texas a&m university page 1 10/10/2014 5:19:49 pm real-time traffic modeling and its application...

Texas A&M UniversityPage 1 04/11/23 01:16 AM

Real-Time Traffic Modeling and its Application in Network

Camouflaging

Wei Zhao, Riccardo Bettati, Nitin VaidyaDepartment of Computer Science

Texas A&M UniversityCollege Station, TX 77843-3112

zhao@cs.tamu.edu409 845-5098

Outline

1. Project Overview

2. Real-Time Traffic Modeling

3. Design and Implementation of NetCamo

4. Camouflaging Other Network Entities

5. Summary

1. Project Overview

• Objectives

• Characteristics

• Major Results

Project Objectives

• Development of countermeasures for generalized

traffic analysis

• Development of countermeasures for denial of services

Characteristics of our Work

• Based on real-time traffic modeling

• Countermeasures for generalized traffic analysis:Camouflaging the network activities whileguaranteeing end-to-end delays

• Countermeasures for denial of services:Detecting DoS attacks in real-time

• Our solutions intended for wired and wireless networks

• Our solutions are upward and downward compatible

Major Results

• Developed a prototype of NetCamo/M

A middle-ware solution for dealing with traffic analysis

+ No change to current network architecture+ Efficient

• Developed a prototype of NetCamo/N

Using independent “mini routers” for camouflaging

+ No disturbance to application hosts+ To be used by Navy HiPer-D 2000

Faculty Members Wei Zhao, Riccardo Bettati, and Nitin Vaidya

Previous Results• Our bandwidth allocation method has been officially

adopted by DoD SAFENET• Two releases of NetEx tool kit:

NetEx/Basic and NetEx/Adaptation• Two best paper awards• Two U.S. patents• Support from DoD and industry: Nortel, Networks, Cisco, Myricom, Packet Engine,

and XYLAN.

The Team

The Collaborators

Government

Navy Surface Warfare Center

HiPer-D Project (Dave Marlow and Mike Masters)

Navy SPAWAR

Distributed real-time combat systems (Russell Johnston)

West Point

Camouflaging technology (Daniel Ragsdale)

Industry

Alcatel (Packet Engines and XYLAN)

High speed routers (Kim Stearns and Dennis Majeski)

Intrusion.Com

Real-time intrusion and camouflaging devices (Joe Head)

Real-time intrusion and camouflaging devices (Mike Wang)

The Collaborators

TAMU Internal

Texas Transportation Institute

ALERT Project (Cedric J. Sims)

Texas Center for Applied Technology

University XXI Project (James Wall)

The Collaborators

2. Real-Time Traffic Modeling

Motivations

To gain information on payload traffic in orderto predict the behavior of the applications and systems

* Predict the worst-case delay

* Provide profile information of payload

- on-line verification

- on-line masking

Traffic Modeling

I)t(t, intervalin arrived bits of #max(I)

1. Peak rate methodpessimistic; over-estimating delay

2. Average rate methodoptimistic; under-estimating delay

3. Timing history methodimpractical, too much information

4. Our method: the maximum rate function:

(I) can also be randomized to deal with statistical rate bounds

Traffic Modeling

Features of (I):

* It covers a wide range of applications

* It is mathematically analyzable

* It is enforceable

* It is holographic

(I) is Mathematically Analyzable

(I) (I) = ?

F*(I) = Output between t and t + I

< Input between t - d and t+I

= F(I+d) = (I+d) * (I+d)

(I) = F*(I)/I = (I+d) * (I+d)/I

(I) is Enforceable

(I) = ( + I)/ILeaky Bucket

Any traffic

Size of tokenbucket

Line rate

(I) is Holographic

(I) can be approximated by any number of points.

Assume that (I1) = then (I) is approximated by

+ min(I1, I - I

Formula can be used recursively if more points areknown.

Traffic Modeling

H1 H 2

Sender Receiver

ATM Switch

Protocol Analyzer

M: ATM Module H: Host VC: Virtual Channel

An experiment: A workstation (H1) sends 16Mbit data per second.

Traffic Modeling

Time interval I (microseconds)

1 10 100 1,000 10,000 100,000 1,000,000

observed

app[6]

Peak Rate

Average Rate

Derived by our method

Observed

Applications ofReal-Time Traffic Modeling

* NetEx: Providing Delay-Guaranteed Communications

A Quorum project

Integrated with Honeywell RTARM system

* Countermeasure for Traffic Analysis

* Countermeasure for Denial Services

Preventing Traffic Analysis by RTTM

Traffic Analysis:

Obtain the mission status by observing network traffic

Our objectives:

» Camouflaging the traffic density

» Camouflaging the connectivity

Countermeasure for Traffic Analysis

Approaches

» Network flooding

» Traffic rerouting

Network Flooding

Flooding the network at right place and right time to make it appear to be constant rate network

Challenge: How much?

