Biblio

In the operation of information technology (IT) services, operators monitor the equipment-issued alarms, to locate the cause of a failure and take action. Alarms generate simultaneously from multiple devices with physical/logical connections. Therefore, if the time and location of the alarms are close to each other, it can be judged that the alarms are likely to be caused by the same event. In this paper, we propose a method that takes a novel approach by correlating alarms considering event units using a Bayesian network based on alarm generation time, generation place, and alarm type. The topology information becomes a critical decision element when doing the alarm correlation. However, errors may occur when topology information updates manually during failures or construction. Therefore, we show that event-by-event correlation with 100% accuracy is possible even if the topology information is 25% wrong by taking into location information other than topology information.

There are a large number of illegal websites on the Internet, such as pornographic websites, gambling websites, online fraud websites, online pyramid selling websites, etc. This paper studies the use of crawler technology for digital forensics on illegal websites. First, a crawler based illegal website forensics program is designed and developed, which can detect the peripheral information of illegal websites, such as domain name, IP address, network topology, and crawl key information such as website text, pictures, and scripts. Then, through comprehensive analysis such as word cloud analysis, word frequency analysis and statistics on the obtained data, it can help judge whether a website is illegal.

Wireless ad hoc networks are characterized by dynamic topology and high node mobility. Network attacks on wireless ad hoc networks can significantly reduce performance metrics, such as the packet delivery ratio from the source to the destination node, overhead, throughput, etc. The article presents an experimental study of an intrusion detection system prototype in mobile ad hoc networks based on machine learning. The experiment is carried out in a MANET segment of 50 nodes, the detection and prevention of DDoS and cooperative blackhole attacks are investigated. The dependencies of features on the type of network traffic and the dependence of performance metrics on the speed of mobile nodes in the network are investigated. The conducted experimental studies show the effectiveness of an intrusion detection system prototype on simulated data.

Accurately constructing dynamic network topology is one of the core tasks to provide on-demand security services to the ubiquitous network. Existing schemes cannot accurately construct dynamic network topologies in time. In this paper, we propose a novel scheme to construct the ubiquitous network topology. Firstly, ubiquitous network nodes are divided into three categories: terminal node, sink node, and control node. On this basis, we propose two operation primitives (i.e., addition and subtraction) and three atomic operations (i.e., intersection, union, and fusion), and design a series of algorithms to describe the network change and construct the network topology. We further use our scheme to depict the specific time-varying network topologies, including Satellite Internet and Internet of things. It demonstrates that their communication and security protection modes can be efficiently and accurately constructed on our scheme. The simulation and theoretical analysis also prove that the efficiency of our scheme, and effectively support the orchestration of protection capabilities.

Software-Defined Networking (SDN) technique is presented in this paper to manage the Naval Supervisory Control and Data Acquisition (SCADA) network for equipping the network with the function of reconfiguration and scalability. The programmable nature of SDN enables a programmable Modular Topology Generator (MTG), which provides an extensive control over the network’s internal connectivity and traffic control. Specifically, two functions of MTG are developed and examined in this paper, namely linkHosts and linkSwitches. These functions are able to place the network into three different states, i.e., fully connected, fully disconnected, and partially connected. Therefore, it provides extensive security benefits and allows network administrators to dynamically reconfigure the network and adjust settings according to the network’s needs. Extensive tests on Mininet have demonstrated the effectiveness of SDN for enabling the reconfigurable and scalable Naval SCADA network. Therefore, it provides a potent tool to enhance the resiliency/survivability, scalability/compatibility, and security of naval SCADA networks.

In this article, we propose a generic cyber-physical framework, developed in our laboratory, for smart grid control and monitoring in real-time. Our framework is composed of four key elements: (1) system layer which embeds a physical or emulated power system network, (2) data analysis layer to execute real-time data-driven grid analysis algorithms, (3) backend layer with a generic data storage framework which supports multiple databases with functionally different architectures, and (4) visualization layer where multiple customized or commercially available user interfaces can be deployed concurrently for grid control and monitoring. These four layers are interlinked via bidirectional communication channels. Such a flexible and scalable framework provides a cohesive environment to enhance smart grid situational awareness. We demonstrate the utility of our proposed architecture with several case studies where we estimate a modified IEEE-33 bus distribution network topology entirely from synchrophasor measurements, without any prior knowledge of the grid network, and render the same on visualization platform. Three demonstrations are included with single and multiple system operators having complete and partial measurements.

