Optimization of Stealthwatch Network Security System for the Detection and Mitigation of Distributed Denial of Service (DDoS) Attack: Application to Smart Grid System

The Smart Grid is an enhancement of the traditional grid system and employs new technologies and sophisticated communication techniques for electrical power transmission and distribution. The Smart Grid’s communication network shares information about status of its several integrated IEDs (Intelligent Electronic Devices). However, the IEDs connected throughout the Smart Grid, open opportunities for attackers to interfere with the communications and utilities resources or take clients’ private data. This development has introduced new cyber-security challenges for the Smart Grid and is a very concerning issue because of emerging cyber-threats and security incidents that have occurred recently all over the world. The purpose of this research is to detect and mitigate Distributed Denial of Service [DDoS] with application to the Electrical Smart Grid System by deploying an optimized Stealthwatch Secure Network analytics tool. In this paper, the DDoS attack in the Smart Grid communication networks was modeled using Stealthwatch tool. The simulated network consisted of Secure Network Analytic tools virtual machines (VMs), electrical Grid network communication topology, attackers and Target VMs. Finally, the experiments and simulations were performed, and the research results showed that Stealthwatch analytic tool is very effective in detecting and mitigating DDoS attacks in the Smart Grid System without causing any blackout or shutdown of any internal systems as compared to other tools such as GNS3, NeSSi2, NISST Framework, OMNeT++, INET Framework, ReaSE, NS2, NS3, M5 Simulator, OPNET, PLC & TIA Portal management Software which do not have the capability to do so. Also, using Stealthwatch tool to create a security baseline for Smart Grid environment, contributes to risk mitigation and sound security hygiene.

Dialogic Function of Denial Resource in Political Commentaries: A Perspective of Appraisal

Appraisal is a major kind of discourse semantic resources construing interpersonal meaning, which includes three subsystems: attitude, engagement and graduation. Engagement resources are linguistic resources of inter- subjective positioning,through which writers or speakers open up or close down dialogic space for putative reader and try to align or disalign readers on the ground of solidarity. This study applies engagement system to analyze political commentaries. It focuses on the denial resources in detail. In political commentaries, by using denial resources, the commentator invokes, and then directly rejects different opinions or beliefs the putative readers may have. Through strategy of dialogic resources, commentators try to make up for disalignments caused by denial and form the grounds for solidarity.

Formalized Description of Distributed Denial of Service Attack

The distributed denial of service (DDoS) attack is one of the dangers in intrusion modes. It's difficult to defense and can cause serious damage to the system. Based on a careful study of the attack principles and characteristics, an object-oriented formalized description is presented, which contains a three-level framework and offers full specifications of all kinds of DDoS modes and their features and the relations between one another. Its greatest merit lies in that it contributes to analyzing, checking and judging DDoS. Now this formalized description has been used in a special IDS and it works very effectively.(

Denial of Service Due to Direct and Indirect ARP Storm Attacks in LAN Environment

ARP-based Distributed Denial of Service (DDoS) attacks due to ARP-storms can happen in local area networks where many computer systems are infected by worms such as Code Red or by DDoS agents. In ARP attack, the DDoS agents constantly send a barrage of ARP requests to the gateway, or to a victim computer within the same sub-network, and tie up the resource of attacked gateway or host. In this paper, we set to measure the impact of ARP-attack on resource exhaustion of computers in a local area network. Based on attack experiments, we measure the exhaustion of processing and memory resources of a victim computer and also other computers, which are located on the same network as the victim computer. Interestingly enough, it is observed that an ARP-attack not only exhausts resource of the victim computer but also significantly exhausts processing resource of other non-victim computers, which happen to be located on the same local area network as the victim computer.

Paradox of Denials in All My Sons

Arthur Miller,who was one of the greatest American playwrights of the 20th century.In All My Sons,different sorts of denials lead to the family’s collapse and Keller’s death.Paradoxically,the very denial that is designed to protect him from prosecution and incarceration is followed by a chain of events that lead to Keller’s own self-imprisonment and self-imposed execution.Denial also exists in the history of some countries,such as Germany,Japan and America and so on.My paper aims to explore the paradox of denial both in our history and in literature works.My paper will demonstrate that denial has some negative effects both on the outer-world and the inner-world through thorough analysis on the characters in All My Sons.

On the Literary Psychology Evolution of Denial Novels of the Qing Dynasty

This paper introduces the denial of the popular novels of the Qing Dynasty,and based on such introduction,it further analyzes the reasons why literary works represented by popular novels in the Qing Dynasty were denied and the influence upon cultural communication of denial.From the perspective of the mainstream cultural status and the actual situation,it explores the guidance function of literary psychology evolution,showing that the Chinese novels,as literary works,have the rational and responsible value.

