eFlowC : 네트워크 관리를 위한 패킷 처리 언어

고방원(Bang-Won Ko),유재우(Jae-Woo Yoo) 한국컴퓨터정보학회 2014 韓國컴퓨터情報學會論文誌 Vol.19 No.1

본 연구는 패킷 처리를 위한 고급 프로그래밍언어 eFlow를 제안하고 이를 지원하는 개발환경을 구현한다. 또한 개발자들이 가장 익숙하고 배우기 쉬운 C 언어를 기반으로 하여 C 언어의 문법과 의미를 유지하면서, 패킷 처리에 불필요한 기능들을 제거하고 패킷 처리에 필요한 패킷 데이터, 데이터베이스 및 스트링 바이트 정보 검사, 이벤트 처리 등을 수행하기 위한 고급 프로그래밍 언어를 설계하고, 기존의 언어나 컴파일러 기술을 적용하면서 패킷 처리를 위해 필요한 언어의 기능과 컴파일 과정을 설명한다. X11 등과 같은 DPIC 장비에 활용하기 위해 이식성과 확장성을 고려한 가상 기계인 eFVM을 설계하고, 이를 위한 컴파일러와 시뮬레이터 및 디버거와 같은 개발 환경을 갖추어 실제 많이 사용되고 있는 다양한 응용 프로그램을 실험하여 제안한 언어의 효용성을 평가하고 있다. 패킷 처리를 위해 갖추어야 할 고급 언어의 기능과 형식 및 그 의미를 정의한 연구가 거의 없이 이루어진 실험에 의의가 있다. In this paper, we propose a high-level programming language for packet processing called eFlowC and it supporting programming development environment. Based on the C language which is already familiar and easy to use to program developers, eFlowC maintains the similar syntax and semantics of C. Some features that are unnecessary for the packet processing has been removed from C, eFlowC is highly focused on performing packet data, database, string byte information checking and event processing. Design high-level programming languages and apply an existing language or compiler technology, language function and compilation process that is required for packet processing will be described. In order to use the DPIC device such as X11, we designed a virtual machine eFVM that takes into account the scalability and portability. We have evaluated the utility of the proposed language by experimenting a variety of real application programs with our programming environment such as compiler, simulator and debugger for eFVM. As there is little research that devoted to define the formats, meanings and functions of the packet processing language, this research is significant and expected to be a basis for the packet processing language.

Optimization of Dynamic Programming to the Multimedia Packets Processing Method for Network Intrusion Detection System

Xu ZHAO,Jin Jiang,Max Stinnett 보안공학연구지원센터 2015 International Journal of Security and Its Applicat Vol.9 No.11

Network Intrusion Detection System (NIDS) is an important network security system. There always appears high packet loss rate in NIDS, especially when the network traffic is high. We raised Multimedia Packets Processing Method to reduce the packet loss rate and received good results. On this basis, Dynamic Programming is applied to optimize the decision-making steps of this method. This improvement can help the system to find an optimum solution to select the highest risk of multimedia data packet sequence in each time slice, moreover, the system load capacity can also be considered. In this way, the limited processing power of NIDS can be focused on the more dangerous multimedia data packets. A series of experimental results indicate this optimization can help the system to improve the detection rate of the high risk of multimedia information.

Real-time Monitoring of Packet Processing Time for Virtual Network Functions

James Won-Ki Hong,Jae-Hyoung Yoo,Nguyen Van Tu 한국통신학회 2020 한국통신학회 APNOMS Vol.2020 No.09

By enabling the deployment of softwarelized network functions on commodity servers, Network Function Virtualization (NFV) brings many benefits such as rapid development and deployment, simplicity and flexibility in network operations and management. Monitoring the performance characteristics of Virtual Network Functions (VNFs), such as packet processing time, is crucial to achieving maximum benefit from NFV. In this paper, we present Packer Processing Time Monitoring (PPTMon) - a solution for real-time and lightweight VNF packet processing time monitoring. PPTMon embeds timestamp information directly into the packets. PPTMon is implemented using extended Berkeley Packet Filter (eBPF) - a new Linux framework that allows high-speed packet processing. Our experiments showed that PPTMon can monitor VNFs with high accuracy and low performance overhead.