With the development of network technology, identifying specific traffic has become important in network monitoring and security. However, designing feature sets that can accurately describe network traffic is still an urgent problem. Most of existing researches cannot realize effectively the identification of targets, and don't perform well in the complex and dynamic network environment. Aiming at these problems, we propose a novel method in this paper, which learns correlation features of network traffic based on the hierarchical structure. Firstly, the method learns the spatial-temporal features using convolutional neural networks (CNNs) and the bidirectional long short-term memory networks (Bi-LSTMs), then builds network topology to capture dependency characteristics between sessions and learns the context-related features through the graph attention networks (GATs). Finally, the network traffic session is classified using a fully connected network. The experimental results show that our method can effectively improve the detection ability and achieve a better classification performance overall.

International regulations specified in WP.29 and international standards specified in ISO/SAE 21434 require security operations such as cyberattack detection and incident responses to protect vehicles from cyberattacks. To meet these requirements, many vehicle manufacturers are planning to install Intrusion Detection Systems (IDSs) in the Controller Area Network (CAN), which is a primary component of in-vehicle networks, in the coming years. Besides, many vehicle manufacturers and information security companies are developing technologies to identify attack paths related to IDS alerts to respond to cyberattacks appropriately and quickly. To develop the IDSs and the technologies to identify attack paths, it is essential to grasp normal communications performed on in-vehicle networks. Thus, our study aims to develop a technology that can easily grasp normal communications performed on in-vehicle networks. In this paper, we propose the first message source identification method that easily identifies CAN-IDs used by each Electronic Control Unit (ECU) connected to the CAN for message transmissions. We realize the proposed method by utilizing diagnostic communications and an IDS installed in the CAN (CAN-IDS). We evaluate the proposed method using an ECU installed in an actual vehicle and four kinds of simulated CAN-IDSs based on typical existing intrusion detection methods for the CAN. The evaluation results show that the proposed method can identify the CAN-ID used by the ECU for CAN message transmissions if a suitable simulated CAN-IDS for the proposed method is connected to the vehicle.

Intelligent service network under the paradigm of the Internet of Things (IoT) uses sensor and network communication technology to realize the interconnection of everything and real-time communication between devices. Under the background of combat, all kinds of sensor devices and equipment units need to be highly networked to realize interconnection and information sharing, which makes the Internet of Things technology hopeful to be applied in the battlefield to interconnect these entities to form the Internet of Battlefield Things (IoBT). This paper analyzes the related concepts of IoBT, and constructs the IoBT multilayer dependency network model according to the typical characteristics and topology of IoBT, then constructs the weighted super-adjacency matrix according to the coupling weights within and between different layers, and the stability model of IoBT is analyzed and derived. Finally, an example of IoBT network is given to provide a reference for analyzing the stability factors of IoBT network.

The Software Defined Networking (SDN) is a solution for Data Center Networks (DCN). This solution offers a centralized control that helps to simplify the management and reduce the big data issues of storage management and data analysis. This paper investigates the performance of deploying an SDN controller in DCN. The paper considers the network topology with a different number of hosts using the Mininet emulator. The paper evaluates the performance of DCN based on Python SDN controllers with a different number of hosts. This evaluation compares POX and RYU controllers as DCN solutions using the throughput, delay, overhead, and convergence time. The results show that the POX outperforms the RYU controller and is the best choice for DCN.