Experimental Evaluation of Cisco ASA-5510 Intrusion Prevention System against Denial of Service Attacks

Cyber attacks are continuing to hamper working of Internet services despite increase in the use of network security systems such as, firewalls and Intrusion protection systems (IPS). Recent Denial of Service (DoS) attack on Independence Day weekend, on July 4th, 2009 launched to debilitate the US and South Korean governments’ websites is indicative of the fact that the security systems may not have been adequately deployed to counteract such attacks. IPS is a vital security device which is commonly used as a front line defense mechanism to defend against such DoS attacks. Before deploying a firewall or an IPS device for network protection, in many deployments, the performance of firewalls is seldom evaluated for their effectiveness. Many times, these IPS’s can become bottleneck to the network performance and they may not be effective in stopping DoS attacks. In this paper, we intend to drive the point that deploying IPS may not always be effective in stopping harmful effects of DoS attacks. It is important to evaluate the capability of IPS before they are deployed to protect a network or a server against DoS attacks. In this paper, we evaluate performance of a commercial grade IPS Cisco ASA-5510 IPS to measure its effectiveness in stopping a DoS attacks namely TCP-SYN, UDP Flood, Ping Flood and ICMP Land Attacks. This IPS comes with features to counteract and provide security against these attacks. Performance of the IPS is measured under these attacks protection and compared with its performance when these protection features were not available (i.e. disabled). It was found that the IPS was unable to provide satisfactory protection despite the availability of the protection features against these flooding attacks. It is important for the network managers to measure the actual capabilities of an IPS system before its deployment to protect critical information infrastructure.

The History, Trend, Types, and Mitigation of Distributed Denial of Service Attacks

Over time, the world has transformed digitally and there is total dependence on the internet. Many more gadgets are continuously interconnected in the internet ecosystem. This fact has made the Internet a global information source for every being. Despite all this, attacker knowledge by cybercriminals has advanced and resulted in different attack methodologies on the internet and its data stores. This paper will discuss the origin and significance of Denial of Service (DoS) and Distributed Denial of Service (DDoS). These kinds of attacks remain the most effective methods used by the bad guys to cause substantial damage in terms of operational, reputational, and financial damage to organizations globally. These kinds of attacks have hindered network performance and availability. The victim’s network is flooded with massive illegal traffic hence, denying genuine traffic from passing through for authorized users. The paper will explore detection mechanisms, and mitigation techniques for this network threat.

基于CNN-BiLSTM的ICMPv6 DDoS攻击检测方法

针对ICMPv6网络中DDoS攻击检测问题,提出一种基于CNN-BiLSTM网络的检测算法。通过将带有注意力机制、DropConnect和Dropout混合使用加入到CNN-BiLSTM算法中,防止在训练过程中产生的过拟合问题,同时更准确地提取数据的特性数据。通过实验表明:提出的算法在多次实验中的检测准确率、误报率与漏报率平均值分别为92.84%、4.49%和10.54%,检测算法泛化性较强,性能由于其他算法,能够有效处理ICMPv6 DDoS攻击检测问题。

GNSS拒止时基于并行CNN-BiLSTM回归和残差补偿的UAV导航误差校正方法

全球导航卫星系统(GNSS)拒止时,GNSS/惯性导航系统(INS)组合导航系统的性能严重下降,导致无人机集群导航误差快速发散.目前,利用神经网络预测位置与速度代替GNSS导航信息可校正无人机INS误差,但该方法仍存在定位误差较高且在轨迹突变时预测精度急剧下降的问题.因此,提出了一种基于卷积-双向长短时记忆网络联合残差补偿的位置与速度预测方法,用于提高位置与速度预测精度.首先,针对GNSS拒止后GNSS/INS组合导航系统定位误差较高的问题,提出卷积神经网络(CNN)与双向长短时记忆网络(BiLSTM)的融合模型,该模型可建立惯性测量单元(IMU)动力学测量数据与GNSS导航信息之间的关系,实现较准确的位置和速度预测.其次,针对轨迹突变时预测效果急剧下降的问题,提出并行CNNBiLSTM回归架构,在预测位置与速度的同时,挖掘IMU动力学测量数据、预测值与预测残差之间的关系,预测并补偿预测残差,增强模型在轨迹突变时的预测精度.仿真结果表明,所提模型在预测准确性、有效性和稳定性方面都优于CNN-LSTM、LSTM网络模型.

