New developments in network forensics - tools and techniques

Network forensics is a branch of digital forensics which has evolved recently as a very important discipline used in monitoring and analysing network traffic-particularly for the purposes of tracing intrusions and attacks. This paper presents an analysis of the tools and techniques used in network forensic analysis. It further examines the application of network forensics to vital areas such as malware and network attack detection; IP traceback and honeypots; and intrusion detection. Further, the paper addresses new and emerging areas of network forensic development which include critical infrastructure forensics, wireless network forensics, as well as its application to social networking. © 2012 IEEE.

Feel bored? Join Verse! Engineering Vehicular Proximity Social Network

Travellers in vehicles often have strong willingness to share their travel experience and exchange information to each other through social networks2, such as Facebook and Twitter. This, however, can be costly due to the limited connections to Internet on the road. In this paper we develop Verse to facilitate the social communications among vehicle travellers on highways. Verse enables passengers on-board vehicles to share the content information, such as travel blogs with pictures, among each other using the impromptu wireless inter-vehicle communications. Unlike traditional online social networks, which are built upon the reliable IP networks, vehicular social networks face fundamental challenges in that: 1) users are anonymous and strangers to each other and hard to identify potential friends of shared interests, and 2) users communicate through intermittent and unreliable inter-vehicle connections. On addressing the two challenges, Verse implements a friend recommendation function, which helps passengers efficiently identify potential social friends with both shared interests and relatively reliable wireless connections. In addition, Verse is equipped with a social-aware rate control scheme towards efficient utilization of network bandwidth. Using extensive simulations, we show that the friend recommendation function of Verse can effectively predict the mobility of vehicles to assist the social communication, and the social-aware rate control scheme quickly and efficiently adapts the vehicle’s transmission rate according to their social impacts.

A feasible IP traceback framework through dynamic deterministic packet marking

DDoS attack source traceback is an open and challenging problem. Deterministic packet marking (DPM) is a simple and effective traceback mechanism, but the current DPM based traceback schemes are not practical due to their scalability constraint. We noticed a factor that only a limited number of computers and routers are involved in an attack session. Therefore, we only need to mark these involved nodes for traceback purpose, rather than marking every node of the Internet as the existing schemes doing. Based on this finding, we propose a novel marking on demand (MOD) traceback scheme based on the DPM mechanism. In order to traceback to involved attack source, what we need to do is to mark these involved ingress routers using the traditional DPM strategy. Similar to existing schemes, we require participated routers to install a traffic monitor. When a monitor notices a surge of suspicious network flows, it will request a unique mark from a globally shared MOD server, and mark the suspicious flows with the unique marks. At the same time, the MOD server records the information of the marks and their related requesting IP addresses. Once a DDoS attack is confirmed, the victim can obtain the attack sources by requesting the MOD server with the marks extracted from attack packets. Moreover, we use the marking space in a round-robin style, which essentially addresses the scalability problem of the existing DPM based traceback schemes. We establish a mathematical model for the proposed traceback scheme, and thoroughly analyze the system. Theoretical analysis and extensive real-world data experiments demonstrate that the proposed traceback method is feasible and effective.

Uma Solução baseada em políticas para gerenciamento integrado de QoS e Multicast em redes IP

Aplicações como videoconferência, vídeo sob-demanda, aplicações de ensino a distância, entre outras, utilizam-se das redes de computadores como infra-estrutura de apoio. Mas para que tal uso seja efetivo, as redes de computadores, por sua vez, devem fornecer algumas facilidades especiais para atender às necessidades dessas aplicações. Dentre as facilidades que devem ser fornecidas estão os suportes à qualidade de serviço (QoS - Quality of Service) e as transmissões multicast. Além do suporte a QoS e multicast nas redes, é necessário fornecer um gerenciamento da rede adequado às expectativas de tais aplicações. Soluções que fornecem gerenciamento de forma individual para tais facilidades, já foram propostas e implementadas. Entretanto, estas soluções não conseguem agir de modo integrado, o que torna a tarefa do gerente da rede extremamente complexa e difícil de ser executada, pois possibilitam um fornecimento não adequado das facilidades desejadas às aplicações. Nesta dissertação é apresentada uma solução para gerenciamento integrado de QoS e multicast. Fazem parte da solução: a definição e implementação de uma arquitetura para gerenciamento integrado de QoS e multicast, utilizando gerenciamento baseado em políticas (PBNM - Policy-Based Network Management), além da validação da solução proposta através da implementação de um protótipo. Um ambiente, condições de teste, e análise dos resultados obtidos, também são apresentados durante a dissertação.

Uma ferramenta de manipulação de pacotes para análise de protocolos de redes industriais baseados em TCP/IP

This work presents a packet manipulation tool developed to realize tests in industrial devices that implements TCP/IP-based communication protocols. The tool was developed in Python programming language, as a Scapy extension. This tool, named IndPM- Industrial Packet Manipulator, can realize vulnerability tests in devices of industrial networks, industrial protocol compliance tests, receive server replies and utilize the Python interpreter to build tests. The Modbus/TCP protocol was implemented as proof-of-concept. The DNP3 over TCP protocol was also implemented but tests could not be realized because of the lack of resources. The IndPM results with Modbus/TCP protocol show some implementation faults in a Programmable Logic Controller communication module frequently utilized in automation companies

Constructive heuristic algorithm for the DC model in network transmission expansion planning

A novel constructive heuristic algorithm to the network expansion planning problem is presented the basic idea comes from Garver's work applied to the transportation model, nevertheless the proposed algorithm is for the DC model. Tests results with most known systems in the literature are carried out to show the efficiency of the method.