Global traffic data are proliferating, including in Indonesia. The number of internet users in Indonesia reached 205 million in January 2022. This data means that 73.7% of Indonesia’s population has used the internet. The median internet speed for mobile phones in Indonesia is 15.82 Mbps, while the median internet connection speed for Wi-Fi in Indonesia is 20.13 Mbps. As predicted by many, real-time traffic such as multimedia streaming dominates more than 79% of traffic on the internet network. This condition will be a severe challenge for the internet network, which is required to improve the Quality of Experience (QoE) for user mobility, such as reducing delay, data loss, and network costs. However, IP-based networks are no longer efficient at managing traffic. Named Data Network (NDN) is a promising technology for building an agile communication model that reduces delays through a distributed and adaptive name-based data delivery approach. NDN replaces the ‘where’ paradigm with the concept of ‘what’. User requests are no longer directed to a specific IP address but to specific content. This paradigm causes responses to content requests to be served by a specific server and can also be served by the closest device to the requested data. NDN router has CS to cache the data, significantly reducing delays and improving the internet network’s quality of Service (QoS). Motivated by this, in 2019, we began intensive research to achieve a national flagship product, an NDN router with different functions from ordinary IP routers. NDN routers have cache, forwarding, and routing functions that affect data security on name-based networks. Designing scalable NDN routers is a new challenge as NDN requires fast hierarchical name-based lookups, perpackage data field state updates, and large-scale forward tables. We have a research team that has conducted NDN research through simulation, emulation, and testbed approaches using virtual machines to get the best NDN router design before building a prototype. Research results from 2019 show that the performance of NDN-based networks is better than existing IP-based networks. The tests were carried out based on various scenarios on the Indonesian network topology using NDNsimulator, MATLAB, Mininet-NDN, and testbed using virtual machines. Various network performance parameters, such as delay, throughput, packet loss, resource utilization, header overhead, packet transmission, round trip time, and cache hit ratio, showed the best results compared to IP-based networks. In addition, NDN Testbed based on open source is free, and the flexibility of creating topology has also been successfully carried out. This testbed includes all the functions needed to run an NDN network. The resource capacity on the server used for this testbed is sufficient to run a reasonably complex topology. However, bugs are still found on the testbed, and some features still need improvement. The following exploration of the NDN testbed will run with more new strategy algorithms and add Artificial Intelligence (AI) to the NDN function. Using AI in cache and forwarding strategies can make the system more intelligent and precise in making decisions according to network conditions. It will be a step toward developing NDN router products by the Bandung Institute of Technology (ITB) Indonesia.

The robustness of supply chain networks (SCNs) against sequential topology attacks is significant for maintaining firm relationships and activities. Although SCNs have experienced many emergencies demonstrating that mixed failures exacerbate the impact of cascading failures, existing studies of sequential attacks rarely consider the influence of mixed failure modes on cascading failures. In this paper, a reinforcement learning (RL)-based sequential attack strategy is applied to SCNs with cascading failures that consider mixed failure modes. To solve the large state space search problem in SCNs, a deep Q-network (DQN) optimization framework combining deep neural networks (DNNs) and RL is proposed to extract features of state space. Then, it is compared with the traditional random-based, degree-based, and load-based sequential attack strategies. Simulation results on Barabasi-Albert (BA), Erdos-Renyi (ER), and Watts-Strogatz (WS) networks show that the proposed RL-based sequential attack strategy outperforms three existing sequential attack strategies. It can trigger cascading failures with greater influence. This work provides insights for effectively reducing failure propagation and improving the robustness of SCNs.

Fraud mechanisms have evolved from isolated actions performed by single individuals to complex criminal networks. This paper aims to contribute to the identification of potentially relevant nodes in fraud networks. Whilst traditional methods for fraud detection rely on identifying abnormal patterns, this paper proposes STARBRIDGE: a new linear and scalable, ranked out, parameter free method to identify fraudulent nodes and rings based on Bridging, Influence and Control metrics. This is applied to the telecommunications domain where fraudulent nodes form a star-bridge-star pattern. Over 75% of nodes involved in fraud denote control, bridging centrality and doubled the influence scores, when compared to non-fraudulent nodes in the same role, stars and bridges being chief positions.