基于引导优化的拒止环境无人系统相对定位

在卫星拒止条件下,包含无人机、无人艇等多个节点的无人系统可以基于节点间距离信息,使用相对定位方法解算所有节点的绝对地理位置。由于无人系统节点的高机动特性,节点间的距离信息具有瞬时有效性,因此需要实现快速、精确的相对定位解算。旋转矩阵的计算是相对定位解算的核心步骤,使用传统的最小二乘法、牛顿法、遗传法等无法兼顾效率与精度因素,基于自由度松弛的引导优化算法通过放松旋转矩阵的自由度能够将寻优参数的初始值一步引导至真值邻域附近,再利用迭代法进行精细寻优,从而实现旋转矩阵的短时间、高精度计算。仿真实验结果表明,在无人系统测距误差达到5 m时,基于引导优化的相对定位方法解算时间为0.014 s,产生的定位误差为25.73 m,与牛顿法的解算精度相当,同时减少了55.56%的计算时间;与最小二乘法的计算时间相当,同时减少了39.47%的定位误差。

基于合约熵判决算法的区块链网络DDoS防御优化

为针对多域协同联合防御分布式拒绝服务(DDoS)更有效发挥区块链网络优势,该文提出智能合约熵检测(SCED)算法。基于Hyperledger Fabric区块链架构,首先,通过智能合约技术构建多域协作机制,建立智能合约协作子算法;然后,针对受害域内非法流量IP生成IP黑名单,并通知所有协作域,协同防御DDoS;其次,在各单域内部署由监测、比对、分类及防御模块组成的熵判决防御子算法,检测处理域内非法流量;最后,结合多域智能合约协作和单域熵判决防御,实现区块链网络中受害域、中间域及攻击域协同防御DDoS。仿真结果表明,对比ChainSecure等算法,SCED算法在精度和效率方面有较好的表现。

战略文化视阈下美国对太平洋岛国的策略与路径

第二次世界大战后,美国与太平洋岛国在互动的过程中形成了以“美国例外”“有限干预”和“战略拒止”为特征的战略文化。基于“美国例外”,美国提出需保持对“自由联系国”的“绝对权威”;基于“有限干预”,美国寻求与太平洋岛国建立机制化合作关系;基于“战略拒止”,美国对域外国家介入太平洋岛国事务保持高度警惕。在战略文化的驱动下,美国积极改善与南太平洋区域组织的政治外交关系,加强顶层设计,由美国国际开发署统筹对太平洋岛国的对外援助事务,开展公共外交活动树立美国正面积极的国际形象,并将太平洋岛国纳入伙伴关系网络,在太平洋岛国及周边地区扩大军事部署。即便如此,由于美国对太平洋岛国的发展问题缺乏认知,忽视双方历史、文化差异并与太平洋岛国存在现实利益分歧,美国在太平洋岛国的战略文化辐射效果有限。

高校中小型高性能集群系统的建设及管理实践

理论模拟实验室是高校各级科研单位开展教学和科研工作的重要支撑平台。如何建设可持续发展且具有高性价比的高性能计算集群系统,并实现集群系统的高可用性和安全使用是各级科研单位集群系统建设和管理的重要问题,也是理论模拟实验室在“双一流”建设中所要面对的重要任务之一。基于吉林大学原子与分子物理研究所共享集群系统的建设、管理和维护实践,提出集群软件等公用资源共享使用、计算资源统一规划、分级管理,并结合自行开发的集群监控管理系统,利用手机端进行集群状态监控,发现异常即时处理,从而提高集群系统管理效率和确保集群系统稳定运行,为学科发展提供重要支撑。

关联公司法人人格否认对实际控制人扩张适用之研究

司法实践中,实际控制人损害债权人利益现象频现,而《公司法》未将实际控制人纳入法人人格否认制度的规制范围,此类案件裁判工作陷入实际控制人责任形态缺失、对其滥用行为未实现整体规制以及责任认定与立法不统一的窘境。实际控制人适用关联公司法人人格否认制度契合法人制度的本质,能够保护债权人利益,堵住法律漏洞,有效规制实际控制人的滥用行为。未来《公司法》应将实际控制人纳入关联公司法人人格否认制度规制范围,完善法人人格否认制度,从立法目的出发,扩张解释现行《公司法》第20条第3款,对实际控制人扩张适用关联公司法人人格否认制度;法院审理此类案件时应严格把握构成要件,采用多重标准认定行为要件,重视结果要件;法院应坚持审慎立场,考察适用必要性,坚持“一案一否认”,防止法人人格否认制度被滥用。

