Jaehak Yu

Traffic flooding attack detection with SNMP MIB using SVM

Recently, as network flooding attacks such as DoS/DDoS and Internet Worm have posed devastating threats to network services, rapid detection and proper response mechanisms are the major concern for secure and reliable network services. However, most of the current Intrusion Detection Systems (IDSs) focus on detail analysis of packet data, which results in late detection and a high system burden to cope with high-speed network traffic. Little or no integration exists between IDS and SNMP-based network management, in spite of the extensive monitoring and statistical information provided by SNMP agents implemented on network devices and systems. In this paper we propose a lightweight and fast detection mechanism for traffic flooding attacks. Firstly, we use SNMP MIB statistical data gathered from SNMP agents, instead of raw packet data from network links. The involved SNMP MIB variables are selected by an effective feature selection mechanism and gathered effectively by the MIB update time prediction mechanism. Secondly, we use a machine learning approach based on a Support Vector Machine (SVM) for attack classification. Using MIB and SVM, we achieved fast detection with high accuracy, the minimization of the system burden, and extendibility for system deployment. The proposed mechanism is constructed in a hierarchical structure, which first distinguishes attack traffic from normal traffic and then determines the type of attacks in detail. Using MIB datasets collected from real experiments involving a DDoS attack, we validate the possibility of our approaches. It is shown that network attacks are detected with high efficiency, and classified with low false alarms.

Real-time classification of internet application traffic using a hierarchical multi-class SVM

In this paper, we propose a hierarchical application traffic classification system as an alternative means to overcome the limitations of the port number and payload based methodologies, which are traditionally considered traffic classification methods. The proposed system is a new classification model that hierarchically combines a binary classifier SVM and Support Vector Data Descriptions (SVDDs). The proposed system selects an optimal attribute subset from the bi-directional traffic flows generated by our traffic analysis system (KU-MON) that enables real-time collection and analysis of campus traffic. The system is composed of three layers: The first layer is a binary classifier SVM that performs rapid classification between P2P and non-P2P traffic. The second layer classifies P2P traffic into file-sharing, messenger and TV, based on three SVDDs. The third layer performs specialized classification of all individual application traffic types. Since the proposed system enables both coarse- and fine-grained classification, it can guarantee efficient resource management, such as a stable network environment, seamless bandwidth guarantee and appropriate QoS. Moreover, even when a new application emerges, it can be easily adapted for incremental updating and scaling. Only additional training for the new part of the application traffic is needed instead of retraining the entire system. The performance of the proposed system is validated via experiments which confirm that its recall and precision measures are satisfactory.

A unified scheme of shot boundary detection and anchor shot detection in news video story parsing

In this paper, we propose an efficient one-pass algorithm for shot boundary detection and a cost-effective anchor shot detection method with search space reduction, which are unified scheme in news video story parsing. First, we present the desired requirements for shot boundary detection from the perspective of news video story parsing, and propose a new shot boundary detection method, based on singular value decomposition, and a newly developed algorithm, viz., Kernel-ART, which meets all of these requirements. Second, we propose a new anchor shot detection system, viz., MASD, which is able to detect anchor person cost-effectively by reducing the search space. It consists of skin color detector, face detector, and support vector data descriptions with non-negative matrix factorization sequentially. The experimental results with the qualitative analysis illustrate the efficiency of the proposed method.

An in-depth analysis on traffic flooding attacks detection and system using data mining techniques

Recently, as network traffic flooding attack such as DoS and DDoS have posed devastating threats on network services, rapid detection, and semantic analysis are the major concern for secure and reliable network services. In addition, in a recent issue of the safety and comfort of vehicles and communication technologies for service is required. We propose a traffic flooding attack detection and an in-depth analysis system that uses data mining techniques. In this paper we (1) designed and implemented a system that detects traffic flooding attacks. Then, it executes classification by attack type and it uses SNMP MIB information based on C4.5 algorithm; (2) conducted a semantic interpretation that extracts and analyzes the rules of execution mechanism that are additionally provided by C4.5; (3) performed an in-depth analysis on the attack patterns and useful knowledge inherent in their data by type, utilizing association rule mining. Classification by attack and attack type based on C4.5 and association rules, automatic rule extraction and semantic in-depth interpretation, which are proposed in this paper, provide a positive possibility to add momentum towards the development of new methodologies for intrusion detection systems as well as to support establishing policies for intrusion detection and response systems.

Adaptive Internet of Things and Web of Things convergence platform for Internet of reality services

Recently, Internet of things (IoT) and Web of Things (WoT) lead us to the excellent era of connected everything device. However, the devices hardly show the property of the autonomous connectivity and the self-cooperation for applying in real-world environments. The purpose of this paper was to propose the adaptive IoT and WoT convergence platform that enables things to dynamically implement the smart Web without any controls from users. The adaptive IoT and WoT convergence platform, proposed in this paper, is a new type of platform which provides global inter-compatibility to help users to easily communicate with things by connecting through the webs. Through mashup of the things connected to the Web, coarsely or finely, this proposal can guarantee an efficient IoT or WoT platform management, adaptive synchronization between the things, a stable platform environment, and creating new services. The performance of our proposed platform is tested via experiments which verify that its simulations are satisfactory.

