United States

&quot;The rise of sequential Machine Learning (ML) methods has paved the way for a new generation of Network Intrusion Detection Systems (NIDS) which base their classification on the temporal patterns exhibited by malicious traffic. 
Previous work presents successful algorithms in this field, but just a few attempts try to assess their robustness in real-world contexts. 
We aim to fill this gap by presenting a novel evaluation methodology. In particular, we propose a new time-based adversarial attack in which we simulate a delay in the malicious communications that changes the arrangement of the samples in the test set. Moreover, we design an innovative evaluation technique simulating a worst-case training scenario in which the last portion of the training set does not include any malicious flow. Through them, we can evaluate how much sequential ML-based NIDS are sensible to modifications that an adaptive attacker might apply at temporal level, and we can verify their robustness to the unpredictable traffic produced by modern networks.
Our experimental campaign validates our proposal against a recent NIDS trained on a public dataset for botnet detection. The results demonstrate its high resistance to temporal adversarial attacks, but also a drastic performance drop when even just 1%  of benign flows are injected at the end of the training set. Our findings raise questions about the reliable deployment of sequential ML-NIDS in practice, and at the same time can guide researchers to develop more robust defensive tools in the future.&quot;

IEEE NCA 2022

Robustness evaluation of Network Intrusion Detection Systems based on Sequential Machine Learning

network intrusion detection systems

temporal patterns

robustness evaluation

sequential ml

adversarial attacks

"The rise of sequential Machine Learning (ML) methods has paved the way for a new generation of Network Intrusion Detection Systems (NIDS) which base their classification on the temporal patterns exhibited by malicious traffic. 
Previous work presents successful algorithms in this field, but just a few attempts try to assess their robustness in real-world contexts. 
We aim to fill this gap by presenting a novel evaluation methodology. In particular, we propose a new time-based adversarial attack in which we simulate a delay in the malicious communications that changes the arrangement of the samples in the test set. Moreover, we design an innovative evaluation technique simulating a worst-case training scenario in which the last portion of the training set does not include any malicious flow. Through them, we can evaluate how much sequential ML-based NIDS are sensible to modifications that an adaptive attacker might apply at temporal level, and we can verify their robustness to the unpredictable traffic produced by modern networks.
Our experimental campaign validates our proposal against a recent NIDS trained on a public dataset for botnet detection. The results demonstrate its high resistance to temporal adversarial attacks, but also a drastic performance drop when even just 1%  of benign flows are injected at the end of the training set. Our findings raise questions about the reliable deployment of sequential ML-NIDS in practice, and at the same time can guide researchers to develop more robust defensive tools in the future."

technical paper

### Welcome to IEEE NCA 2022!

NCA 2022, the International Symposium on Network Computing and Applications, is a successful series of conferences that serves as a large international forum for presenting and sharing recent research results and technological developments in the fields of Network and Cloud Computing. NCA, which is sponsored by the IEEE Computer Society, reaches out to both researchers and practitioners, and to both academia and industry. The conference features keynotes, technical presentations, and workshops.

All papers presented at the main conference and the workshops will be submitted to IEEE Xplore for publication and indexing.

[More about NCA](https://www.nca-ieee.org/2022/index.html)

**Organization**

* Steering Committee Chair: Dimiter R. Avresky, *IRIANC, Boston/Munich, USA/Germany*
* General Chair: Michele Colajanni, *University of Bologna, Italy*
* Program Chair: Miguel Pardal, *INESC-ID, Lisboa, Portugal*
* Program Chair: Luca Ferretti, *University of Modena and Reggio Emilia, Italy*
* Financial Chair: Mauro Andreolini, *University of Modena and Reggio Emilia, Italy*

