Engineering Papers⌕ Search

SEARCH · Engineering Papers

Results for “Network traffic analysis”

Search indexed NASA NTRS and DOE OSTI research on propulsion, heat transfer, battery materials and energy systems. Follow report and document links to the original sources.

Quote a phrase for an exact phrase match. Source license links do not imply unrestricted reuse.

At least 91 records · Page 5
All sourcesNASA NTRSDOE OSTI
NASA NTRS1994

Data communication network at the ASRM facility

This three-year project (February 1991 to February 1994) has involved analyzing and helping to design the communication network for the Advanced Solid Rocket Motor (ASRM) facility at Yellow Creek, near Iuka, MS. The principal concerns in the analysis were the bandwidth (both on average and in the worst case) and the expandability of the network. As the communication network was designed and modified, a careful evaluation of the bandwidth of the network, the capabilities of the protocol, and the requirements of the controllers and computers on the network was required. The overall network, which was heterogeneous in protocol and bandwidth, needed to be modeled, analyzed, and simulated to obtain some degree of confidence in its performance capabilities and in its performance under nominal and heavy loads. The results of our analysis did have an impact on the design and operation of the ASRM facility. During 1993 we analyzed many configurations of this basic network structure. The analyses are described in detail in Section 2 and 3 herein. Section 2 reports on an analysis of the whole network. The preliminary results of that research indicated that the most likely bottleneck as the network traffic increased would be the hubs. Thus a study of Cabletron hubs was initiated. The results of that study are in Section 3. Section 4 herein reports on the final network configuration analyzed. When the ASRM facility was mothballed in December of 1993, this was basically the planned and partially installed network. A briefing was held at NASA/MSFC on December 7, 1993, at which time our final analysis and conclusions were disseminated. This report contains a written record of most of the information disseminated at that briefing.

Moorhead, Robert J., III↗
DOE OSTI2017

Pattern Discovery in Internet Background Radiation

Internet Background Radiation (IBR) is observed in empty network address spaces. No traffic should arrive there, but it does in overwhelming quantities, gathering evidences of attacks, malwares and misconfigurations. The study of IBR helps to detect spreading network problems, common vulnerabilities and attack trends. However, network traffic data evolves quickly and is of high volume and diversity, i.e., an outstanding big data challenge. When used to assist network security, it also requires the online classification of dynamic streaming data. In this paper, we introduce an AGgregation & Mode (AGM) vector to represent network traffic. The AGM format characterizes IP hosts by extracting aggregated and mode values of IP header fields, and without inspecting payloads. We performed clustering and statistical analysis to explore six months of IBR from 2012 with the AGM mapping. The discovered patterns allow building a classification of IBR, which identifies phenomena that have been actively polluting the Internet for years. The AGM representation is light and tailored for monitoring and pattern discovery. We show that AGM vectors are suitable to analyze large volumes of network traffic: they capture permanent operations, such as long term scanning, as well as bursty events from targeted attacks and short term incidents.

Iglesias, Felix↗
DOE OSTI2019

City-Wide Eco-Routing Navigation Considering Vehicular Communication Impacts

Intelligent Transportation Systems (ITSs) utilize Vehicular Ad-hoc Networks (VANETs) to collect, disseminate, and share data with the Traffic Management Center (TMC) and different actuators. Consequently, packet drop and delay in VANETs can significantly impact ITS performance. Feedback-based eco-routing (FB-ECO) is a promising ITS technology, which is expected to reduce vehicle fuel/energy consumption and pollutant emissions by routing drivers through the most environmentally friendly routes. To compute these routes, the FB-ECO utilizes VANET communication to update link costs in real-time, based on the experiences of other vehicles in the system. In this paper, we study the impact of vehicular communication on FB-ECO navigation performance in a large-scale real network with realistic calibrated traffic demand data. We conduct this study at different market penetration rates and different congestion levels. We start by conducting a sensitivity analysis of the market penetration rate on the FB-ECO system performance, and its network-wide impacts considering ideal communication. Subsequently, we study the impact of the communication network on system performance for different market penetration levels, considering the communication system. The results demonstrate that, for market penetration levels less than 30%, the eco-routing system performs adequately in both the ideal and realistic communication scenarios. It also shows that, for realistic communication, increasing the market penetration rate results in a network-wide degradation of the system performance.