IoT as a applications: cloud-based building management systems for the internet of things

Recently, excellent by Internet of Things (IoT), the era of connected everything device is coming. However, the devices hardly show the manner to autonomous connectivity on it and the self-cooperation for applied to real-world environments. In this paper, we proposed a smart building on IoT and cloud-based technology that can perform collaboration and efficient operation with various sensing devices in building and facilities. The smart building is very important to reduce on a huge amount of building energy is consumed by the management system of buildings. The proposed system selects an optimum device feature subset from the computing resources and storages by our cloud-based building management system. The performance of our proposed system is tested via experiments which verify that its measures are satisfactory.

NetCube: a comprehensive network traffic analysis model based on multidimensional OLAP data cube

SUMMARY Network traffic monitoring and analysis are essential for effective network operation and resource management. In particular, multidimensional analysis for long-term traffic data is necessary for comprehensive understanding of the traffic trend and effective quality-of-service provision considering the extremely dynamic behavior of the current Internet, where various types of traffic occur from high-speed network links and greatly increasing number of applications. However, only limited analysis results are provided, as the existing network traffic analysis tools and systems are developed and deployed focusing on their own specialized analysis purposes. Consequently, it is difficult to understand the network comprehensively and deeply, which increases the necessity for multilateral analysis of long-term traffic data. In this paper, we propose a novel traffic analysis model for large volumes of Internet traffic accumulated over a long period of time. The NetCube, the proposed network traffic analysis model using online analytical processing (OLAP) on a multidimensional data cube, provides an easy and fast way to construct a multidimensional traffic analysis system for comprehensive and detailed analysis of long-term traffic data by utilizing simple OLAP operations and powerful data-mining techniques on various abstraction levels of traffic data to complete the analysis purpose. We validate the feasibility and applicability of the proposed NetCube traffic analysis model by implementing a traffic analysis system and applying it to our campus network. Copyright

Real-time cooling load forecasting using a hierarchical multi-class SVDD

In this paper, we propose a real-time cooling load forecasting system in order to overcome the problems of the conventional methods. The proposed system is a new load forecasting model that hierarchically combines Support Vector Data Descriptions (SVDDs). The proposed system selects an optimal attribute subset by our cooling load forecasting system that enables real-time load data generation and collection. The system is composed of two layers: The first layer predicts the time slots in three representative forms: morning, midday and afternoon. The second layer performs specialized prediction of each individual time slot. Since the proposed system enables both coarse-and fine-grained forecasting, it can efficient cooling load management. Moreover, even when a new time slot emerges, it can be easily adapted for incremental updating and scaling. The performance of the proposed system is validated via experiments which confirm that the recall and precision measures of the method are satisfactory.

Cloud-based building management systems using short-term cooling load forecasting

In this paper, we propose a novel cloud-based building management system (BMS) architecture for a short-term cooling load forecasting mechanism to manage the building cooling system (BCS) and reduce the cost of BCS construction and maintenance. The BCS is very important to economize on air conditioning since a huge amount of energy is consumed by the cooling system of buildings in summer time and some recent work has attempted to manage the BCS using short-term cooling load forecasting. In order to have accurate forecasts, however, excellent computing systems are necessary to predict and control the BCS based on a huge amount of past energy consumption data with rapid processing speed. Hence, in the proposed architecture, we use centralized computing resources and storages to predict and control the BCS. Furthermore, we propose a model with short-term cooling load forecasting and semantic analysis system that uses data mining techniques to improve the forecasting accuracy. Through our performance results, the proposed forecasting model outperforms another scheme in terms of the forecasting accuracy to control the BCS and it is expected that the cost of the BCS maintenance will be greatly reduced with the cloud-based BMS architecture.

WISE: web of object architecture on IoT environment for smart home and building energy management

Fog computing extends cloud-based computing concept to the edge of the network, thus enabling a breed of services and applications. Previous research topics on fog computing have significantly focused on the concepts and fundamentals of fog computing and its importance in the context of Internet of things (IoT) and Web of object (WoO). Recently, inspired by IoT and WoO, the era of connecting all the things and people is coming. Unfortunately, various devices and objects in IoT environments hardly show the method for automatic connection and the cooperation applied to IoT applications and services. Firstly, in this paper we propose WoO based on the architecture which contains various devices and objects for providing Web base IoT services and applications. Secondly, various service overlay network concepts for providing mashup by service federation and composition are introduced. Also, we describe service deployment architecture over smart home IoT architecture on fog computing environment. Thirdly, we propose a new architecture for selecting optimal objects or things attributed from the metadata, resource and profiles by our WoO-based smart building energy prediction methodology.