Based on the analysis of the covert channel＇s working mechanism of the internet control message protocol （ICMP） in internet protocol version 4 （IPv4） and Internet Protocol version 6 （IPv6）, the ICMP covert cha...Based on the analysis of the covert channel＇s working mechanism of the internet control message protocol （ICMP） in internet protocol version 4 （IPv4） and Internet Protocol version 6 （IPv6）, the ICMP covert channd＇s algorithms of the IPv4 and IPv6 are presented, which enable automatic channeling upon IPv4/v6 nodes with non-IPv4-compatible address, and the key transmission is achieved by using this channel in the embedded Internet terminal. The result shows that the covert channel＇s algorithm, which we implemented if, set correct, the messages of this covert channel might go through the gateway and enter the local area network.展开更多
The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not eas...The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not easy to be discovered.Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions.In this paper,we propose an ICMP covert tunnel attack intent detection framework ICMPTend,which includes five steps:data collection,feature dictionary construction,data preprocessing,model construction,and attack intent prediction.ICMPTend can detect a variety of attack intentions,such as shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attacks.We extract features from five types of attack intent found in ICMP channels.We build a multi-dimensional dictionary of malicious features,including shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attack keywords.For the high-dimensional and independent characteristics of ICMP traffic,we use a support vector machine(SVM)as a multi-class classifier.The experimental results show that the average accuracy of ICMPTend is 92%,training ICMPTend only takes 55 s,and the prediction time is only 2 s,which can effectively identify the attack intention of ICMP.展开更多
There is a lack of appropriate guidelines for realistic user traces, mobility models, routing protocols, considerations of real-life challenges, etc. for general-purpose mobile ad hoc networks （MANET）. In this paper...There is a lack of appropriate guidelines for realistic user traces, mobility models, routing protocols, considerations of real-life challenges, etc. for general-purpose mobile ad hoc networks （MANET）. In this paper, four laptops are used in an open field environment in four scenarios to evaluate the performances of Internet control message protocol （ICMP） based ping and transmission control protocol （TCP） based streaming video applications using optimised link state routing （OLSR） implementation in an IEEE 802.11g wireless network. Corresponding simulations are developed in Network Simulator ns-2 by setting simulation parameters according to the real experiments. Difficulties faced to regenerate real-life scenarios have been discussed and the gaps between reality and simulation are identified. A setup guideline to produce realistic simulation results has been established.展开更多
Two significant issues in Internet-based networked control systems （ INCSs）, transport performance of different protocols and security breach from Internet side, are investigated. First, for improving the performanc...Two significant issues in Internet-based networked control systems （ INCSs）, transport performance of different protocols and security breach from Internet side, are investigated. First, for improving the performance of data transmission, user datagram protocol （UDP） is adopted as the main stand for controllers and plants using INCSs. Second, a dual-channel secure transmission scheme （DCSTS）based on data transmission characteristics of INCSs is proposed, in which a raw UDP channel and a secure TCP （transmission control protocol） connection making use of SSL/TLS （secure sockets layer/transport layer security） are included. Further, a networked control protocol （NCP） at application layer for supporting DCSTS between the controllers and plants in INCSs is designed, and it also aims at providing a universal communication mechanism for interoperability of devices among the networked control laboratories in Beijing Institute of Technology of China, Central South University of China and Tokyo University of Technology of Japan. By means of a networked single-degree-of-free- dom robot arm, an INCS under the new protocol and security environment is created. Compared with systems such as IPSec or SSL/TLS, which may cause more than 91% network throughput deduction, the new DCSTS protocol may yield results ten times better, being just 5.67%.展开更多
简要介绍了TCP/IP(Transmission Control Protocol/Internet Protocol)通讯协议、Windows Sockets(Winsock)和VisualC#6.0编程环境,阐述了利用Winsock和VisualC#6.0在Internet上实现计算机远程控制的原理和方法。计算机远程控制包括两...简要介绍了TCP/IP(Transmission Control Protocol/Internet Protocol)通讯协议、Windows Sockets(Winsock)和VisualC#6.0编程环境,阐述了利用Winsock和VisualC#6.0在Internet上实现计算机远程控制的原理和方法。计算机远程控制包括两个部分:通讯部分和命令处理部分。通讯部分主要是通过调用Winsock中的函数来实现服务器端和客户端的连接与数据通讯。命令处理部分在VisualC6.0环境下编程实现,进行相应的命令处理。为了保证数据传输的正确性、顺序性和不重复,采用了面向连接的协议TCP,提供无边界的字节流的传输。计算机远程控制可以实现上传文件、下载文件、在服务器端执行文件、删除文件、搜索文件、注销当前用户、重新启动远程计算机、关闭远程计算机、键盘和鼠标的加锁与解锁、查看远程计算机的屏幕、进程管理、列出远程计算机的系统信息等功能。实践证明,这种方法是灵活有效而且可行的。展开更多
基金Supported by the National Natural Science Foun-dation of China (90104005 ,66973034)
文摘Based on the analysis of the covert channel＇s working mechanism of the internet control message protocol （ICMP） in internet protocol version 4 （IPv4） and Internet Protocol version 6 （IPv6）, the ICMP covert channd＇s algorithms of the IPv4 and IPv6 are presented, which enable automatic channeling upon IPv4/v6 nodes with non-IPv4-compatible address, and the key transmission is achieved by using this channel in the embedded Internet terminal. The result shows that the covert channel＇s algorithm, which we implemented if, set correct, the messages of this covert channel might go through the gateway and enter the local area network.
