Flash Crowd attacks are a form of Distributed Denial of Service(DDoS)attack that is becoming increasingly difficult to detect due to its ability to imitate normal user behavior in Cloud Computing(CC).Botnets are often...Flash Crowd attacks are a form of Distributed Denial of Service(DDoS)attack that is becoming increasingly difficult to detect due to its ability to imitate normal user behavior in Cloud Computing(CC).Botnets are often used by attackers to perform a wide range of DDoS attacks.With advancements in technology,bots are now able to simulate DDoS attacks as flash crowd events,making them difficult to detect.When it comes to application layer DDoS attacks,the Flash Crowd attack that occurs during a Flash Event is viewed as the most intricate issue.This is mainly because it can imitate typical user behavior,leading to a substantial influx of requests that can overwhelm the server by consuming either its network bandwidth or resources.Therefore,identifying these types of attacks on web servers has become crucial,particularly in the CC.In this article,an efficient intrusion detection method is proposed based on White Shark Optimizer and ensemble classifier(Convolutional Neural Network(CNN)and LighGBM).Experiments were conducted using a CICIDS 2017 dataset to evaluate the performance of the proposed method in real-life situations.The proposed IDS achieved superior results,with 95.84%accuracy,96.15%precision,95.54%recall,and 95.84%F1 measure.Flash crowd attacks are challenging to detect,but the proposed IDS has proven its effectiveness in identifying such attacks in CC and holds potential for future improvement.展开更多
Through caching popular contents at the network edge,wireless edge caching can greatly reduce both the content request latency at mobile devices and the traffic burden at the core network.However,popularity-based cach...Through caching popular contents at the network edge,wireless edge caching can greatly reduce both the content request latency at mobile devices and the traffic burden at the core network.However,popularity-based caching strategies are vulnerable to Cache Pollution Attacks(CPAs)due to the weak security protection at both edge nodes and mobile devices.In CPAs,through initiating a large number of requests for unpopular contents,malicious users can pollute the edge caching space and degrade the caching efficiency.This paper firstly integrates the dynamic nature of content request and mobile devices into the edge caching framework,and introduces an eavesdroppingbased CPA strategy.Then,an edge caching mechanism,which contains a Request Pattern Change-based Cache Pollution Detection(RPC2PD)algorithm and an Attack-aware Cache Defense(ACD)algorithm,is proposed to defend against CPAs.Simulation results show that the proposed mechanism could effectively suppress the effects of CPAs on the caching performance and improve the cache hit ratio.展开更多
We study the random injury outcome caused by multiple flash bang submunitions on a crowd. We are particularly interested in the fluctuations in injury outcome among individual realizations. Previously, to simulate the...We study the random injury outcome caused by multiple flash bang submunitions on a crowd. We are particularly interested in the fluctuations in injury outcome among individual realizations. Previously, to simulate the distribution of the actual number of injured, we developed a comprehensive Monte Carlo model. While the full computational model is important for thorough theoretical investigations, in practical operations, it is desirable to characterize the phenomenological behavior of injury outcome using a concise model with only one or two parameters. Conventionally, the injury outcome is indicated by the average fraction of injured, which is called the risk of significant injury (RSI). The single metric RSI