VIDEO TRAFFIC MODELING BASED ON GEO<SUP>Y</SUP>/G/∞ INPUT PROCESSES

SANG HYUK KANG,BARA KIM 한국산업응용수학회 2008 Journal of the Korean Society for Industrial and A Vol.12 No.3

With growing applications of wireless video streaming, an efficient video traffic model featuring modem high-compression techniques is more desirable than ever, because the wireless channel bandwidths are ever limited and time-varying. We propose a modeling and analysis method for video traffic by a class of stochastic processes, which we call 'Geo<SUP>Y</SUP>/G/∞ input processes'. We model video traffic by Geo<SUP>Y</SUP>/G/∞ input process with gamma-distributed batch sizes Y and Weibull-like autocorrelation function. Using four real-encoded, full-length video traces including action movies, a drama, and an animation, we evaluate our modeling performance against existing model, transformed- M/G/∞ input process, which is one of most recently proposed video modeling methods in the literature. Our proposed Geo<SUP>Y</SUP>/G/∞ model is observed to consistently provide conservative performance predictions, in terms of packet loss ratio, within acceptable error at various traffic loads of interest in practical multimedia streaming systems, while the existing transformed- M/G/∞ fails. For real-time implementation of our model, we analyze G/D/1/K queueing systems with Geo<SUP>Y</SUP>/G/∞ input process to upper estimate the packet loss probabilities.

패킷 페이로드 분석을 활용한 트랜스포머 기반 침입탐지시스템

박우승,김건남,이수진 한국컴퓨터정보학회 2023 韓國컴퓨터情報學會論文誌 Vol.28 No.11

Intrusion detection systems that learn metadata of network packets have been proposed recently. However these approaches require time to analyze packets to generate metadata for model learning, and time to pre-process metadata before learning. In addition, models that have learned specific metadata cannot detect intrusion by using original packets flowing into the network as they are. To address the problem, this paper propose a natural language processing-based intrusion detection system that detects intrusions by learning the packet payload as a single sentence without an additional conversion process. To verify the performance of our approach, we utilized the UNSW-NB15 and Transformer models. First, the PCAP files of the dataset were labeled, and then two Transformer (BERT, DistilBERT) models were trained directly in the form of sentences to analyze the detection performance. The experimental results showed that the binary classification accuracy was 99.03% and 99.05%, respectively, which is similar or superior to the detection performance of the techniques proposed in previous studies. Multi-class classification showed better performance with 86.63% and 86.36%, respectively.

Application of non-stationary signal characteristics using wavelet packet transformation

박상길,심현진,이혜진,오재응 대한기계학회 2008 JOURNAL OF MECHANICAL SCIENCE AND TECHNOLOGY Vol.22 No.11

Although Fourier-based methods have been standard methods for frequency analysis, they are not well suited for the analysis of nonlinear or non-stationary systems due to their time-varying natures. Thus, in this paper, a wavelet packetbased technique, which calculates time-varying coherence functions for input/output relationships, is developed. The developed method uses the Coiflet wavelet that has been widely used in signal processing. It is applied to obtain the time-varying coherence function, and to detect the impulse signal from the impulse-embedded signal such as an automobile sound/vibration signal with an external impact caused by a collision or passing over rough terrain. Some characteristics of non-stationary behavior such as the wavelet packet coefficients, maximum phase plane (MPP) analysis and fault detection are also demonstrated. The method gives promising results of non-stationary input-output systems, and so may be used as an effective tool for condition monitoring or fault detection area.

Fuzzy H∞ FIR Filtering for T–S Fuzzy Systems with Quantization and Packet Dropout

이창주,임묘택 제어·로봇·시스템학회 2018 International Journal of Control, Automation, and Vol.16 No.3

This paper proposes a new fuzzy H∞ finite impulse response (FIR) filter with quantization and packet dropout for Takagi–Sugeno (T–S) fuzzy systems with external disturbance. The measurements are quantized by a logarithmic quantizer and then transmitted from the plant to the filter imperfectly due to random packet loss described by the Bernoulli random process. The proposed fuzzy H∞ FIR filter is in the form of fuzzy-basis-independent linear matrix inequalities (LMIs) that guarantee H∞ performance. Two simulation examples are given to illustrate the effectiveness and robustness of the proposed fuzzy H∞ FIR filter.

