In order to classify packet, we propose a novel IP classification based the non-collision hash and jumping table trie-tree (NHJTTT) algorithm, which is based on noncollision hash Trie-tree and Lakshman and Stiliadis p...In order to classify packet, we propose a novel IP classification based the non-collision hash and jumping table trie-tree (NHJTTT) algorithm, which is based on noncollision hash Trie-tree and Lakshman and Stiliadis proposing a 2-dimensional classification algorithm (LS algorithm). The core of algorithm consists of two parts: structure the non-collision hash function, which is constructed mainly based on destination/source port and protocol type field so that the hash function can avoid space explosion problem; introduce jumping table Trie-tree based LS algorithm in order to reduce time complexity. The test results show that the classification rate of NHJTTT algorithm is up to 1 million packets per second and the maximum memory consumed is 9 MB for 10 000 rules. Key words IP classification - lookup algorithm - trie-tree - non-collision hash - jumping table CLC number TN 393.06 Foundation item: Supported by the Chongqing of Posts and Telecommunications Younger Teacher Fundation (A2003-03).Biography: SHANG Feng-jun (1972-), male, Ph.D. candidate, lecture, research direction: the smart instrument and network.展开更多
Currently,telecom fraud is expanding from the traditional telephone network to the Internet,and identifying fraudulent IPs is of great significance for reducing Internet telecom fraud and protecting consumer rights.Ho...Currently,telecom fraud is expanding from the traditional telephone network to the Internet,and identifying fraudulent IPs is of great significance for reducing Internet telecom fraud and protecting consumer rights.However,existing telecom fraud identification methods based on blacklists,reputation,content and behavioral characteristics have good identification performance in the telephone network,but it is difficult to apply to the Internet where IP(Internet Protocol)addresses change dynamically.To address this issue,we propose a fraudulent IP identification method based on homology detection and DBSCAN(Density-Based Spatial Clustering of Applications with Noise)clustering(DC-FIPD).First,we analyze the aggregation of fraudulent IP geographies and the homology of IP addresses.Next,the collected fraudulent IPs are clustered geographically to obtain the regional distribution of fraudulent IPs.Then,we constructed the fraudulent IP feature set,used the genetic optimization algorithm to determine the weights of the fraudulent IP features,and designed the calculation method of the IP risk value to give the risk value threshold of the fraudulent IP.Finally,the risk value of the target IP is calculated and the IP is identified based on the risk value threshold.Experimental results on a real-world telecom fraud detection dataset show that the DC-FIPD method achieves an average identification accuracy of 86.64%for fraudulent IPs.Additionally,the method records a precision of 86.08%,a recall of 45.24%,and an F1-score of 59.31%,offering a comprehensive evaluation of its performance in fraud detection.These results highlight the DC-FIPD method’s effectiveness in addressing the challenges of fraudulent IP identification.展开更多
Distributed Denial-of-Service (DDoS) attacks against public web servers are increasingly common. Countering DDoS attacks are becoming ever more challenging with the vast resources and techniques increasingly available...Distributed Denial-of-Service (DDoS) attacks against public web servers are increasingly common. Countering DDoS attacks are becoming ever more challenging with the vast resources and techniques increasingly available to attackers. It is impossible for the victim servers to work on the individual level of on-going traffic flows. In this paper, we establish IP Flow which is used to select proper features for DDoS detection. The IP flow statistics is used to allocate the weights for traffic routing by routers. Our system protects servers from DDoS attacks without strong client authentication or allowing an attacker with partial connectivity information to repeatedly disrupt communications. The new algorithm is thus proposed to get efficiently maximum throughput by the traffic filtering, and its feasibility and validity have been verified in a real network circumstance. The experiment shows that it is with high average detection and with low false alarm and miss alarm. Moreover, it can optimize the network traffic simultaneously with defending against DDoS attacks, thus eliminating efficiently the global burst of traffic arising from normal traffic.展开更多
