Wang Baosheng

Detection Network Anomalies Based on Packet and Flow Analysis

Anomalies generate vast amounts of bogus traffic, which can overwhelm the network and any attached hosts. Identifying traffic anomalies rapidly and accurately is critical to network stability and usefulness. Most papers focus on analyzing the volume of data or packets on the network. However, legitimate network traffic may be bursty or highly variable, rendering such naive approaches ineffective (Lakhina et al., 2005). We propose a novel method called MultiA to solve this problem. Rather than just looking at volumes of packets, MultiA intelligently adopted multistage filter and information entropy take into account the behavior of the network. The MultiA is scalable, automated and self-training. We find this technique effectively identifies network traffic anomalies while avoiding the high false alarms rate.Anomalies generate vast amounts of bogus traffic, which can overwhelm the network and any attached hosts. Identifying traffic anomalies rapidly and accurately is critical to network stability and usefulness. Most papers focus on analyzing the volume of data or packets on the network. However, legitimate network traffic may be bursty or highly variable, rendering such naive approaches ineffective (Lakhina et al., 2005). We propose a novel method called MultiA to solve this problem. Rather than just looking at volumes of packets, MultiA intelligently adopted multistage filter and information entropy take into account the behavior of the network. The MultiA is scalable, automated and self-training. We find this technique effectively identifies network traffic anomalies while avoiding the high false alarms rate.

Malware Clustering Based on SNN Density Using System Calls

Clustering is an important part of the malware analysis. The malware clustering algorithms commonly used at present have gradually can not adapt to the growing number of malware. In order to improve the malware clustering algorithm, this paper uses the clustering algorithm based on Shared Nearest Neighbor (SNN), and uses frequencies of the system calls as the features for input. This algorithm combined with the DBSCAN which is traditional density-based clustering algorithm in data mining. This makes it is a better application in the process of clustering of malware. The results of clusters demonstrate that the effect of the algorithm of clustering is good. And the algorithm is simple to implement and easy to complete automated analysis. It can be applied to actual automated analysis of malware.Clustering is an important part of the malware analysis. The malware clustering algorithms commonly used at present have gradually can not adapt to the growing number of malware. In order to improve the malware clustering algorithm, this paper uses the clustering algorithm based on Shared Nearest Neighbor (SNN), and uses frequencies of the system calls as the features for input. This algorithm combined with the DBSCAN which is traditional density-based clustering algorithm in data mining. This makes it is a better application in the process of clustering of malware. The results of clusters demonstrate that the effect of the algorithm of clustering is good. And the algorithm is simple to implement and easy to complete automated analysis. It can be applied to actual automated analysis of malware.

Software Data Plane and Flow Switching Plane Separation in Next-Generation Router Architecture

Routers have traditionally been architected as two elements: forwarding plane and control plane through ForCES or other protocols. Each forwarding plane aggregates a fixed amount of computing, memory, and network interface resources to forward packets. Unfortunately, the tight coupling of packet-processing tasks with network interfaces has severely restricted service innovation and hardware upgrade. In this context, we explore the insightful prospect of functional separation in forwarding plane to propose a next-generation router architecture, which, if realized, can provide promises both for various packet-processing tasks and for flexible deployment while solving concerns related to the above problems. Thus, we put forward an alternative construction in which functional resources within a forwarding plane are disaggregated. A forwarding plane is instead separated into two planes: software data plane (SDP) and flow switching plane (FSP). SDP is responsible for packet-processing tasks without its expansibility restricted with the amount and kinds of network interfaces. FSP is in charge of packet receiving/transmitting tasks and can incrementally add switching elements, such as general switches, or even specialized switches, to provide network interfaces for SDP. At last, we make an experiment on our platform in terms of bandwidth utilization rate, configuration delay, and the processing time of a simple router. Our experimental results show that the separation of SDP and FSP brings greater modularity to router architecture, allowing operators to optimize their deployments.

Two-Tier Model for Supporting Network Functions Virtualization with FoCES

Network functions virtualization (NFV) is used to leverage standard virtualization technologies to consolidate multiple network functions onto industry standard equipment. And most network functions consist of two layers including control plane and data plane. So we put forward a two-tier model for supporting network function virtualization based on ForCES framework. It includes three key components: CP, NF, and NF Manager. NF Manager judges which CP is active and establishes communication channel between NF and CP. NF is regarded as one of network functions such as switching elements, mobile network nodes, and other network-wide functions. CP runs the NF terminals to manage corresponding NFs and configures NF topology to customize service chaining. Besides, this model should include authentication and authorization mechanism to ensure communication security and NF security, message priority to provide different service of quality for different network functions, and CP redundancy or CP failover to reduce the affect introduced by a single point of failure. This paper mainly puts forward a general model for network functions virtualization, points out key-components, and lists current technologies related with NFV. At last, it designs two typical frameworks based on our proposed two-tier model. We hope our analysis about device framework for supporting network functions virtualization can enhance the speed of deployment of network functions virtualization.