**The topics of interest include, but are not limited to:**

* Theory of Network Computing
* Autonomic Network Computing
* Content Delivery Network (CDN)
* High Speed Networks/Protocols and Middleware
* Routing Mechanisms
* Overlay Networks/Peer-to-Peer Systems
* System Area Networks (SAN)/Clusters
* Performance Modeling/Quality of Services (QoS) Issues
* Web Caching and Switching
* Dependable Wide, Local, and System Area Networks
* Network Security
* Intrusion-Tolerant Networked Systems
* Scalable and Dependable Servers and Data Centers
* Middleware for Dependable Network Computing
* Self* (Configuring, Healing, Optimizing, Protecting, Organizing, Aware)
* Platforms for Network Computing
* Network Protocols: Verification and Validation
* Autonomic Network Computing for Achieving Self* Properties and Applications Availability
* Seamless and Virtual Capabilities for Implementing Self* Properties
* Software Defined Networking (SDN): Principles and Implementation
* Designing Highly-Available and Secure SDN
* Network Functions Virtualization (NFV): Design and Optimization
* Network Cloud Computing
* Machine Learning Techniques for Cloud Resources Management
* Big Data in Clouds for IoT
* Future Internet and Communicating Objects
* Mobile Ad-Hoc Networks (MANET)
* Sensor Networks
* Fog/Edge Computing
* Energy-Efficient Computation and Communication
* Applications to Real and/or Complex Problems, Practical Experiences and Prototypes
* Programming Environments for Distributed Systems
* Blockchain
* Byzantine Fault Tolerance
* Web and Mobile Security
* Security of Networked Applications (including Automotive, Industrial and Cyberphysical Systems)


To access the IEEE NCA 2022 content, [please register here ](https://www.nca-ieee.org/2022/registration.html)

NCA 2022, the International Symposium on Network Computing and Applications, is a successful series of conferences that serves as a large international forum for presenting and sharing recent research results and technological developments in the fields of Network and Cloud Computing.

The presentation proposes SixPack v2, an enhanced version of the SixPack attack that allows to evade even state-of- the-art misbehavior detection systems. As the original SixPack, SixPack v2 is a dynamic attack targeting other C-ITS entities by simulating the sudden activation of the braking system with consequent activation of the Anti-lock Braking System. SixPack v2 achieves better evasion by improving the main phases of the attack (FakeBrake, Recovery, and Rejoin) through a novel path-reconstruction algorithm that generates a more realistic representation of the real vehicle trajectory.

SixPack v2: enhancing SixPack to avoid last generation misbehavior detectors in VANETs

Network traffic engineering aims at the network quality, optimizing routes and detecting network attacks. In this context, traffic prediction is an essential tool to capture the underlying behavior of a network. Therefore, this work proposes a modularization architecture for volumetric prediction models, allowing switching between models and setups at runtime in controllers of Software Defined Networks (SDN), dealing with short time series and delivering the data already processed for the prediction. The proposed architecture compares the results from four traditional predictors based on short-range time dependency.

Modularized and Contract-Based Prediction Models in Programable Networks

"This short paper presents a novel formalism for describing the
evolution of dynamic-link network parameters which is based on Cellular Automata (CA) models."

On using Cellular Automata for Modeling the Evolution of Dynamic-Link Network Parameters

"Augmented Reality (AR) and Virtual Reality (VR) games are some of the emerging use cases of 5G in the area of ultra-Reliable and Low Latency Communications (uRLLC). A multiplayer AR/VR game broadly consists of compute-intensive tasks which convert the raw data generated from sensory sources such as wearables, smartphones, etc., to action data such as location, orientation, intention, etc., and services that process the action data. Services generate a common response to all
players by taking action data as input. The total response time must be as low as 20 milliseconds for a good user experience and to prevent motion sickness. While considering these aspects, the multiplayer game must be scalable, and users should be able to move. Multi-access edge computing (MEC) helps to improve performance by partially/fully offloading such tasks from mobile devices and latency-sensitive services from the cloud to a server at the edge called the MEC host. We propose, for the first time, an online mobility-aware heuristic in a Multi-access Edge Computing Network (MEN) to reduce the response time, specifically the Game Frame Time (GFT), consistently, for an improved Quality of Experience (QoE), for such games. This is done by jointly offloading tasks and placing services, and migrating both whenever required. Additionally, for improved response, the network is partitioned into regions, and a service instance is placed on a MEC host, called the Region Coordinator (RC), in each region, in a decentralized manner. When a new player joins, an old player leaves, or old players move, the number of players and their mobility patterns change in a particular region. This may require allocating or moving tasks from one MEC host to another and migrating services to a new RC. While tasks and services are migrated, the associated state and data must be moved to the destination MEC host. Our experiments demonstrate that the standard deviation for
the mean GFT is 0 ms in the best case and 9.26 ms in the worst case, providing a uniform user experience, even when mobility is as high as 50% (it means 50% of the players are moving). When there is mobility, the GFT increases by 28.29% in the best
case and 37.18% in the worst case, compared to a no-mobility scenario. We also demonstrate that, given computing power, there is a tradeoff between responsiveness and GFT."