This paper proposes a new two-stage encryption method to increase the cryptographic strength of the AES algorithm, which is based on stochastic error of a neural network. The composite encryption key in AES neural network cryptosystem are the weight matrices of synaptic connections between neurons and the metadata about the architecture of the neural network. The stochastic nature of the prediction error of the neural network provides an ever-changing pair key-ciphertext. Different topologies of the neural networks and the use of various activation functions increase the number of variations of the AES neural network decryption algorithm. The ciphertext is created by the forward propagation process. The encryption result is reversed back to plaintext by the reverse neural network functional operator.

The MANET architecture's future growth will make extensive use of encryption and encryption to keep network participants safe. Using a digital signature node id, we illustrate how we may stimulate the safe growth of subjective clusters while simultaneously addressing security and energy efficiency concerns. The dynamic topology of MANET allows nodes to join and exit at any time. A form of attack known as a black hole assault was used to accomplish this. To demonstrate that he had the shortest path with the least amount of energy consumption, an attacker in MATLAB R2012a used a digital signature ID to authenticate the node from which he wished to intercept messages (DSEP). “Digital Signature”, “MANET,” and “AODV” are all terms used to describe various types of digital signatures. Black Hole Attack, Single Black Hole Attack, Digital Signature, and DSEP are just a few of the many terms associated with MANET.

In this paper, we address the virtual network embedding (VNE) problem in non-terrestrial networks (NTNs) enabling dynamic changes in the virtual network function (VNF) deployment to maximize the service acceptance rate and service revenue. NTNs such as satellite networks involve highly dynamic topology and limited resources in terms of rate and power. VNE in NTNs is a challenge because a static strategy under-performs when new service requests arrive or the network topology changes unexpectedly due to failures or other events. Existing solutions do not consider the power constraint of satellites and rate limitation of inter-satellite links (ISLs) which are essential parameters for dynamic adjustment of existing VNE strategy in NTNs. In this work, we propose a dynamic VNE algorithm that selects a suitable VNE strategy for new and existing services considering the time-varying network topology. The proposed scheme, D-ViNE, increases the service acceptance ratio by 8.51% compared to the benchmark scheme TS-MAPSCH.

As the cyberspace structure becomes more and more complex, the problems of dynamic network space topology, complex composition structure, large spanning space scale, and a high degree of self-organization are becoming more and more important. In this paper, we model the cyberspace elements and their dependencies by combining the knowledge of graph theory. Layer adopts a network space modeling method combining virtual and real, and level adopts a spatial iteration method. Combining the layer-level models into one, this paper proposes a fast modeling method for cyberspace security structure model with network connection relationship, hierarchical relationship, and vulnerability information as input. This method can not only clearly express the individual vulnerability constraints in the network space, but also clearly express the hierarchical relationship of the complex dependencies of network individuals. For independent network elements or independent network element groups, it has flexibility and can greatly reduce the computational complexity in later applications.

The Internet of Things (IoT) is a technology that has evolved to make day-to-day life faster and easier. But with the increase in the number of users, the IoT network is prone to various security and privacy issues. And most of these issues/attacks occur during the routing of the data in the IoT network. Therefore, for secure routing among resource-constrained nodes of IoT, the RPL protocol has been standardized by IETF. But the RPL protocol is also vulnerable to attacks based on resources, topology formation and traffic flow between nodes. The attacks like DoS, Blackhole, eavesdropping, flood attacks and so on cannot be efficiently defended using RPL protocol for routing data in IoT networks. So, defense mechanisms are used to protect networks from routing attacks. And are classified into Secure Routing Protocols (SRPs) and Intrusion Detection systems (IDs). This paper gives an overview of the RPL attacks and the defense mechanisms used to detect or mitigate the RPL routing attacks in IoT networks.

Network security is a problem that is of great concern to all countries at this stage. How to ensure that the network provides effective services to people without being exposed to potential security threats has become a major concern for network security researchers. In order to better understand the network security situation, researchers have studied a variety of quantitative assessment methods, and the most scientific and effective one is the hierarchical quantitative assessment method of the network security threat situation. This method allows the staff to have a very clear understanding of the security of the network system and make correct judgments. This article mainly analyzes the quantitative assessment of the hierarchical network security threat situation from the current situation and methods, which is only for reference.

