Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186391

Yijing Zhang, Hui Xue, Jianjun Lin, Xiaoyu Liu, Weilin Gai, Xiaodu Yang, Anqi Wang, Yinliang Yue, Bo Sun

{"title":"ER-ERT:A Method of Ensemble Representation Learning of Encrypted RAT Traffic","authors":"Yijing Zhang, Hui Xue, Jianjun Lin, Xiaoyu Liu, Weilin Gai, Xiaodu Yang, Anqi Wang, Yinliang Yue, Bo Sun","doi":"10.23919/IFIPNetworking57963.2023.10186391","DOIUrl":"https://doi.org/10.23919/IFIPNetworking57963.2023.10186391","url":null,"abstract":"Remote Access Trojan (RAT) is one of the major threats to today's network environment. It is a class of malware frequently used by hacking collectives to monitor victims' actions and steal personal information in targeted computers. Traditional machine learning algorithms have been widely used to detect malicious encrypted RAT traffic. Traditional machine learning algorithms rely deeply on expert experience, and it is difficult for current traffic classification models to design effective handcraft features. Deep learning methods have been introduced in recent years to generate representations from raw network traffic data automatically. Previous deep learning-based malicious traffic detection methods generate representations from flow sequences or packet payload bytes. None of these methods simultaneously learn embeddings from flow sequence and packet payload bytes. Thus, we propose a novel ensemble model to draw fine-grained and multi-angle traffic representations for RAT traffic. The model extract (1) temporal features with convolution neural network (CNN) and the Reproducing Kernel Hilbert Space (RKHS) embedding method to model network flow sequence, (2) spatial features with autoencoder and bidirectional gated recurrent unit (Bi-GRU) network to model packet payload bytes, and (3) some stage-based attributes to enhance the identification ability of RAT traffic behaviors. According to the experimental result, our approach achieves better performance than previous works with a precision rate of 97.0% and a recall rate of 96.5%.","PeriodicalId":31737,"journal":{"name":"Edutech","volume":"9 1","pages":"1-10"},"PeriodicalIF":0.0,"publicationDate":"2023-06-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"72503861","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Committees and Organizing Team 委员会及组织小组

Edutech Pub Date : 2023-06-12 DOI: 10.23919/ifipnetworking57963.2023.10186394

引用次数: 0

A Tutorial on the Implementation of a Hyperledger Fabric-based Security Architecture for IoMT 基于Hyperledger fabric的IoMT安全架构实现教程

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186443

Filippos Pelekoudas Oikonomou, J. Ribeiro, G. Mantas, Firooz Bashashi, G. Sakellari, Jonathan González

{"title":"A Tutorial on the Implementation of a Hyperledger Fabric-based Security Architecture for IoMT","authors":"Filippos Pelekoudas Oikonomou, J. Ribeiro, G. Mantas, Firooz Bashashi, G. Sakellari, Jonathan González","doi":"10.23919/IFIPNetworking57963.2023.10186443","DOIUrl":"https://doi.org/10.23919/IFIPNetworking57963.2023.10186443","url":null,"abstract":"Internet of Medical Things (IoMT) have improved individuals' quality of life by enabling IoMT-based healthcare monitoring systems to grow dramatically in recent years. Therefore, cutting-edge security techniques are needed to address the security risks of IoMT networks effectively and in a timely manner. On the other hand, blockchain technology has the potential to play a significant role in both securing IoMT devices and preventing unauthorized access during data transmission and it has been anticipated by the industry and the research community to be a disruptive technology that can be incorporated into novel security solutions for IoMT networks. In this regard, the goal of this research work is to demonstrate the integration of blockchain technology into novel security solutions for IoMT networks and to deploy a Hyperledger Fabric-based blockchain security architecture for IoMT-based healthcare monitoring systems by utilizing the features of the Hyperledger Fabric Platform, its utilities, and its lightweight consensus nature in order to: i) improve security in IoMT-based healthcare monitoring systems, ii) provide secure data storage in a decentralized way, and iii) eliminate single point of failure.","PeriodicalId":31737,"journal":{"name":"Edutech","volume":"15 1","pages":"1-6"},"PeriodicalIF":0.0,"publicationDate":"2023-06-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"81961604","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 1

