James Won-Ki Hong

A flow-based method for abnormal network traffic detection

One recent trend in network security attacks is an increasing number of indirect attacks which influence network traffic negatively, instead of directly entering a system and damaging it. In future, damages from this type of attack are expected to become more serious. In addition, the bandwidth consumption by these attacks influences the entire network performance. This paper presents an abnormal network traffic detecting method and a system prototype. By aggregating packets that belong to the identical flow, we can reduce processing overhead in the system. We suggest a detecting algorithm using changes in traffic patterns that appear during attacks. This algorithm can detect even mutant attacks that use a new port number or changed payload, while signature-based systems are not capable of detecting these types of attacks. Furthermore, the proposed algorithm can identify attacks that cannot be detected by examining only single packet information.

Towards automated application signature generation for traffic identification

Traditionally, Internet applications have been identified by using predefined well-known ports with questionable accuracy. An alternative approach, application-layer signature mapping, involves the exhaustive search of reliable signatures but with more promising accuracy. With a prior protocol knowledge, the signature generation can guarantee a high accuracy. As more applications use proprietary protocols, it becomes increasingly difficult to obtain an accurate signature while avoiding time-consuming and manual signature generation process. This paper proposes an automated approach for generating application-level signature, the LASER algorithm, that does not need to be preceded by an analysis of application protocols. We show that our approach is as accurate and efficient as the approach that uses preceding application protocol analysis.

XML-based configuration management for IP network devices

As the Internet continues to grow, the tasks of operations and management of IP networks and systems are becoming more difficult. Over the past few years, much effort has been given to improve the deficiencies of SNMP, but most have failed to be standardized. One critical deficiency of SNMP is in the area of configuration management. Recent work focuses on the use of XML technology for network and service management as an alternative or complementary approach to SNMP. This article presents the IETFs latest effort, Netconf, which is viewed by many as a promising revolutionary solution for configuration management. To validate this new effort, we present the design and implementation of an XML-based configuration management system based on Netconf. We also discuss our experience with XCMS and make some suggestions for improving the current Netconf protocol.

Characteristic analysis of internet traffic from the perspective of flows

The necessity of network traffic monitoring and analysis is growing dramatically with increasing network usage demands from individual users as well as business communities. Most network traffic monitoring and analysis systems are based on flows. One key asset with these systems is to compress a significant amount of packet data into flows. However, the compression ratio is highly variable in the recent network environments due to the increased use of peer-to-peer file sharing applications and the frequent appearances of abnormal traffic caused by Internet worms, which negatively influences the performance of traffic analysis systems. The performance of traffic monitoring and analysis systems highly depends on the number of flows as well as link utilization and the pattern of packet arrival. This paper examines the characteristics of recent Internet traffic from the perspective of flows. We found that the frequent occurrence of flash flows highly affects the performance of the existing flow-based traffic monitoring systems. Using various flow-related metrics, we analyzed the IP traffic traces collected from the Internet junction at POSTECH, a university with over 6000 end hosts and servers.

Web-based intranet services and network management

Intranets are composed of a network of various devices, systems, and services supporting a wide variety of applications within an organization. Providing a secure, reliable, and efficient operating environment to support the organizations daily activities and its business is the most challenging task faced by operations and management staff today. Current management practices typically involve the use of separate, incompatible tools and techniques for managing networks, systems, and applications. What is needed desperately is a simple, uniform framework for managing not only networks but also systems and applications. Web-based management is a promising approach that can provide a truly integrated management solution. This article examines the key emerging technologies involved in Web-based management. The authors present an integrated architecture that can be used to manage all the networking and computing resources in an Intranet. Also presented are several specific examples where Web technology has been applied in managing different target resources for validating the architecture.

Usage pattern analysis of smartphones

Recently, mobile traffic has increased tremendously due to the deployment of smart devices such as smartphones and smart tablets. These devices use various types of access networks such as 3G, WiFi, and mobile WiMAX. Network service providers also provide these access networks with various types of plans. There is a growing need to manage these smart devices and mobile networks. However, research on mobile network management has focused on the performance of the network itself. Few research has focused on applying the usage patterns of smartphone users to mobile network management. In this paper, we present an analysis of smartphone usage patterns. We define the five possible states of a smartphone based on such a phones basic operations. We collected real usage log data from real smartphone users over a two month period. We show that all users have their own usage pattern. We present a case study in order to show how to apply usage pattern information to power management of smartphones. We also discuss how to apply such information to mobile device management and network management.

Towards Peer-to-Peer Traffic Analysis Using Flows

One of the main problems with today’s Internet traffic analysis is caused by the large number of network-based applications whose types and traffic patterns are more complicated than in the past. Today, peer-to-peer (P2P), streaming media, and game traffic are continuously increasing. The difficulty the traffic analysis is that this newly emerging traffic is not as simple as past well-known port based traffic. This paper focuses on analyzing P2P traffic, which is the most complicated traffic among newly emerging Internet traffic. We describe the properties of P2P traffic and explain why P2P traffic analysis is more difficult than other types of Internet traffic analysis. Next, we propose a new algorithm suitable for P2P traffic analysis. The main idea of our algorithm is that flow grouping based on their relationships will increase the accuracy of P2P traffic analysis.

A load cluster management system using SNMP and web

Clustered servers for Internet service is a popular solution to cope with the explosive increase in client requests. The high probability of service failure in cluster servers make the cluster management system necessary to provide high availability and convenient administrator control. In this paper, we present the design and implementation of a load cluster management system (LCMS) based on SNMP and Web technology. Our LCMS implementation has been deployed on a commercial ultra-dense server.

A generic architecture for autonomic service and network management

As the Internet evolves into an all-IP communication infrastructure, a key issue to consider is that of creating and managing IP-based services with efficient resource utilization in a scalable, flexible, and automatic way. In this paper, we present the Autonomic Service Architecture (ASA), a uniform framework for automated management of both Internet services and their underlying network resources. ASA ensures the delivery of services according to specific service level agreements (SLAs) between customers and service providers. As an illustrative example, ASA is applied to the management of DiffServ/MPLS networks, where we propose an autonomic bandwidth sharing scheme. With the proposed scheme, the bandwidth allocated for each SLA can be automatically adjusted according to the measured traffic load and under policy control for efficient resource utilization, while SLA compliance over the network is always guaranteed.

On the design and implementation of a home energy management system

To reduce energy consumption and wastage, effective energy management at home is key and an integral part of the future Smart Grid. In this paper, we present the design and implementation of Green Home Service (GHS) for home energy management. Our approach addresses the key issues of home energy management in Smart Grid: a holistic management solution, improved device manageability, and an enabler of Demand-Response. We also present the scheduling algorithms in GHS for smart energy management and show the results in simulation studies.