Within our academic high-speed network infrastructure which is used for connecting all universities and high schools in our country to the Internet, there are thousands of cybersecurity attacks occurring every day. That is why, within our SANET II project, an effort has been made to create a self-learning system without a teacher, which would be able to quickly adapt to arbitrary traffic and recognize DDoS attacks on time, even in high-speed networks, with a potential simple implementation into a hardware probe. In the article, we deal with the Hurst and autoregression coefficients and the coefficient of variation. We test the coefficients on simulated data and on real records of attacks. For early machine recognition of the attack, we propose the so-called predicting $\sigma$-tunnel. The obtained results can lead to the investigation of other prediction methods that would improve the early recognition of an attack.

As part of the research in the recently ended project SANET II, we were trying to create a new machine-learning system without a teacher. This system was designed to recognize DDoS attacks in real time, based on adaptation to real-time arbitrary traffic and with the ability to be embedded into the hardware implementation of network probes. The reason for considering this goal was our hands-on experience with the high-speed SANET network, which interconnects Slovak universities and high schools and also provides a connection to the Internet. Similar to any other public-facing infrastructure, it is often the target of DDoS attacks. In this article, we are extending our previous research, mainly by dealing with the use of various statistical parameters for DDoS attack detection. We tested the coefficients of Variation, Kurtosis, Skewness, Autoregression, Correlation, Hurst exponent, and Kullback–Leibler Divergence estimates on traffic captures of different types of DDoS attacks. For early machine recognition of the attack, we have proposed several detection functions that use the response of the investigated statistical parameters to the start of a DDoS attack. The proposed detection methods are easily implementable for monitoring actual IP traffic.

This paper deals with the modeling of real IP flows using Markov-modulated On–Off processes. In the first section of the paper, we summarize the knowledge found so far about the Markov modulated On–Off regular process model, which has already been published in our previous papers. For the sake of completeness, we also summarize the well-known facts regarding the Bernoulli process. In the second section, we deal with the continuation of modeling using the Markov-modulated On–Off Bernoulli process. Our own derivation of the hitherto-unknown probability distribution of time spaces (tail distribution) is completely new. For its derivation, we used the tail distribution generating function, and then, using its derivation, we calculated the hitherto-unknown moments of the distribution (mean, variation, and third initial moment). This knowledge will allow us to create a new numerical procedure for estimating MMBP parameters from measured IP traffic. Finally, we present a formula for the sizing of network resources for a given flow using effective bandwidth with respect to QoS based on a given level of IP traffic.

This paper proposes a novel methodology for the design of dual-stack IP routing protocols focused on neighborships and routing messages transport. The first part describes currently used dual-stack IP routing protocols, their history, and key features. The description of four identified combinations based on a number of neighbor sessions and protocol used for the transport of routing messages is presented afterward. These combinations are introduced as Protocol Integration Solution Classes (PISCs) in this paper. Colored Petri nets (CPNs) are selected as a formal method to create a model of each PISC. The following parts deal with a detailed description and analysis of the created Protocol Integration Solution Class models, which are also verified and compared with each other. Based on the comparison of each PISC model simulation step, the PISC 2 class is selected as the most efficient one. The last part of the paper formulates recommendations for the dual-stack IP routing protocol design based on the results presented in this paper.