Frédéric Beck

Monitoring the Neighbor Discovery Protocol

While IPv6 is increasingly being deployed in networks, including ISPs, the need to monitor and manage the associated protocols increases. In this paper we focus on the Neighbor Discovery Protocol and we motivate the importance to monitor it. We also present our approach for this task together with the functionalities we provide and the software, NDPMon, that we developed.

Automated and secure IPv6 configuration in enterprise networks

Over the last decade, IPv6 has established itself as the most mature network protocol for the future Internet. Its recent deployment in core networks of operators, its availability to end customers of multiple ISPs together with the availability of native access to large services like Google assess the increasing penetration of IPv6.

A Monitoring Approach for Safe IPv6 Renumbering

Network renumbering is a very interesting feature of IPv6. It is also one of the most risky procedures which need special attention in the management plane. In this paper we identify the challenges of renumbering and demonstrate how monitoring can improve this process. We also present an implementation of a monitoring framework and share the experience gained in its deployment

A platform for the analysis and visualization of network flow data of android environments

In this demo, we present a monitoring platform dedicated to the collection, storage, analysis and visualization of logs and network flow data of mobile applications. The platform relies on a set of on-device probes to monitor network and system activities of these applications. The data are collected from these probes and parsed through generic and flexible collectors relying on Flume agents that we have adapted and extended. We are storing the collected data using a column oriented Hbase storage engine which is the Hadoop database. Finally, after being parsed, the data are made available within the Elasticsearch engine to search and visualize them using the Kibana tool.

Empirical analysis of Android logs using self-organizing maps

In this paper, we present an empirical analysis of the logs generated by the logging system available in Android environments. The logs are mainly related to the execution of the different components of applications and services running on an Android device. We have analysed the logs using self organizing maps where our goal is to establish behavioural fingerprints of Android applications. Each fingerprint is build using information available in logs and related to the structure of an application and its interaction with the system. The developed methodology allows us the better understand Android Apps regarding their granted permissions and performed actions and it proves to be promising for the analysis of malware applications with a minimal overhead and cost.

Autonomic renumbering in the future iInternet

IPv6 is an essential building block of the evolution toward the future Internet. To take the full benefit of this protocol and exploit all its features, the future Internet needs to gracefully couple it with autonomics. In this article we demonstrate through our experience with network renumbering how the coupling of both IPv6 core functionality extended with major functions of the autonomic world can lead to fully autonomous activities of main management functions. We instantiate the notions of self-configuration, self-monitoring, self-protection, and self-healing in the network renumbering process and show how all together they can make renumbering a real success. We illustrate the various functions with the tools we have implemented to support them.

Optimizing internet scanning for assessing industrial systems exposure

Industrial systems are composed of multiple components whose security has not been addressed for a while. Even if recent propositions target to improve it, they are still often exposed to vulnerabilities, since their components are hard to update or replace. In parallel, they tend to be more and more exposed in the public Internet for convenience. Although awareness of such a problem has been raised, there is no precise evaluation of such a risk. In this paper, we define a methodology to measure the exposure of industrial systems through Internet. In particular, a carefully designed scanning approach, named WiScan, is proposed with a low footprint due to the high sensitivity and low resources of targeted systems. It has been applied on the entire IPv4 address space, by targeting specific SCADA ports.