Mehmet Hadi Gunes

Internet of Things (IoT) devices introduce new vulnerabilities to the network. These devices are relatively cheap, have simple design yet they can collect private user data, and be employed as botnets to conduct large-scale attacks. In general, IoT devices have a limited set of functionalities. Thus, the network administrator can formulate the expected traffic patterns of the devices and employ the network traffic to detect malicious activities. Existing systems to detect anomaly in IoT traffic mainly use machine learning. Thus, they require tuning the parameters of models and selecting/extracting a representative set of features from the network traffic data. In this paper, we introduce a novel approach Locality Sensitive Anomaly Detection and Identification (LSADI) to detect anomaly in IoT network traffic based on the locality-sensitive hash of the traffic flow. The proposed approach does not require feature selection/extraction from the data and does not have complex set of parameters that need to be tuned. Evaluation with three datasets containing 25 attacks shows that LSADI can detect and identify the type of anomalous flows with an accuracy above 90% on average and performs equally well compared to the state-of-the-art machine learning-based methods.

Comprehensive analysis that aims to understand the topology of real-world networks and the development of algorithms that replicate their characteristics has been significant research issues. Although the accuracy of newly developed network protocols or algorithms does not depend on the underlying topology, the performance generally depends on the topology. As a result, network practitioners have concentrated on generating representative synthetic topologies and utilize them to investigate the performance of their design in simulation or emulation environments. Network generators typically represent the Internet topology as a graph composed of point-to-point links. In this study, we discuss the implications of multi-access links on the synthetic network generation and modeling of the networks as bi-partite graphs to represent both subnetworks and routers. We then analyze the characteristics of sampled Internet topology data sets from backbone Autonomous Systems (AS) and observe that in addition to the commonly recognized power-law node degree distribution, the subnetwork size and the router interface distributions often exhibit power-law characteristics. We introduce a SubNetwork Generator (SubNetG) topology generation approach that incorporates the observed measurements to produce bipartite network topologies. In particular, generated topologies capture the 2-mode relation between the layer-2 (i.e., the subnetwork and interface distributions) and the layer-3 (i.e., the degree distribution) that is missing from the current network generators that produce 1-mode graphs. The SubNetG source code and experimental data is available athttps://github.com/netml/sonet.

Engineered systems get smarter with computing capabilities, particularly through a multitude of Internet of Things (IoT) devices. IoT devices, however, are prone to be compromised as they are often resource-limited and optimized for a certain task. They lack computing power for security software hence, they have become a major target of malicious activities. In order to secure a network, administrators may isolate vulnerable devices and limit traffic to a device based on its communication needs. In this paper, we introduce a novel approach to identify an IoT device based on the locality-sensitive hash of its traffic flow. Different from previous studies that employ machine learning, the proposed approach does not require feature extraction from the data, operates in all states of the device (e.g., setup, idle, and active), and does not require to retrain the model when a new device type/version is introduced. The evaluation results on different data sets show that our approach achieves precision and recall above 90% on average and performs equally well compared to the state-of-the-art machine learning-based methods.

Interactive and multimedia applications depend on the stability of end-to-end paths for predictable performance and good quality of service. On the other hand, network providers depend on multiple paths to ensure fault tolerance and use load balancing between these paths to enhance the overall network throughput. In this study, we analyze path dynamics for both end-to-end paths and path segments within service providers’ networks using 2 months of measurement data from the RIPE Atlas platform, which collects path traces between a fixed set of source and destination pairs every 15 minutes. We observe that 78% of the end-to-end routes have at least two alternative Autonomous System (AS) paths with some end-to-end routes going through hundreds of different AS paths during the 2 months of analysis. While AS level paths are often prevalent for a day, there are considerable changes in the routing of the trace packets over the ASes for a longer duration of a month or longer. Analyzing end-to-end paths for routing anomalies, we observe that 4.4% of the path traces (involving 18% of the ASes) contain routing loops indicating misconfiguration of routers. Some of the ASes had over 100 routers involved in loops in path traces through their networks. We observe a much higher rate of anomalies in the AS level, with 45% of path traces containing an AS loop. Additionally, we discovered that few of the ASes bounce-back packets where some traces through their network traverse routers in both forward and backward directions. Determining path segments belonging to each AS, we further explore ingress to egress paths of ASes in addition to the source to destination paths within the AS. Analyzing trace segments between ingresses and egresses of an AS, we realized more than half of the ASes have the same router level path between any ingress-egress pair for the 2 months, but others implement load balancing. These results are different from earlier studies that indicated a high level of path dynamism. Our results indicate that the end-to-end path dynamism is due to the Border Gateway Protocol level rather than the router level within ASes.

Interactive and multimedia applications depend on the stability of end-to-end paths on the Internet for predictable performance and good quality of service. On the other hand, network providers depend on multiple paths to ensure fault tolerance and use load balancing between these paths to enhance the overall network throughput. In this study, we analyze the path dynamics within service providers' networks using a month of measurement data from the RIPE Atlas platform which collects path traces between a source and a destination pair approximately every 15 minutes. Determining path segments belonging to each Autonomous System (AS), we explore ingress to egress paths of an AS in addition to source to destination paths within the AS. We observe that 13.2% of ASes contain routing loops within their network indicating mis-configuration of routers. Couple of ASes had over a million loops with over 100 routers causing loops in path traces. Additionally, 77.6% of end-to-end routes have at least two alternative AS paths with some end-to-end routes going through hundreds of different AS paths. Analyzing trace segments between ingresses and egresses of an AS, we realized more than a third of the backbone ASes have consistent routing between any node pair, but others implement load balancing or have inconsistent routing policies across their network.