An Algorithm to Obtain Boat Engine RPM from Passive Sonar Signals Based on DEMON Processing and Wavelets Packets Transform

Guillermo Kemper,David Ponce,Joel Telles,Christian del Carpio 대한전기학회 2019 Journal of Electrical Engineering & Technology Vol.14 No.6

The detection of the engine rotational speed in revolutions per minute (RPM) is of great importance to estimate the speed of boats. This value can be obtained from the fundamental frequency component of acquired sonar signals. However, detection can often be seriously afected by noise and distortion introduced by the underwater environment. Several methods have been proposed for fundamental component detection, but they do not specifcally take advantage of the passive sonar signal characteristics to improve the performance of the process. In this context, the proposed algorithm uses DEMON processing applied to wavelets packets subbands to exploit the characterization of the sonar signal in the time and frequency domains. The algorithm involves signal segmentation, wavelet packet decomposition, subband envelope cross-correlation and fundamental component detection from the power spectrum. The method was applied in passive sonar signals acquired in navigation and also obtained by simulation. The performance of the proposed algorithm was evaluated with signals of diferent SNR values that were also corrupted by a simulated multipath underwater channel. The signals were evaluated by both the experienced sonar operators and the proposed algorithm. The results obtained were very satisfactory for RPM detection and are detailed at the end of this document.

3GPP LTE/SAE 네트워크에서의 인증 시그널링 부하에 대한 평가

강성용(Seong-Yong Kang),한찬규(Chan-Kyu Han),최형기(Hyoung-Kee Choi) 한국정보보호학회 2012 정보보호학회논문지 Vol.22 No.2

통합된 코어 망 구조(core network architecture)와 다양한 무선 가입자 행동들은 3GPP in Release 8에서 제안된 EPC(Evolved Packet Core Network)에서 상당한 시그널링 부하 증가를 가져온다. 따라서 인증 시그널링 분석(authentication signaling analysis)은 체감품질(quality-of-experience)을 충족시키면서 인증 시그널링 부하와 지연을 줄이는 통찰력을 갖게 해준다. 본 논문에서는 갱신 과정 이론(renewal process theory)에 기반을 둔 분석적 모델링을 통해 EPS 구조에서의 시그널링 부하에 대해 평가하였다. 갱신 과정 이론은 특정 랜덤 과정(random process)에 상관없이 잘 작동 한다 (예. 포아송(Poisson)). 본 논문은 발신 발생 속도(call arrival rate), 이동성(mobility), 가입자들의 선호도와 운영정책의 관점에서 가입자들의 다양한 패턴을 고려하였다. 매개변수들과 성능지표들 사이의 상호관계를 나타내기 위해 수치적인 결과를 사용하였다. 수직적 핸드오버(vertical handover) 성능의 민감도와 heavy-tail process의 영향에 대해서도 검토하였다. The integrated core network architecture and various mobile subscriber behavior can result in a significant increase of signaling load inside the evolved packet core network proposed by 3GPP in Release 8. Consequently, an authentication signaling analysis can provide insights into reducing the authentication signaling loads and latency, satisfying the quality-of-experience. In this paper, we evaluate the signaling loads in the EPS architecture via analytical modeling based on the renewal process theory. The renewal process theory works well, irrespective of a specific random process (i.e. Poisson). This paper considers various subscribers patterns in terms of call arrival rate, mobility, subscriber"s preference and operational policy. Numerical results are illustrated to show the interactions between the parameters and the performance metrics. The sensitivity of vertical handover performance and the effects of heavy-tail process are also discussed.

An Extension of the M/M/1 Queue with a First-order Integer-valued AR Source

Gyemin Lee 한국자료분석학회 1999 Journal of the Korean Data Analysis Society Vol.1 No.2

In this paper, we propose an extension of the M/M/1 queue with a first-order integer-valued AR process. The proposed model may be more appropriate for packetized communication networks since it reflects the correlation of the input streams. Also we derive a way to obtain the queue length distri- bution of this model, and then investigate the effect of the correlation on queueing performance.