32 ENERGY CONSERVATION, CONSUMPTION, AND UTILIZATI↗
DOE OSTI2022

ThunderSecure: deploying real-time intrusion detection for 100G research networks by leveraging stream-based features and one-class classification network

Nowadays, data generated by large-scale scientific experiments are on the scale of petabytes per month. These data are transferred through dedicated high-bandwidth networks (40/100G) across distributed sites for processing, storage, and analysis. Like general purpose networks, research networks experience intrusions. However, monitoring anomalies in such high-speed network traffics is challenging given current cyber-infrastructure. Moreover, traditional network intrusion detection systems (NIDS) are signature based. However, anomaly patterns are difficult to define and that rulesets are often not updated frequently enough to reflect the changes of attack behaviors. We present ThunderSecure, a high-throughput, unsupervised learning-based intrusions detection system for 100G research networks. ThunderSecure implements an efficient packet processing and detection pipeline using multi-cores and GPUs. It extracts statistical and temporal features from real-time network data streams and feeds them to a one-class anomaly detection network. A baseline of normal distribution will be created based on the training observation. Testing traffic deviated from the learned profile will be marked as anomalies. We trained ThunderSecure on hundreds of billions of science data packets mirrored from two 100G network connections at Fermi National Accelerator Laboratory. The detection performance was evaluated on traffic captured from the same research network days and weeks after the training with different types of attack flows injected. Results show that ThunderSecure can recognize science data traffic captured long after the training and made nearly certain detection on the segment of the streams where anomalous flows were injected.

100G research network↗
NASA NTRS1992

Advanced Solid Rocket Motor (ASRM) communications network analysis

This paper describes the simulation of a proposed campus-wide network for a new manufacturing facility. The proposed network consists of five carrier sense multiple access with collision detection (CSMA/CD) networks connected to five ports of a VAX cluster. In Section 1 the system configuration, the projected traffic pattern, and the proposed protocols are presented. Section 2 describes the models used in constructing the network simulation, while Section 3 contains the results and an analysis of the simulations. The simulations are compared to a mathematical model in Section 4. Some conclusions are drawn in Section 5.

Thompson, Dale R.↗
NASA NTRS1983

Communications network design and costing model technical manual

This computer model provides the capability for analyzing long-haul trunking networks comprising a set of user-defined cities, traffic conditions, and tariff rates. Networks may consist of all terrestrial connectivity, all satellite connectivity, or a combination of terrestrial and satellite connectivity. Network solutions provide the least-cost routes between all cities, the least-cost network routing configuration, and terrestrial and satellite service cost totals. The CNDC model allows analyses involving three specific FCC-approved tariffs, which are uniquely structured and representative of most existing service connectivity and pricing philosophies. User-defined tariffs that can be variations of these three tariffs are accepted as input to the model and allow considerable flexibility in network problem specification. The resulting model extends the domain of network analysis from traditional fixed link cost (distance-sensitive) problems to more complex problems involving combinations of distance and traffic-sensitive tariffs.

