment. Then, the reported vulnerabilities are analyzed by a behavioral property of Petri net, and the existence of the vulnerabilities is verified by the property checking. Moreover, a new potential vulnerability is presented and verified by both formal and experimental methods.

Wireless Sensor Networks are composed of small, low cost, resource-constrained computing nodes equipped with low power wireless transceivers. In this paper, we study and model the time and energy cost of Kerberos protocol by using timed automata in WSN. We model check the protocol using UPPAAL. We show that considering time in the analysis of security protocols yield more confident results.

In this paper we present a novel approach for detecting SYN flooding attacks by investigating the entropy of SYN packet inter-arrival times as a measure of randomness. We argue that normal SYN packets are almost independent leading to higher values of entropy while SYN flooding attacks consist of a high volume of related SYN packets and so the entropy of their inter-arrival times would be less than normal. We apply this entropy-based method on different data sets of network traffic both in off-line and real-time modes.

The reliability of wireless sensor networks (WSNs) depends on both sensing coverage and reliable transmission of collected data provided by the target cluster of sensors in the proximity of the phenomenon to the observer. In this paper, we establish a probabilistic fundamental quantitative notion for performance-critical applications on reliable information transfer and propose a new analytical model to calculate the coverage-oriented reliability of cluster-based WSNs. Here, the packet loss probability is modeled as a function of two main parameters. The first is the probability of link failure when the node's buffer at the end point of the link is full (discarding the packet) or when the link encounters some errors (corrupting the packet). The second is the probability of path failure when at least the energy of one node is depleted on the path. Most of network properties are considered as random variables and a queuing-theory based model is derived. Simulation results are used to validate the proposed model. The simulation results agree well with the model.

This article takes a theoretical approach to focus on the algorithmic properties of hardware/software partitioning. It proposes a method with polynomial complexity to find the global optimum of an NP-hard model partitioning problem for 75% of occurrences under some practical conditions. The global optimum is approached with a lower bound distance for the remaining 25%. Furthermore, this approach ensures finding the 2-approximate of the global optimum partition in 97% of instances where technical assumptions exist. The strategy is based on intelligently changing the parameters of the polynomial model of the partitioning problem to force it to produce (or approach) the exact solution to the NP-hard model.

Although several analytical models have been proposed for wireless sensor networks (WSNs) with different capabilities, very few of them consider the effect of general service distribution as well as design constraints on network performance. This paper presents a new analytical model to compute message latency in a WSN with loop-free Bellman Ford routing strategy. The model considers limited buffer size for each node using M/G/1/k queuing system. Also, contention probability and resource utilization are suitably modeled. The results obtained from simulation experiments confirm that the model exhibits a high degree of accuracy for various network configurations.

Cartesian genetic programming (CGP) has an unusual genotype representation which makes it more efficient than Genetic programming (GP) in digital circuit design problem. However, to the best of our knowledge, all methods used in evolutionary design of digital circuits deal with rugged, complex search space, which results in long running time to obtain successful evolution. Therefore, employing a method to guide evolution in these spaces can facilitate achieving more reasonable results. It has been claimed that a two-step evolutionary scenario caused by benefit and cost of learning called Baldwin effect can guide evolution in the biology and artificial life. Therefore, we have been motivated to examine this effect on CGP. We observe using this scenario the success rate and evolution time of CGP improves dramatically especially when size of chromosomes increases.

An important approach to reduce power dissipation is reducing the number of instructions executed by the processor. To achieve this goal, this paper introduces a novel instruction scheduling algorithm that executes an instruction only when its result is required by another instruction. In this manner, it not only does not execute useless instructions, but also reduces the number of instructions executed after a mispredicted branch. The cost of the extra hardware is 161 bytes for 128 instruction window size. Measurements done using SPEC CPU 2000 benchmarks show that the average number of executed instructions is reduced by 13.5% while the average IPC is not affected.

In this paper, we introduce novel mechanisms for measuring and evaluating the performance of a network and its devices, configured especially for voice over IP (VoIP). We study the effects of different configurations on final voice quality by enabling or changing the related equipment features. In our study we quantify quality changes based on different router configurations and discuss precisely to what extent and how much this quality is improved versus features or special configurations of network devices. These results can be used for two purposes: compare and benchmark different routers in order to know which one is proper for a typical VoIP network, and select the best configurations. We demonstrate that the highest final quality of voice is achieved in packet remarking configurations with IP precedence and DSCP.

Network survivability gauges the ability of a network to support the committed quality of service (QoS) continuously in the presence of various failure scenarios. We perceive that both performance and availability are integral components of survivability. Therefore, we propose a composite model for survivability that consists of performance and availability analysis. A analytical technique is presented to find the excess loss due to failure (ELF) when the system is operating in gracefully degraded states. An algorithm is proposed to carry out the availability analysis of the network, even when the available paths between nodes are non-disjoint. These two models are combined to construct a hierarchical model to evaluate the network survivability performance. We consider single and multiple link failures, and also node failures. A WDM network with wavelength conversion is used as an example for this evaluation.

Improving testability during the early stages of High-Level Synthesis (HLS) reduces test hardware overheads, test costs, design iterations, and also improves fault coverage. In this paper, we present a novel register allocation algorithm which is based on weighted graph coloring, targeting testability improvement.