The “Internet of Things” (IoT) is internetworking of physical devices known as 'things', algorithms, equipment and techniques that allow communication with another device, equipment and software over the network. And with the advancement in data communication, every device must be connected via the Internet. For this purpose, we use resource-constrained sensor nodes for collecting data from homes, offices, hospitals, industries and data centers. But various vulnerabilities may ruin the functioning of the sensor nodes. Routing Protocol for Low Power and Lossy Networks (RPL) is a standardized, secure routing protocol designed for the 6LoWPAN IoT network. It's a proactive routing protocol that works on the destination-oriented topology to perform safe routing. The Sinkhole is a networking attack that destroys the topology of the RPL protocol as the attacker node changes the route of all the traffic in the IoT network. In this paper, we have given a survey of Sinkhole attacks in IoT and proposed different methods for preventing and detecting these attacks in a low-power-based IoT network.

As a large number of sensor nodes as well as limited resources such as energy, memory, computing power, as well as bandwidth. Lossy linkages connect these nodes together. In early 2008,IETF working group looked into using current routing protocols for LLNs. Routing Over minimum power and Lossy networksROLL standardizes an IPv6 routing solution for LLNs because of the importance of LLNs in IoT.IPv6 Routing Protocol is based on the 6LoWPAN standard. RPL has matured significantly. The research community is becoming increasingly interested in it. The topology of RPL can be built in a variety of ways. It creates a topology in advance. Due to the lack of a complete review of RPL, in this paper a mobility management framework has been proposed along with experimental evaluation by applying parameters likePacket Delivery Ratio, throughput, end to end delay, consumed energy on the basis of the various parameters and its analysis done accurately. Finally, this paper can help academics better understand the RPL and engage in future research projects to improve it.

The “Internet of Things (IoT)” is a term that describes physical sensors, processing software, power and other technologies to connect or interchange information between systems and devices through the Internet and other forms of communication. RPL protocol can efficiently establish network routes, communicate routing information, and adjust the topology. The 6LoWPAN concept was born out of the belief that IP should protect even the tiniest devices, and for low-power devices, minimal computational capabilities should be permitted to join IoT. The DIS-Flooding against RPL-based IoT with its mitigation techniques are discussed in this paper.

Existing solutions for scheduling arbitrarily complex distributed applications on networks of computational nodes are insufficient for scenarios where the network topology is changing rapidly. New Internet of Things (IoT) domains like the Internet of Robotic Things (IoRT) and the Internet of Battlefield Things (IoBT) demand solutions that are robust and efficient in environments that experience constant and/or rapid change. In this paper, we demonstrate how recent advancements in machine learning (in particular, in graph convolutional neural networks) can be leveraged to solve the task scheduling problem with decent performance and in much less time than traditional algorithms.

The topological structure of the network relationship is described by the network diagram, and the formation and evolution process of the network is analyzed by using the cost-benefit method. Assuming that the self-interested network member nodes can connect or break the connection, the network topology model is established based on the dynamic random pairing evolution network model. The static structure of the network is studied. Respecting the psychological cognition law of college students and innovating the core value cultivation model can reverse the youth's identification dilemma with the core values, and then create a good political environment for the normal, healthy, civilized and orderly network participation of the youth. In recognition of the atmosphere, an automatic learning algorithm of Bayesian network structure that effectively integrates expert knowledge and data-driven methods is realized.

Information-Centric Networking (ICN) is among the promising architecture that can drive the need and versatility towards the future generation (xG) needs. In the future, support for network communication relies on the area of telemedicine, autonomous vehicles, and disaster recovery. In the disaster recovery case, there is a high possibility where the communication path is severed. Multicast communication and DTN-friendly route algorithm are becoming suitable options to send a packet message to get a faster response and to see any of the nodes available for service, this approach could give burden to the core network. Also, during disaster cases, many people would like to communicate, receive help, and find family members. Flooding the already disturbed/severed network will further reduce communication performance efficiency even further. Thus, this study takes into consideration prioritization factors to allow networks to process and delivering priority content. For this purpose, the proposed technique introduces the Routable Prefix Identifier (RP-ID) that takes into account the prioritization factor to enable optimization in Delay Tolerant ICN communication.