description fails to capture fluctuations in the injury outcome. The number of injured in the crowd is influenced by many random factors: the aiming error of flash bang mortar, the dispersion of submunitions after mortar burst, the amount of acoustic dose reaching individual subjects, and the biovariability of individual subjects’ reactions to a given acoustic dose. We aim to include these random factors properly and concisely. In this study, we represent the random injury outcome as a compound binomial model, in which the hidden injury probability is drawn from a two-parameter model distribution. We formulate and examine six model distributions for the injury probability. The best performer is a mixture of uniform and triangle distributions, parameterized by (RSI, dp) where dp is the standard deviation of the hidden injury probability. This mixture model predicts the behavior of injury outcome with uncertainty, based solely on the two parameters (RSI, dp) in the flash bang description. For example, we can predict the probability of the injury outcome not exceeding a prescribed tolerance. We advocate the adoption of this two-parameter characterization for flash bangs to replace the single-parameter RSI description. Whenever we need to give a high level coarse description of a flash bang situation, we state that the injury risk is represented by (RSI, dp).展开更多
容器作为物理资源的逻辑抽象,具有资源占用少、资源供给快等特点,适合工作负载突变的互联网应用模式,特别是面向微服务架构的新型服务范型.已有工作受限于物理机和虚拟化环境,或资源难以弹性供给或资源供给时效性较差,难以应对负载突变(...容器作为物理资源的逻辑抽象,具有资源占用少、资源供给快等特点,适合工作负载突变的互联网应用模式,特别是面向微服务架构的新型服务范型.已有工作受限于物理机和虚拟化环境,或资源难以弹性供给或资源供给时效性较差,难以应对负载突变(flash-crowds)场景.针对此问题提出了一种服务质量(quality of service,QoS)敏感的、基于前馈的容器资源弹性供给方法,该方法采用排队论刻画工作负载、资源利用率和响应时间的关联关系,构建应用性能模型.其中,响应时间采用模糊自适应卡尔曼滤波进行预测(前馈控制器),预测结果违背QoS是触发资源弹性供给的依据.基于CloudStone基准的实验结果显示,前馈控制器具有快速收敛的特点,对响应时间的预测误差小于10%.在flash-crowds场景下,相对于已有方法可有效保障应用的QoS.展开更多
在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥...在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥事件检测的分析不论是对预防恶意流量还是电子数据取证都至关重要。提出一种SDN中基于流特征的多类型DDoS攻击和闪拥流量检测方法,其中可调节的φ-熵增加不同数据类型间的距离以便在流形成初期及时发现攻击行为。对一些常见的DDoS攻击方式进行详细分析,并通过获取交换机中流表的多维特征对样本进行训练分类,在有效检测DDoS攻击流量的同时还能在一定程度上区分DDoS攻击与闪拥事件。通过Mininet平台进行仿真实验,实验表明,该方法可以有效提高DDoS攻击检测率并降低闪拥事件误报率,验证了实验的准确性和有效性。展开更多
基金The authors gratefully acknowledge the approval and the support of this research study by grant no.SCIA-2022-11-1551 from the Deanship of Scientific Research at Northern Border University,Arar,K.S.A.
文摘Flash Crowd attacks are a form of Distributed Denial of Service(DDoS)attack that is becoming increasingly difficult to detect due to its ability to imitate normal user behavior in Cloud Computing(CC).Botnets are often used by attackers to perform a wide range of DDoS attacks.With advancements in technology,bots are now able to simulate DDoS attacks as flash crowd events,making them difficult to detect.When it comes to application layer DDoS attacks,the Flash Crowd attack that occurs during a Flash Event is viewed as the most intricate issue.This is mainly because it can imitate typical user behavior,leading to a substantial influx of requests that can overwhelm the server by consuming either its network bandwidth or resources.Therefore,identifying these types of attacks on web servers has become crucial,particularly in the CC.In this article,an efficient intrusion detection method is proposed based on White Shark Optimizer and ensemble classifier(Convolutional Neural Network(CNN)and LighGBM).Experiments were conducted using a CICIDS 2017 dataset to evaluate the performance of the proposed method in real-life situations.The proposed IDS achieved superior results,with 95.84%accuracy,96.15%precision,95.54%recall,and 95.84%F1 measure.Flash crowd attacks are challenging to detect,but the proposed IDS has proven its effectiveness in identifying such attacks in CC and holds potential for future improvement.