For link j,

i Fi,j( I ) + Sj( I ) = I

Traffic Rerouting

Indirect delivery of packets

Challenge: Can we still guarantee real-time delay bound?

For for connection j,

i di,,j, < Dj

Objectives

• Camouflage network activities

• Provide QoS-guaranteed communication services

• Be upward and downward compatible with existing

operating systems, applications, and network technologies

• Be scalable and evolvable

3. Design and Implementation of NetCamo

• Traffic camouflaging: rerouting and traffic padding based on real-time traffic modeling theory.

• Real-time communication: providing delay guaranteed services to applications while having traffic camouflaged

• NetCamo/M: A middle-ware solution» No change to current network architecture» Efficient

• NetCamo/N: Using independent “routers” for camouflaging» No disturbance to application hosts» To be used by Navy HiPer-D 2000

NetCamo Approaches

NetCamo/M

PayloadHost

Network

Middle-Ware Middle-WareMiddle-WareMiddle-Ware

NetCamo/M WorkflowC

s NetCamo Network

Controller

NetCamo Host

ControllerNetwork

NetCamo Host

Controller

NetCamo/M ArchitectureNetCamo Network Controller

Host Agent Host Agent

Router AgentRouter Agent

NetCamo Traffic Manager

Router Router

Host Manager

Traffic

Controller

NetCamo Host Controller

Host Manager

Traffic

Controller

NetCamo Host Controller

Host Host

Network

NetCamo/M Host Implementation

NetCamo/M Host Traffic Controller

NetCamo/M Testbed

NetCamo/M Results

Station 1 Station 2: CBR 250 pps (200 Direct + 50 Re-route via Station 4)

Station 1 Station 4: VBR 40pps (Direct)

NetCamo/N

PayloadHost

Network

Mini Router Mini Router Mini Router Mini Router

NetCamo Mini Router

Use of NetCamo/N in HiPer-D 2000

Navy SD Base NSWC

Mini Router

NetCamo/N Testbed

NetCamo/N Results

Cover Mode

Payload

4. Camouflaging Other Entities

• Camouflaging the topology

So that distributed denial of service attacks

can be prevented or avoided

• Camouflaging servers

No one can attack them anymore

• Camouflaging wireless networks

Be power aware.

Motivation

Reducing the damage of organized and distributed DoS attacks

Topology Camouflaging

Topology Camouflaging Approaches

Preventive Camouflaging

• Purposely let a group of routers misunderstandthe topology

Reactive Camouflaging

• Dynamically change routing strategy

Topology Camouflaging: Challenges

• Consistency: An altered topology should still make sense

• Efficiency: Minimizing the network management effort tolet an altered topology be perceived for a giveneffectiveness measure

• Effectiveness: Minimizing the potential damage of DoN attacksfor a given attack power

Topology Camouflaging: Realization Methods

Preventive Camouflaging (PC)

• Change Internet Control Message Protocol atsome routers

Reactive Camouflaging (RC)

• Adaptively and autonomously adjust routingtables at some routers

5. Summary

• Cyber space camouflaging (CSC) is an important strategy to

realize tolerant networks

• Traditional encryption is a special case of CSC:

i.e., camouflaging the content of payload

• While some concepts can be borrowed from physical

camouflaging techniques, much more challenges

are ahead.

Camouflaging, Concealment, and Decoyin Cyber Space

Means Packet Conn. Traffic Server Topology Op Mode

Blend Encryption Flooding

Disguising Anycasting Neutral mode

Disrupting Re-routing RC

Decoy PC Multiple cover modes

texas a&m university page 1 10/10/2014 5:19:49 pm real-time traffic modeling and its application...

university page

pm realtime traffic

pm traffic modeling

enforceable i

network traffic

pm countermeasure

pm characteristics

holographic slide

Documents

resume e portfolio - riccardo cambò

on flow marking attacks in wireless anonymous...

camouflaging of areas occupied by units of the soviet army

riccardo scarascia – real time marketing

introduction for riccardo vieri

zhiqiang lin, xiangyu zhang, dongyan xu- reuse-oriented...

riccardo ronco mta 2015 symposium

riccardo greco resume (2) - extreme...

fondazione riccardo catella - bernardo bortolotti ·...

riccardo...

structure riccardo negrini riccardo.negrini@unicatt.it

2011 modeling and detection of camouflaging worm

camouflaging and concealing structures from visual

riccardo marchesi

memorial symposium to honor riccardo giacconi · 2020. 8....

william shakespeare - riccardo ii

riccardo bellofiore february 2011 - unibg · riccardo...

riccardo pozzo - library.oapen.org

riccardo scotti galletta architect

a riccardo research presentation