分布式拒绝服务攻击的防御策略

随着信息技术的快速发展,网络安全威胁也日益增多,其中分布式拒绝服务(DDoS)攻击因其破坏性强和难以防御而成为网络安全的一大挑战。DDoS攻击可以利用大量受控设备对目标服务器发起海量请求,致使其服务不可用。文中详细分析了当前DDoS攻击的主要手段,探讨了基于流量监控、行为分析和机器学习的多种检测技术。在此基础上,还提出了一套包括基础防御措施和高级防御技术的综合防御框架。

面向网络靶场的DDoS攻击缓解方法研究

本文提出一种面向不平衡数据的DDoS攻击检测模型,提升对DDoS洪泛攻击的检测效果。以OpenStack为核心技术设计网络靶场,并使用Ceph分布式存储替换OpenStack原生存储系统,提出一种OpenStack与Ceph的超融合网络靶场方案,可以实现对计算、存储、网络资源的统一管理。首先,针对Ceph集群在存储时的数据分布不均情况对平台存储性能的影响,提出一种基于好感度的数据存储优化算法,利用好感度因子约束数据的存储位置,有效提高集群中所有OSD节点存储数据的均衡性。同时,设计了一种基于软件定义网络(Software Defined Network,SDN)的DDoS洪泛攻击检测与缓解方法,有效降低了对物理设备性能的要求,最后结合Ryu控制器的可编程性,实现DDoS洪泛攻击缓解方法。

面向边缘计算的TCA1C DDoS检测模型

边缘计算弥补了传统云计算数据传输开销大的不足,但边缘网络中存储和计算资源受限的特殊性限制了其部署复杂安全算法的能力,更易受到分布式拒绝服务(DDoS)攻击。针对目前边缘网络中DDoS攻击检测方法性能不高、未对卸载任务分类处理、对多属性的流量处理能力弱的问题,提出一种基于任务分类的Attention-1D-CNN DDoS检测模型TCA1C,对通信链路中的流量按不同的卸载任务进行分类,使单个任务受到攻击时不会影响整个链路中计算任务卸载的安全性,再对同一任务下的流量提取属性值并进行归一化处理。处理后的数据输入到Attention-1D-CNN,通道Attention和空间Attention学习数据特征对DDoS检测的贡献度,利用筛选函数剔除低于特征阈值的冗余信息,降低模型学习过程的复杂度,使模型快速收敛。仿真结果表明:TCA1C模型在缩短DDoS检测所用时间的情况下,检测准确率高达99.73%,检测性能优于DT、ELM、LSTM和CNN;当多个卸载任务在面临特定攻击概率时,卸载任务分类能有效降低不同任务的相互影响,使终端设备的计算任务在卸载过程中保持较高的安全性。

基于CNN的5G网络切片安全分配研究

网络切片是5G网络的关键技术,在支持多种5G应用和服务方面发挥着重要作用。为确保5G网络提供更加灵活安全的按需服务,对网络切片的灵活性和安全性研究尤为重要。为此,提出一种按应用服务类型划分细粒度网络切片的方案,并通过基于卷积神经网络(Convolutional Neural Networks,CNN)的模型来安全分配网络切片。当网络流通过该模型后,先筛选出受到分布式拒绝服务(Distributed Denial of Service,DDoS)攻击的流量,然后良性流量再按应用类型分配到相应的切片上。仿真结果表明,基于CNN的网络切片分配模型,在安全分配网络切片方面有着显著的效果。与其它常见的机器学习分类算法相比,该方案中的模型在准确率、精确率、召回率和F1分数方面都有着更好的性能优势。

SDN中基于统计与集成自编码器的DDoS攻击检测模型

软件定义网络(Software-defined Networking,SDN)是一种提供细颗粒集中网络管理服务的新型网络体系结构,主要有控制与转发分离、集中控制和开放接口基本特征。SDN由于控制层的集中管理逻辑,控制器被攻击者作为理想的分布式拒绝服务攻击(Distributed Denial-of-Service,DDoS)目标。然而,传统的基于统计的DDoS攻击检测算法常存在误报率高、阈值固定等问题;基于机器学习模型的检测算法常存在计算资源消耗大、泛化性差等问题。为此,文中提出了一种基于统计特征与集成自编码器的DDoS攻击双层检测模型。基于统计的方法提取Rényi熵特征,设置动态阈值判断可疑流量;基于集成自编码器算法对可疑流量进行更精确的DDoS攻击判断。双层检测模型不仅提升了检测效果,解决了误报率高的问题,同时还有效地缩短了检测时间,从而减少了计算资源的消耗。实验结果表明,该模型在不同网络环境下都有较高的准确率,不同数据集检测的F1值最低都达到了98.5%以上,表现出了很强的泛化性。