Graph Convolutional Reinforcement Learning for Load Balancing and Smart Queuing

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186430

Hassan Fawaz, Omar Houidi, D. Zeghlache, Julien Lesca, Pham Tran Anh Quang, Jérémie Leguay, P. Medagliani

引用次数: 1

5GShield: HTTP/2 Anomaly Detection in 5G Service-Based Architecture 5G shield:基于5G服务架构的HTTP/2异常检测

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186410

Nathalie Wehbe, H. Alameddine, M. Pourzandi, C. Assi

{"title":"5GShield: HTTP/2 Anomaly Detection in 5G Service-Based Architecture","authors":"Nathalie Wehbe, H. Alameddine, M. Pourzandi, C. Assi","doi":"10.23919/IFIPNetworking57963.2023.10186410","DOIUrl":"https://doi.org/10.23919/IFIPNetworking57963.2023.10186410","url":null,"abstract":"Fifth Generation (5G) core network leverages the application-layer Hypertext Transfer Protocol version 2 (HTTP/2) to enable the communication between the Network Functions (NFs) of its Service-Based Architecture (SBA). 5G SBA adopts the security-by-design principle, yet, the usage of HTTP/2 introduces some vulnerabilities related to its features exploitation. For instance, the HTTP/2 stream multiplexing attack exploits the stream multiplexing feature, which allows carrying multiple requests over a single TCP connection, and causes a Denial of Service (DoS) on 5G SBA. HTTP/2 attacks can be detected using traditional flow-based anomaly detection solutions in a web environment. Nonetheless, these solutions fall short in detecting these attacks in a 5G network, as we show in this work. To reinforce 5G core network security against HTTP/2 attacks, we propose 5GShield, a novel application-layer anomaly detection framework that uses neural networks, namely, Autoencoder, for anomaly detection. To evaluate our approach, we deploy a 5G testbed, simulate the HTTP/2 stream multiplexing attack and collect HTTP/2 data. Our experimental results show that 5GShield can detect HTTP/2 stream multiplexing attack with an F1-score of 0.992, outperforming a flow-based anomaly detection solution that exhibits an F1-score of 0.78. 5GShield shows the efficiency of 5G-specific application-layer features in exposing HTTP/2 attacks that can go undetected at the network layer.","PeriodicalId":31737,"journal":{"name":"Edutech","volume":"24 1","pages":"1-9"},"PeriodicalIF":0.0,"publicationDate":"2023-06-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"86600972","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

QUIC on the Highway: Evaluating Performance on High-rate Links 高速公路上的QUIC:评估高速链路的性能