Mobility-aware Multi-Access Edge Computing for Multiplayer Augmented and Virtual Reality Gaming

Energy efficiency is considered a significant concern in the deployment and operation of data center networks. In this work, to address the energy consumption problem in data center networks, we propose an energy-efficient routing approach that considers that the network devices work based on traffic demand. Our approach monitors the traffic demand to improve the energy efficiency in SD-DCN networks. The simulation results reflect the enhancement of the proposed approach to optimize the end-to-end delay, throughput, and energy savings.

Energy-Aware Routing in SDN Enabled Data Center Network

Cloud-based services are a current approach for developing large-scale applications with advantages such as flexibility, access to on-demand resources, and business agility. The overall application functionality results from complex interactions of many decoupled services, each having its operational specificity. Due to this complexity, the manual configuration of these systems is very arduous, error-prone and likely to impair the quality of service, leading to malfunctioning services, lowering availability and accruing costs. Identifying the optimal solution to simultaneously optimize availability and costs, whilst meeting service-level objectives remains a challenge for professionals developing solutions using cloud services. This paper proposes a mathematical formulation of a bi-objective problem to identify the optimal set of solutions for the system configuration. Empirical evaluation of the proposed approach in a case study of a real industrial scenario results in an R-Squared of 0.85, an MSE of 0.021 and an optimization accuracy of 0.928. These methods can help practitioners to keep services at an optimum configuration enabling autonomic service operation, whilst improving availability and cost.

Bi-objective optimization of availability and cost for cloud services

Firewalls for IoT devices can be enforced at the gateway router or at the cloud. Utilizing a fog based architecture, firewalls can also be enforced at the fog layer. Depending on where the firewall is running, varying delays and overhead will be experienced by IoT devices. Some IoT devices are sensitive to the incurred delays. So choosing the most suitable platform to enforce a firewall for each individual device considering the delay sensitivity of the device is important. This presentation  gives an overview of a delay-aware IoT firewall enforcing mechanism using fog-cloud architecture. The presentation includes the system architecture, methodology, workflow of dynamic assignment of different devices to different platforms, the idea of delay monitoring and load-balancing, and future work.

Enforcing delay-aware fog-cloud based IoT firewall (Work In Progress)

"This work present a software-defined, dynamic and autonomous network slice management middleware for 5G-based industrial internet of things use
cases, such as adaptive robotic repair. "

Software-defined Dynamic 5G Network Slice Management for Industrial Internet of Things

"During this presentation, we consider communication market scenarios where operators lease resources from the InP.
We propose a resolution approach based on an admission control program and a greedy heuristic algorithm that performs the resource allocation.
We show that our algorithm provides good results for multiple scenarios generated in a real environment.
"

Inter-slice B5G Bandwidth Resource Allocation

In beyond 5G (B5G) network, unmanned aerial vehicle (UAV) is considered as a promising solution to improve network coverage and satisfy the wide variety of service requirements. In B5G, mobile terminals (MTs) will be able to connect to
UAVs flying in different altitudes and serving different classes of applications such as enhanced mobile broadband (eMBB), ultra reliable low latency communication (uRLLC) and security intensive applications such as security as a service (SaaS). It
may be noted that UAVs in high altitude incur high power consumption, but reduced secrecy throughput and packet loss. In contrast, lower altitude UAVs incur high packet loss and secrecy throughput with reduced power consumption. Due to
such trade-off and the fact that the traditional user association problem is NP hard, selecting an appropriate UAV to satisfy the user requirement is a computationally challenging task. In this work, an UAV selection mechanism has been proposed for UAV enabled B5G network based on analytic hierarchy process (AHP) which essentially captures the aforementioned trade-off while associating the MTs with the UAVs. The proposed AHP selects the best UAV based on the application class. Simulation results show that the proposed UAV selection mechanism outperforms the existing best downlink (BD) based approach in terms of user throughput, secrecy throughput and packet loss rate

Premium content

Robustness evaluation of Network Intrusion Detection Systems based on Sequential Machine Learning

Downloads

Next from IEEE NCA 2022

SixPack v2: enhancing SixPack to avoid last generation misbehavior detectors in VANETs

Stay up to date with the latest Underline news!

PRESENTATIONS

CONFERENCES

COMPANY

RESOURCES