文摘Through caching popular contents at the network edge,wireless edge caching can greatly reduce both the content request latency at mobile devices and the traffic burden at the core network.However,popularity-based caching strategies are vulnerable to Cache Pollution Attacks(CPAs)due to the weak security protection at both edge nodes and mobile devices.In CPAs,through initiating a large number of requests for unpopular contents,malicious users can pollute the edge caching space and degrade the caching efficiency.This paper firstly integrates the dynamic nature of content request and mobile devices into the edge caching framework,and introduces an eavesdroppingbased CPA strategy.Then,an edge caching mechanism,which contains a Request Pattern Change-based Cache Pollution Detection(RPC2PD)algorithm and an Attack-aware Cache Defense(ACD)algorithm,is proposed to defend against CPAs.Simulation results show that the proposed mechanism could effectively suppress the effects of CPAs on the caching performance and improve the cache hit ratio.
文摘We study the random injury outcome caused by multiple flash bang submunitions on a crowd. We are particularly interested in the fluctuations in injury outcome among individual realizations. Previously, to simulate the distribution of the actual number of injured, we developed a comprehensive Monte Carlo model. While the full computational model is important for thorough theoretical investigations, in practical operations, it is desirable to characterize the phenomenological behavior of injury outcome using a concise model with only one or two parameters. Conventionally, the injury outcome is indicated by the average fraction of injured, which is called the risk of significant injury (RSI). The single metric RSI description fails to capture fluctuations in the injury outcome. The number of injured in the crowd is influenced by many random factors: the aiming error of flash bang mortar, the dispersion of submunitions after mortar burst, the amount of acoustic dose reaching individual subjects, and the biovariability of individual subjects’ reactions to a given acoustic dose. We aim to include these random factors properly and concisely. In this study, we represent the random injury outcome as a compound binomial model, in which the hidden injury probability is drawn from a two-parameter model distribution. We formulate and examine six model distributions for the injury probability. The best performer is a mixture of uniform and triangle distributions, parameterized by (RSI, dp) where dp is the standard deviation of the hidden injury probability. This mixture model predicts the behavior of injury outcome with uncertainty, based solely on the two parameters (RSI, dp) in the flash bang description. For example, we can predict the probability of the injury outcome not exceeding a prescribed tolerance. We advocate the adoption of this two-parameter characterization for flash bangs to replace the single-parameter RSI description. Whenever we need to give a high level coarse description of a flash bang situation, we state that the injury risk is represented by (RSI, dp).
文摘容器作为物理资源的逻辑抽象,具有资源占用少、资源供给快等特点,适合工作负载突变的互联网应用模式,特别是面向微服务架构的新型服务范型.已有工作受限于物理机和虚拟化环境,或资源难以弹性供给或资源供给时效性较差,难以应对负载突变(flash-crowds)场景.针对此问题提出了一种服务质量(quality of service,QoS)敏感的、基于前馈的容器资源弹性供给方法,该方法采用排队论刻画工作负载、资源利用率和响应时间的关联关系,构建应用性能模型.其中,响应时间采用模糊自适应卡尔曼滤波进行预测(前馈控制器),预测结果违背QoS是触发资源弹性供给的依据.基于CloudStone基准的实验结果显示,前馈控制器具有快速收敛的特点,对响应时间的预测误差小于10%.在flash-crowds场景下,相对于已有方法可有效保障应用的QoS.
文摘在软件定义网络(software defined networking,SDN)中,由于集中管理与可编程的特点,其安全性面临着巨大的挑战。恶意攻击者容易利用SDN网络的安全漏洞进行分布式拒绝服务(distributed denial of service,DDoS)攻击,而对DDoS攻击与闪拥事件检测的分析不论是对预防恶意流量还是电子数据取证都至关重要。提出一种SDN中基于流特征的多类型DDoS攻击和闪拥流量检测方法,其中可调节的φ-熵增加不同数据类型间的距离以便在流形成初期及时发现攻击行为。对一些常见的DDoS攻击方式进行详细分析,并通过获取交换机中流表的多维特征对样本进行训练分类,在有效检测DDoS攻击流量的同时还能在一定程度上区分DDoS攻击与闪拥事件。通过Mininet平台进行仿真实验,实验表明,该方法可以有效提高DDoS攻击检测率并降低闪拥事件误报率,验证了实验的准确性和有效性。