This In the past decade there has been an increasing need for designs to address the time and cost efficiency issues from various computer network applications such as general IP address lookup and specific network in...This In the past decade there has been an increasing need for designs to address the time and cost efficiency issues from various computer network applications such as general IP address lookup and specific network intrusion detection. Hashing techniques have been widely adopted for this purpose, among which XOR-operation-based hashing is one of most popular techniques due to its relatively small hash process delay. In most current commonly used XOR-hashing algorithms, each of the hash key bits is usually explicitly XORed only at most once in the hash process, which may limit the amount of potential randomness that can be introduced by the hashing process. In [1] a series of bit duplication techniques are proposed by systematically duplicating one row of key bits. This paper further looks into various ways in duplicating and reusing key bits to maximize randomness needed in the hashing process so as to enhance the overall performance further. Our simulation results show that, even with a slight increase in hardware requirement, a very significant reduction in the amount of hash collision can be obtained by the proposed technique.展开更多
通过构建整数线性规划(ILP)来计算网络的能耗,求解ILP的解需要的计算机内存空间大,但内存不足仍然是需要考虑的问题之一。针对这一问题,提出了一种基于K算法来设计绿色IP over WDM网络的方法,该方法是基于传统的虚拓扑网络业务疏导方法...通过构建整数线性规划(ILP)来计算网络的能耗,求解ILP的解需要的计算机内存空间大,但内存不足仍然是需要考虑的问题之一。针对这一问题,提出了一种基于K算法来设计绿色IP over WDM网络的方法,该方法是基于传统的虚拓扑网络业务疏导方法,首先利用K算法求解网络中节点与节点之间的K条可能路径,然后通过构建整数线性规划(ILP)来求解网络资源的分布。分析网络能耗的模型,利用数学表达式来描述基于K算法下3种IP over WDM网络的能耗。展开更多
针对IP over WDM网络,建立了整数线性规划(ILP)最小功耗模型,计算了满足峰值业务需要开启的设备数目;对于低峰业务提出休眠机制,分别利用最小光路数算法与最小跳数算法,在保证连接无阻塞的情况下找出空闲设备,对比峰值业务得到不同算法...针对IP over WDM网络,建立了整数线性规划(ILP)最小功耗模型,计算了满足峰值业务需要开启的设备数目;对于低峰业务提出休眠机制,分别利用最小光路数算法与最小跳数算法,在保证连接无阻塞的情况下找出空闲设备,对比峰值业务得到不同算法下的设备使用率,确定IP over WDM网络的节能潜力。结果表明,ILP优化模型的网络功耗最小,最小光路数算法次之;低峰业务下利用休眠机制可以关闭设备的比例占40%～60%;采用最小光路数算法的休眠机制节能效果较优。展开更多
Problems of the current IGMP mechanism were identified, such as unnecessary periodic probing of hosts and leave latency, which wastes bandwidth and cause more traffic and overhead. Alternative mechanism that preserve ...Problems of the current IGMP mechanism were identified, such as unnecessary periodic probing of hosts and leave latency, which wastes bandwidth and cause more traffic and overhead. Alternative mechanism that preserve the IP multicast model but employ join/leave messages to track local group membership for broadcast LANs (shared medium LANs) was proposed in this paper. We describe the implementation requirements of the new mechanism and compare it to existing one, demonstrating that join/leave approach is uniformly superior for the environment of broadcast LANs.展开更多
文摘In order to classify packet, we propose a novel IP classification based the non-collision hash and jumping table trie-tree (NHJTTT) algorithm, which is based on noncollision hash Trie-tree and Lakshman and Stiliadis proposing a 2-dimensional classification algorithm (LS algorithm). The core of algorithm consists of two parts: structure the non-collision hash function, which is constructed mainly based on destination/source port and protocol type field so that the hash function can avoid space explosion problem; introduce jumping table Trie-tree based LS algorithm in order to reduce time complexity. The test results show that the classification rate of NHJTTT algorithm is up to 1 million packets per second and the maximum memory consumed is 9 MB for 10 000 rules. Key words IP classification - lookup algorithm - trie-tree - non-collision hash - jumping table CLC number TN 393.06 Foundation item: Supported by the Chongqing of Posts and Telecommunications Younger Teacher Fundation (A2003-03).Biography: SHANG Feng-jun (1972-), male, Ph.D. candidate, lecture, research direction: the smart instrument and network.
基金funded by the National Natural Science Foundation of China under Grant No.62002103Henan Province Science Foundation for Youths No.222300420058+1 种基金Henan Province Science and Technology Research Project No.232102321064Teacher Education Curriculum Reform Research Priority Project No.2023-JSJYZD-011.