基金This research was supported by National Natural Science Foundation of China(Grant Nos.61972048,62072051).
文摘The Internet Control Message Protocol(ICMP)covert tunnel refers to a network attack that encapsulates malicious data in the data part of the ICMP protocol for transmission.Its concealment is stronger and it is not easy to be discovered.Most detection methods are detecting the existence of channels instead of clarifying specific attack intentions.In this paper,we propose an ICMP covert tunnel attack intent detection framework ICMPTend,which includes five steps:data collection,feature dictionary construction,data preprocessing,model construction,and attack intent prediction.ICMPTend can detect a variety of attack intentions,such as shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attacks.We extract features from five types of attack intent found in ICMP channels.We build a multi-dimensional dictionary of malicious features,including shell attacks,sensitive directory access,communication protocol traffic theft,filling tunnel reserved words,and other common network attack keywords.For the high-dimensional and independent characteristics of ICMP traffic,we use a support vector machine(SVM)as a multi-class classifier.The experimental results show that the average accuracy of ICMPTend is 92%,training ICMPTend only takes 55 s,and the prediction time is only 2 s,which can effectively identify the attack intention of ICMP.
文摘There is a lack of appropriate guidelines for realistic user traces, mobility models, routing protocols, considerations of real-life challenges, etc. for general-purpose mobile ad hoc networks （MANET）. In this paper, four laptops are used in an open field environment in four scenarios to evaluate the performances of Internet control message protocol （ICMP） based ping and transmission control protocol （TCP） based streaming video applications using optimised link state routing （OLSR） implementation in an IEEE 802.11g wireless network. Corresponding simulations are developed in Network Simulator ns-2 by setting simulation parameters according to the real experiments. Difficulties faced to regenerate real-life scenarios have been discussed and the gaps between reality and simulation are identified. A setup guideline to produce realistic simulation results has been established.
文摘Two significant issues in Internet-based networked control systems （ INCSs）, transport performance of different protocols and security breach from Internet side, are investigated. First, for improving the performance of data transmission, user datagram protocol （UDP） is adopted as the main stand for controllers and plants using INCSs. Second, a dual-channel secure transmission scheme （DCSTS）based on data transmission characteristics of INCSs is proposed, in which a raw UDP channel and a secure TCP （transmission control protocol） connection making use of SSL/TLS （secure sockets layer/transport layer security） are included. Further, a networked control protocol （NCP） at application layer for supporting DCSTS between the controllers and plants in INCSs is designed, and it also aims at providing a universal communication mechanism for interoperability of devices among the networked control laboratories in Beijing Institute of Technology of China, Central South University of China and Tokyo University of Technology of Japan. By means of a networked single-degree-of-free- dom robot arm, an INCS under the new protocol and security environment is created. Compared with systems such as IPSec or SSL/TLS, which may cause more than 91% network throughput deduction, the new DCSTS protocol may yield results ten times better, being just 5.67%.
文摘简要介绍了TCP/IP(Transmission Control Protocol/Internet Protocol)通讯协议、Windows Sockets(Winsock)和VisualC#6.0编程环境,阐述了利用Winsock和VisualC#6.0在Internet上实现计算机远程控制的原理和方法。计算机远程控制包括两个部分:通讯部分和命令处理部分。通讯部分主要是通过调用Winsock中的函数来实现服务器端和客户端的连接与数据通讯。命令处理部分在VisualC6.0环境下编程实现,进行相应的命令处理。为了保证数据传输的正确性、顺序性和不重复,采用了面向连接的协议TCP,提供无边界的字节流的传输。计算机远程控制可以实现上传文件、下载文件、在服务器端执行文件、删除文件、搜索文件、注销当前用户、重新启动远程计算机、关闭远程计算机、键盘和鼠标的加锁与解锁、查看远程计算机的屏幕、进程管理、列出远程计算机的系统信息等功能。实践证明,这种方法是灵活有效而且可行的。
