Browsing by Author "Chen, Hsia-Hsiang"

Now showing 1 - 5 of 5

A Multi-Agent Intelligence Hybrid System Technique for Detection and Defense of DDoS Attacks
(2015-01-01)
Chen, Hsia-Hsiang
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
;
Department of Computer Science
In the paper, we propose the distributed detection and identification multi-agent system (DDIMAS) framework that is the first attempt to apply in solving distributed denial of service (DDoS) problem. It includes three stages which are information heuristic rule, meta-heuristic algorithm and backward and forward search (BFS) rule, respectively. Moreover, the framework is a flexible architecture that can incorporate into other algorithms or rules to improve the overall performance. From the evaluation design, the experiment results show that our method is with higher detection rate and better accuracy than standard repositories. The proposed framework resolves issues in other swarm optimization algorithms and reveals that the performance of DDIMAS is better than existing methods and the adaptive meta-heuristic algorithm framework outperforms other methods for detecting DDoS attacks.
A Unified Ant Agent Framework for Solving DoS and QoS Problems
(2016-11)
Chen, Hsia-Hsiang
;
Lee, Chien-Hua
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
Anomalous traffic volume can be used for identifying network threats and faults. Denial of service (DoS) and quality of service (QoS) are two contrasting problems of anomalous network traffic. DoS exploits malicious traffic to hinder service availability to normal users, whereas QoS determines if the service provision quality has reached the preset agreement. This paper proposes a unified ant agent framework for identifying the source of these problems: IP traceback for DoS attacks and fault localization for QoS violations. Numerous studies have investigated IP traceback techniques for identifying spoofed IP addresses of attackers. These techniques can identify the attack path from the victim to the attacker. Metaheuristic algorithms that consider slight increments in traffic volume (SITV) are rarely studied for solving the IP traceback problem of DoS attacks. We investigated the malicious and nonmalicious situations for the QoS attack and QoS fault localization problem. This paper proposes a novel ant colony optimization (AGO) method for fast filtering, DoS threat source identification, and QoS fault localization (unified threat identification and fault localization by using ACO, UTFACO). The UTFACO framework was compared with the probabilistic packet marking approach and conventional ant system algorithms. We compared the efficiency of UTFACO with and without a bloom filter (BF). The framework was verified in the QoS attack and QoS fault experiment environments. This study showed that attack or fault detection and identification procedures can be designed and implemented practically. The tests used the dataset of the network topology from the DARPA repository with two cases: one is a general experiment, and the other has various levels of SITV. Perfect accuracy can be achieved for the general experiment, and more than 90% accuracy can be obtained for various levels of SITV. The datasets of the QoS attack and QoS fault were obtained from a real network. Precise fault localization is achieved due to the high detection rate obtained. The results show that UTFACO is an efficient and accurate framework. Moreover, the computation time is considerably reduced by using UTFACO with the BF, and the time is less than five seconds in the framework. Our proposed framework is robust and can solve the problem of identifying the IP address of an attacker and detecting the fault location.
Automatic Defense Through Fault Localization and Dynamic Patch Creation
(2016)
Chen, Hsia-Hsiang
;
Zheng, Da-Qun
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
The US Department of Defense has called for contest on automatic attack and defense. The contest is a competition, called Cyber Grand Challenge (CGC), aimed at developing cyber security systems. In accordance with the competition rules, we developed an automatic cyber reasoning system (CRS) that meets the objectives specified in the CGC. Our CRS combines the techniques of fuzz testing, fault localization, and binary patch creation to construct an automatic defense system. From the sample problems in the CGC, we evaluate our system and the binary patch capability by applying them to real programs. We explore two patching methods in five challenges in CGC with partial successes in availability and security.
Diagnosing SDN Network Problems by Using Spectrum-based Fault Localization Techniques
(2015)
Chen, Hsia-Hsiang
;
Lu, Han-Lin
;
Huang, Shih-Kun
;
Gao, Ruizhi
;
Wong, W. Eric
Software-defined network (SDN) is the recent advances of mitigation on improving network management flexibility and dynamic configurability. It is due to the separation of control plane and data plane and the controller software for arbitrary network configurations. However, such a flexible architecture still suffers from the inherent traits of software quality issues. Software testing and software related fault localization methods should be applied. To the best of our knowledge, we are the first to apply spectrum-based fault localization (SFL) techniques for SDN problems and propose the SFL system framework to find the illogic rules and related procedure faults in SDN. We conduct evaluations on the standard SDN environment in OpenFlow and compare the related SFL techniques. The results show that the fault locations can be found precisely. In addition, we also develop a debugging tool that can search the error causes and feedback the information to the SDN controller for fixing the faulty conditions in time.
LDDoS Attack Detection by Using Ant Colony Optimization Algorithms
(2016-07)
Chen, Hsia-Hsiang
;
Huang, Shih-Kun
;
資訊工程學系
;
資訊技術服務中心
;
Department of Computer Science
Internet service providers and equipment vendors are subject to cyber threats. One of the most prevalent security threats is the distributed denial of service (DDoS) attack. In a DDoS attack, the attack traffic and attacker\'s IP address are respectively difficult to detect and trace. This is because attack traffic is similar to regular traffic and the attack is executed by multiple attackers. This study focused on solving the low-rate distributed denial of service (LDDoS) problem; this problem is difficult to detect and trace compared with a DDoS attack. We therefore propose a novel distributed detection and identification ant colony system (DDIACS) framework, which is an ant-colony-optimization based metaheuristic technique, for solving the LDDoS problem. The DDIACS framework comprises three stages, which entail an information heuristic rule, a multiagent algorithm, and a backward and forward search method. Moreover, the DDIACS framework is compliant with the emerging software defined network (SDN) because in this framework, a control plane and data plane are used to monitor and manage the network topology. The proposed framework demonstrates SDN advantages such as enabling networks to exhibit flexibility, fast convergence, and robustness in overcoming complicated multi-attacker problems. In addition, this study investigated the time and space complexity of the DDIACS framework and compared this framework with the swarm optimization algorithm and probabilistic packet marking. This study designed the network topology by using the data set from the DARPA and KDD repository. The simulation results show that the proposed framework resolves the problems in using other algorithms and that the DDIACS framework demonstrates better performance than existing methods; furthermore, the adaptive metaheuristic algorithm outperforms other methods in thwarting an LDDoS attack. The detection rate is about 89% and the accuracy is greater than 83%.