Within our academic high-speed network infrastructure which is used for connecting all universities and high schools in our country to the Internet, there are thousands of cybersecurity attacks occurring every day. That is why, within our SANET II project, an effort has been made to create a self-learning system without a teacher, which would be able to quickly adapt to arbitrary traffic and recognize DDoS attacks on time, even in high-speed networks, with a potential simple implementation into a hardware probe. In the article, we deal with the Hurst and autoregression coefficients and the coefficient of variation. We test the coefficients on simulated data and on real records of attacks. For early machine recognition of the attack, we propose the so-called predicting $\sigma$-tunnel. The obtained results can lead to the investigation of other prediction methods that would improve the early recognition of an attack.

Pattern recognition systems always misclassify anomalies, which can be dangerous for uninformed users. Therefore, anomalies must be filtered out from each classification. The main challenge for the anomaly filter design is the huge number of possible anomaly samples compared with the number of samples in the training set. Tailoring the filter for the given classifier is just the first step in this reduction. Paper tests the hypothesis that the filter trained in avoiding “near” anomalies will also refuse the “far” anomalies, and the anomaly detector is then just a classifier distinguishing between “far real” and “near anomaly” samples. As a “far real” samples generator was used, a Generative Adversarial Network (GAN) fake generator that transforms normally distributed random seeds into fakes similar to the training samples. The paper proves the assumption that seeds unused in fake training will generate anomalies. These seeds are distinguished according to their Chebyshev norms. While the fakes have seeds within the hypersphere with a given radius, the near anomalies have seeds within the sphere near cover. Experiments with various anomaly test sets have shown that GAN-based anomaly detectors create a reliable anti-anomaly shield using the abovementioned assumptions. The proposed anomaly detector is tailored to the given classifier, but its limitation is due to the need for the availability of the database on which the classifier was trained.

As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

This paper deals with the modeling of real IP flows using Markov-modulated On–Off processes. In the first section of the paper, we summarize the knowledge found so far about the Markov modulated On–Off regular process model, which has already been published in our previous papers. For the sake of completeness, we also summarize the well-known facts regarding the Bernoulli process. In the second section, we deal with the continuation of modeling using the Markov-modulated On–Off Bernoulli process. Our own derivation of the hitherto-unknown probability distribution of time spaces (tail distribution) is completely new. For its derivation, we used the tail distribution generating function, and then, using its derivation, we calculated the hitherto-unknown moments of the distribution (mean, variation, and third initial moment). This knowledge will allow us to create a new numerical procedure for estimating MMBP parameters from measured IP traffic. Finally, we present a formula for the sizing of network resources for a given flow using effective bandwidth with respect to QoS based on a given level of IP traffic.

This paper focuses on the portability of Cloud Computing (CC) services, specifically on the problems with the portability of Infrastructure as a Service (IaaS). We analyze the current state of CC with the intention of standardizing the portability of CC solutions. CC IaaS providers often use proprietary solutions, which leads to a problem known as “vendor lock-in”. Another problem might appear during migration between two providers if huge scripts are written in a proprietary language. To solve the portability problem, we applied the Model-Driven Architecture (MDA) approach to propose the general IaaS reference architecture. Using a generic IaaS model, we are able to describe entities of the IaaS environment and then design necessary transformation rules for specific IaaS environments in a simplified but flexible way. Using this model, we continue designing transformation rules that define the transcript of IaaS services. The CC-portability problem is thus solved by transforming a specific IaaS service description from one description to another through the generic model. This approach is extensible and can be adopted for the evolution of CC services. Therefore, it can be used as a generic solution to IaaS-portability issues. Using this flexible approach, the introduction of a new CC environment requires only the design of a single transformation rule that prevents proprietary peer-to-peer full-mesh mappings. Thanks to the proposed model and the transformation rules described, we were able to experimentally confirm the functionality of the transfer of the environment description between three cloud providers.

OpenStack is a popular open-source cloud platform that orchestrates virtualized compute, storage, and networking resources. In such virtualized environments, packet traceability refers to the ability to track the path and transformations of network packets as they traverse virtual switches, routers, and interfaces. This paper presents a comprehensive overview of packet traceability in OpenStack cloud environments. We provide an introduction to the OpenStack architecture with a focus on the Networking component (Neutron) and discuss how packets flow through virtual networking elements. We examine the routing and interface mechanisms that enable communication within and across nodes, and compare single-node versus multi-node OpenStack deployments from a packet tracing perspective. Furthermore, we survey tools and techniques for packet tracing (such as monitoring interfaces, using tcpdump, and Open vSwitch tracing), and highlight the challenges faced (multi-tenancy, overlay networks, etc.) in tracing packets. We offer recommendations for improving traceability, including leveraging built-in OpenStack features and advanced kernel-level tracing technologies. Our goal is to aid cloud administrators and researchers in understanding and improving network packet observability in OpenStack clouds, thereby enhancing troubleshooting and security analysis capabilities.