Transmission network expansion planning with security constraints

A mathematical model and a methodology to solve the transmission network expansion planning problem with security constraints are presented. The methodology allows one to find an optimal and reliable transmission network expansion plan using a DC model to represent the electrical network. The security (n-1) criterion is used. The model presented is solved using a genetic algorithm designed to solve the reliable expansion planning in an efficient way. The results obtained for several known systems from literature show the excellent performance of the proposed methodology. A comparative analysis of the results obtained with the proposed methodology is also presented.

Specialised branch-and-bound algorithm for transmission network expansion planning

An algorithm is presented that finds the optimal plan long-term transmission for till cases studied, including relatively large and complex networks. The knowledge of optimal plans is becoming more important in the emerging competitive environment, to which the correct economic signals have to be sent to all participants. The paper presents a new specialised branch-and-bound algorithm for transmission network expansion planning. Optimality is obtained at a cost, however: that is the use of a transportation model for representing the transmission network, in this model only the Kirchhoff current law is taken into account (the second law being relaxed). The expansion problem then becomes an integer linear program (ILP) which is solved by the proposed branch-and-bound method without any further approximations. To control combinatorial explosion the branch- and bound algorithm is specialised using specific knowledge about the problem for both the selection of candidate problems and the selection of the next variable to be used for branching. Special constraints are also used to reduce the gap between the optimal integer solution (ILP program) and the solution obtained by relaxing the integrality constraints (LP program). Tests have been performed with small, medium and large networks available in the literature.

Efficient linear programming algorithm for the transmission network expansion planning problem

The transmission network planning problem is a non-linear integer mixed programming problem (NLIMP). Most of the algorithms used to solve this problem use a linear programming subroutine (LP) to solve LP problems resulting from planning algorithms. Sometimes the resolution of these LPs represents a major computational effort. The particularity of these LPs in the optimal solution is that only some inequality constraints are binding. This task transforms the LP into an equivalent problem with only one equality constraint (the power flow equation) and many inequality constraints, and uses a dual simplex algorithm and a relaxation strategy to solve the LPs. The optimisation process is started with only one equality constraint and, in each step, the most unfeasible constraint is added. The logic used is similar to a proposal for electric systems operation planning. The results show a higher performance of the algorithm when compared to primal simplex methods.

Analysis of heuristic algorithms for the transportation model in static and multistage planning in network expansion systems

The usefulness of the application of heuristic algorithms in the transportation model, first proposed by Garver, is analysed in relation to planning for the expansion of transmission systems. The formulation of the mathematical model and the solution techniques proposed in the specialised literature are analysed in detail. Starting with the constructive heuristic algorithm proposed by Garver, an extension is made to the problem of multistage planning for transmission systems. The quality of the solutions found by heuristic algorithms for the transportation model is analysed, as are applications in problems of planning transmission systems.

Test systems and mathematical models for transmission network expansion planning

The data of four networks that can be used in carrying out comparative studies with methods for transmission network expansion planning are given. These networks are of various types and different levels of complexity. The main mathematical formulations used in transmission expansion studies-transportation models, hybrid models, DC power flow models, and disjunctive models are also summarised and compared. The main algorithm families are reviewed-both analytical, combinatorial and heuristic approaches. Optimal solutions are not yet known for some of the four networks when more accurate models (e.g. The DC model) are used to represent the power flow equations-the state of the art with regard to this is also summarised. This should serve as a challenge to authors searching for new, more efficient methods.

Simulation in NS-2 of DNP3 protocol encapsulated over TCP/IP in smart grid applications

In dealing with computer networks, these allow the flow of information through the resources of various equipment's. This work describes the implementation through the encapsulation of Protocol DNP3, usually employed in Smart Grid communication, in a simulator of discrete events. The NS-2 is a simulator in open source of network events, that facilitate the development of communication networks scenarios considering the protocols involved, in wireless or wired technologies. The objective of this work is to develop the DNP3 protocol encapsulation over a TCP/IP in the in the discrete event Simulator NS-2, allowing an analysis of behavior of a middle or large network sized in Smart Grid applications. © 2013 IEEE.

Monitoramento de hosts em redes tcp/ip sobre base georreferenciada com métricas de qualidade

Coordenação de Aperfeiçoamento de Pessoal de Nível Superior (CAPES)

Esperimenti di Modularizzazione dello Stack TCP-IP di Linux

In questo lavoro si introduce il progetto di estrarre lo stack tcp-ip dal kernel di linux e farlo funzionare come una normale libreria in userspace. Si parlerà dei vantaggi di avere lo stack tcp-ip in userspace, di altri progetti simili, del motivo per cui si è scelto lo stack di linux, dei principali problemi incontrati nel corso del lavoro, del percorso seguito, e di come il risultato possa essere migliorato per renderlo uno strumento effettivamente utile.