Logan, K. P.↗
DOE OSTI2021

Companion Assisted Software Based Remote Attestation in SCADA Networks

Critical infrastructure such as power generation and water distribution systems have become a priority target in cyber warfare because of their recent computerization and introduction to the internet. As a result, Supervisory Control and Data Acquisition (SCADA) system security has become a hot topic in academic and industrial research. Among these topics, Remote Attestation is a security method intended to detect the presence of fileless malware in remote devices as they continue to operate. This allows for the detection of malware in the absence of long-term storage artifacts before symptoms of compromise begin to appear. In general, a trusted device (the verifier) makes a request for evidence of innocence from the untrusted device (the prover). In software-based schemes, the verifier can then measure the delay between its request and the prover’s response. If this delay is greater than the known computational time of the evidence gathering algorithm performed by the prover, then evidence may have been forged. Multi-hop networks often introduce too much network jitter to allow accurate measurement of prover response time, which limits the effectiveness of software based Remote Attestation in a real-world setting. In this work, we introduce a companion device that the verifier can trust to perform a subset of attestation, thereby removing any network jitter. This device is a Field Programmable Gate Array (FPGA) that is physically connected to the prover. We provide a communication protocol between the verifier, prover, and companion. To evaluate our scheme, we simulate it in a common SCADA network environment under normal and heavy traffic loads. Our simulations are performed in the discrete event network simulator NS-3, and we perform statistical analysis over our results to show that our scheme allows for tight timing constraints to be placed on the prover such that the verifier can more easily determine the validity of the evidence that it receives.

Johnson, William A.↗
DOE OSTI2015

Behavior-dependent Routing: Responding to Anomalies with Automated Low-cost Measures

This is a conference paper submission describing research and software implementation of a cybersecurity concept that uses behavior models to trigger changes in routing of network traffic. As user behavior deviates more and more from baseline models, traffic is routed through more elevated layers of analysis and control.

information flow controls↗
NASA NTRS2002

The Aeronautical Data Link: Taxonomy, Architectural Analysis, and Optimization

The future Communication, Navigation, and Surveillance/Air Traffic Management (CNS/ATM) System will rely on global satellite navigation, and ground-based and satellite based communications via Multi-Protocol Networks (e.g. combined Aeronautical Telecommunications Network (ATN)/Internet Protocol (IP)) to bring about needed improvements in efficiency and safety of operations to meet increasing levels of air traffic. This paper will discuss the development of an approach that completely describes optimal data link architecture configuration and behavior to meet the multiple conflicting objectives of concurrent and different operations functions. The practical application of the approach enables the design and assessment of configurations relative to airspace operations phases. The approach includes a formal taxonomic classification, an architectural analysis methodology, and optimization techniques. The formal taxonomic classification provides a multidimensional correlation of data link performance with data link service, information protocol, spectrum, and technology mode; and to flight operations phase and environment. The architectural analysis methodology assesses the impact of a specific architecture configuration and behavior on the local ATM system performance. Deterministic and stochastic optimization techniques maximize architectural design effectiveness while addressing operational, technology, and policy constraints.

Morris, A. Terry↗
NASA NTRS2010

Visualization of Traffic Accidents

Traffic accidents have tremendous impact on society. Annually approximately 6.4 million vehicle accidents are reported by police in the US and nearly half of them result in catastrophic injuries. Visualizations of traffic accidents using geographic information systems (GIS) greatly facilitate handling and analysis of traffic accidents in many aspects. Environmental Systems Research Institute (ESRI), Inc. is the world leader in GIS research and development. ArcGIS, a software package developed by ESRI, has the capabilities to display events associated with a road network, such as accident locations, and pavement quality. But when event locations related to a road network are processed, the existing algorithm used by ArcGIS does not utilize all the information related to the routes of the road network and produces erroneous visualization results of event locations. This software bug causes serious problems for applications in which accurate location information is critical for emergency responses, such as traffic accidents. This paper aims to address this problem and proposes an improved method that utilizes all relevant information of traffic accidents, namely, route number, direction, and mile post, and extracts correct event locations for accurate traffic accident visualization and analysis. The proposed method generates a new shape file for traffic accidents and displays them on top of the existing road network in ArcGIS. Visualization of traffic accidents along Hampton Roads Bridge Tunnel is included to demonstrate the effectiveness of the proposed method.