文摘Currently,telecom fraud is expanding from the traditional telephone network to the Internet,and identifying fraudulent IPs is of great significance for reducing Internet telecom fraud and protecting consumer rights.However,existing telecom fraud identification methods based on blacklists,reputation,content and behavioral characteristics have good identification performance in the telephone network,but it is difficult to apply to the Internet where IP(Internet Protocol)addresses change dynamically.To address this issue,we propose a fraudulent IP identification method based on homology detection and DBSCAN(Density-Based Spatial Clustering of Applications with Noise)clustering(DC-FIPD).First,we analyze the aggregation of fraudulent IP geographies and the homology of IP addresses.Next,the collected fraudulent IPs are clustered geographically to obtain the regional distribution of fraudulent IPs.Then,we constructed the fraudulent IP feature set,used the genetic optimization algorithm to determine the weights of the fraudulent IP features,and designed the calculation method of the IP risk value to give the risk value threshold of the fraudulent IP.Finally,the risk value of the target IP is calculated and the IP is identified based on the risk value threshold.Experimental results on a real-world telecom fraud detection dataset show that the DC-FIPD method achieves an average identification accuracy of 86.64%for fraudulent IPs.Additionally,the method records a precision of 86.08%,a recall of 45.24%,and an F1-score of 59.31%,offering a comprehensive evaluation of its performance in fraud detection.These results highlight the DC-FIPD method’s effectiveness in addressing the challenges of fraudulent IP identification.
文摘Distributed Denial-of-Service (DDoS) attacks against public web servers are increasingly common. Countering DDoS attacks are becoming ever more challenging with the vast resources and techniques increasingly available to attackers. It is impossible for the victim servers to work on the individual level of on-going traffic flows. In this paper, we establish IP Flow which is used to select proper features for DDoS detection. The IP flow statistics is used to allocate the weights for traffic routing by routers. Our system protects servers from DDoS attacks without strong client authentication or allowing an attacker with partial connectivity information to repeatedly disrupt communications. The new algorithm is thus proposed to get efficiently maximum throughput by the traffic filtering, and its feasibility and validity have been verified in a real network circumstance. The experiment shows that it is with high average detection and with low false alarm and miss alarm. Moreover, it can optimize the network traffic simultaneously with defending against DDoS attacks, thus eliminating efficiently the global burst of traffic arising from normal traffic.
文摘This In the past decade there has been an increasing need for designs to address the time and cost efficiency issues from various computer network applications such as general IP address lookup and specific network intrusion detection. Hashing techniques have been widely adopted for this purpose, among which XOR-operation-based hashing is one of most popular techniques due to its relatively small hash process delay. In most current commonly used XOR-hashing algorithms, each of the hash key bits is usually explicitly XORed only at most once in the hash process, which may limit the amount of potential randomness that can be introduced by the hashing process. In [1] a series of bit duplication techniques are proposed by systematically duplicating one row of key bits. This paper further looks into various ways in duplicating and reusing key bits to maximize randomness needed in the hashing process so as to enhance the overall performance further. Our simulation results show that, even with a slight increase in hardware requirement, a very significant reduction in the amount of hash collision can be obtained by the proposed technique.
文摘通过构建整数线性规划(ILP)来计算网络的能耗,求解ILP的解需要的计算机内存空间大,但内存不足仍然是需要考虑的问题之一。针对这一问题,提出了一种基于K算法来设计绿色IP over WDM网络的方法,该方法是基于传统的虚拓扑网络业务疏导方法,首先利用K算法求解网络中节点与节点之间的K条可能路径,然后通过构建整数线性规划(ILP)来求解网络资源的分布。分析网络能耗的模型,利用数学表达式来描述基于K算法下3种IP over WDM网络的能耗。
文摘针对IP over WDM网络,建立了整数线性规划(ILP)最小功耗模型,计算了满足峰值业务需要开启的设备数目;对于低峰业务提出休眠机制,分别利用最小光路数算法与最小跳数算法,在保证连接无阻塞的情况下找出空闲设备,对比峰值业务得到不同算法下的设备使用率,确定IP over WDM网络的节能潜力。结果表明,ILP优化模型的网络功耗最小,最小光路数算法次之;低峰业务下利用休眠机制可以关闭设备的比例占40%～60%;采用最小光路数算法的休眠机制节能效果较优。
文摘Problems of the current IGMP mechanism were identified, such as unnecessary periodic probing of hosts and leave latency, which wastes bandwidth and cause more traffic and overhead. Alternative mechanism that preserve the IP multicast model but employ join/leave messages to track local group membership for broadcast LANs (shared medium LANs) was proposed in this paper. We describe the implementation requirements of the new mechanism and compare it to existing one, demonstrating that join/leave approach is uniformly superior for the environment of broadcast LANs.