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186365

Benedikt Jaeger, Johannes Zirngibl, Marcel Kempf, Kevin Ploch, Georg Carle

{"title":"QUIC on the Highway: Evaluating Performance on High-rate Links","authors":"Benedikt Jaeger, Johannes Zirngibl, Marcel Kempf, Kevin Ploch, Georg Carle","doi":"10.23919/IFIPNetworking57963.2023.10186365","DOIUrl":"https://doi.org/10.23919/IFIPNetworking57963.2023.10186365","url":null,"abstract":"QUIC is a new protocol standardized in 2021 designed to improve on the widely used TCP/ TLS stack. The main goal is to speed up web traffic via HTTP, but it is also used in other areas like tunneling. Based on UDP it offers features like reliable in-order delivery, flow and congestion control, stream-based multiplexing, and always-on encryption using TLS 1.3. Other than with TCP, QUIC implements all these features in user space, only requiring kernel interaction for UDP. While running in user space provides more flexibility, it profits less from efficiency and optimization within the kernel. Multiple implementations exist, differing in programming language, architecture, and design choices. This paper presents an extension to the QUIC Interop Runner, a framework for testing interoperability of QUIC implementations. Our contribution enables reproducible QUIC benchmarks on dedicated hardware. We provide baseline results on 10G links, including multiple implementations, evaluate how OS features like buffer sizes and NIC offloading impact QUIC performance, and show which data rates can be achieved with QUIC compared to TCP. Our results show that QUIC performance varies widely between client and server implementations from 90 Mbit/s to 4900 Mbit/s. We show that the OS generally sets the default buffer size too small, which should be increased by at least an order of magnitude based on our findings. Furthermore, QUIC benefits less from NIC offloading and AES NI hardware acceleration while both features improve the goodput of TCP to around 8000 Mbit/s. Our framework can be applied to evaluate the effects of future improvements to the protocol or the OS.","PeriodicalId":31737,"journal":{"name":"Edutech","volume":"5 1","pages":"1-9"},"PeriodicalIF":0.0,"publicationDate":"2023-06-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"88821472","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 4

An Enhanced Model for Machine Learning-Based DoS Detection in Vehicular Networks 基于机器学习的车辆网络DoS检测增强模型

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186390

Secil Ercan, Léo Mendiboure, Lylia Alouache, Sassi Maaloul, Tidiane Sylla, H. Aniss

{"title":"An Enhanced Model for Machine Learning-Based DoS Detection in Vehicular Networks","authors":"Secil Ercan, Léo Mendiboure, Lylia Alouache, Sassi Maaloul, Tidiane Sylla, H. Aniss","doi":"10.23919/IFIPNetworking57963.2023.10186390","DOIUrl":"https://doi.org/10.23919/IFIPNetworking57963.2023.10186390","url":null,"abstract":"Vehicular communication networks should play an important role in deploying future automated and connected vehicles. Indeed, these vehicular networks could exchange information (position, speed, obstacle detection, slowing down, etc.) that could improve road safety and traffic efficiency. Therefore, it is essential to ensure the cybersecurity of these communication systems to prevent malicious entities from disrupting them. This is why, in this paper, we focus on one of the most common types of attacks in the vehicular environment: Denial-of-Service (DoS) attacks that impact the availability of services. The existing algorithms for DoS attacks detection, mainly based on Artificial Intelligence tools (Machine Learning, Deep Learning), only consider a limited number of features to build their models (position, speed). Therefore, in this paper, we quickly compare state-of-the-art approaches and introduce a new Machine Learning model considering a larger number of features and aiming at guaranteeing better performances for DoS attacks detection. We also propose an implementation and a comparative analysis of existing models to demonstrate the benefits of our approach both in terms of accuracy and F1-score.","PeriodicalId":31737,"journal":{"name":"Edutech","volume":"82 1","pages":"1-9"},"PeriodicalIF":0.0,"publicationDate":"2023-06-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":null,"resultStr":null,"platform":"Semanticscholar","paperid":"77204625","PeriodicalName":null,"FirstCategoryId":null,"ListUrlMain":null,"RegionNum":0,"RegionCategory":"","ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":"","EPubDate":null,"PubModel":null,"JCR":null,"JCRName":null,"Score":null,"Total":0}

引用次数: 0

Imperfect Bandwidth-Sharing Policies using Network Calculus 基于网络演算的不完全带宽共享策略

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186418

A. Bouillard

引用次数: 1

General Chairs Welcome Message 主席欢迎辞

Edutech Pub Date : 2023-06-12 DOI: 10.23919/ifipnetworking57963.2023.10186414

引用次数: 0

Linking User Identities Across Social Networks via Frequency Domain Analysis 通过频域分析连接跨社交网络的用户身份

Edutech Pub Date : 2023-06-12 DOI: 10.23919/IFIPNetworking57963.2023.10186395

Hui Xue, Bo Sun, Weixuan Mao

引用次数: 1

Edutech最新文献