Wang, Jie↗
NASA NTRS1992

Spreadsheet Analysis Of Queuing In A Computer Network

Method of analyzing responses of computer network based on simple queuing-theory mathmatical models via spreadsheet program. Effects of variations in traffic, capacities of channels, and message protocols assessed.

Galant, David C.↗
DOE OSTI2017

Millions of targets under attack: a macroscopic characterization of the DoS ecosystem

Denial-of-Service attacks have rapidly increased in terms of frequency and intensity, steadily becoming one of the biggest threats to Internet stability and reliability. However, a rigorous comprehensive characterization of this phenomenon, and of countermeasures to mitigate the associated risks, faces many infrastructure and analytic challenges. We make progress toward this goal, by introducing and applying a new framework to enable a macroscopic characterization of attacks, attack targets, and DDoS Protection Services (DPSs). Our analysis leverages data from four independent global Internet measurement infrastructures over the last two years: backscatter traffic to a large network telescope; logs from amplification honeypots; a DNS measurement platform covering 60% of the current namespace; and a DNS-based data set focusing on DPS adoption. Our results reveal the massive scale of the DoS problem, including an eye-opening statistic that one-third of all / 24 networks recently estimated to be active on the Internet have suffered at least one DoS attack over the last two years. We also discovered that often targets are simultaneously hit by different types of attacks. In our data, Web servers were the most prominent attack target; an average of 3% of the Web sites in .com, .net, and .org were involved with attacks, daily. Finally, we shed light on factors influencing migration to a DPS.

Jonker, Mattijs↗
DOE OSTI2022

Securing Inverter Communication: Proactive Intrusion Detection and Mitigation System to Tap, Analyze, and Act

The electric grid has undergone rapid, revolutionary changes in recent years; from the addition of advanced smart technologies to the growing penetration of distributed energy resources (DERs) to increased interconnectivity and communications. However, these added communications, access interfaces, and third-party software to enable autonomous control schemes and interconnectivity also expand the attack surface of the grid. To address the gap of DER cybersecurity and secure the grid-edge to motivate a holistic, defense-in-depth approach, a proactive intrusion detection and mitigation system (PIDMS) device was developed to secure PV smart inverter communications. The PIDMS was developed as a distributed, flexible bump-in-the-wire (BITW) solution for protecting PV smart inverter communications. Both cyber (network traffic) and physical (power system measurements) are processed using network intrusion monitoring tools and custom machinelearning algorithms for deep packet analysis and cyber-physical event correlation. The PIDMS not only detects abnormal events but also deploys mitigations to limit or eliminate system impact; the PIDMS communicates with peer PIDMSs at different locations using the MQTT protocol for increased situational awareness and alerting. The details of the PIDMS methodology and prototype development are detailed in this report as well as the evaluation results within a cyber-physical emulation environment and subsequent industry feedback.

14 SOLAR ENERGY↗
NASA NTRS2013

Coarse-Grain Bandwidth Estimation Techniques for Large-Scale Space Network

In this paper, we describe a top-down analysis and simulation approach to size the bandwidths of a store-andforward network for a given network topology, a mission traffic scenario, and a set of data types with different latency requirements. We use these techniques to estimate the wide area network (WAN) bandwidths of the ground links for different architecture options of the proposed Integrated Space Communication and Navigation (SCaN) Network.

Cheung, Kar-Ming↗
DOE OSTI2017

Deep Packet/Flow Analysis using GPUs

Deep packet inspection (DPI) faces severe performance challenges in high-speed networks (40/100 GE) as it requires a large amount of raw computing power and high I/O throughputs. Recently, researchers have tentatively used GPUs to address the above issues and boost the performance of DPI. Typically, DPI applications involve highly complex operations in both per-packet and per-flow data level, often in real-time. The parallel architecture of GPUs fits exceptionally well for per-packet network traffic processing. However, for stateful network protocols such as TCP, their data stream need to be reconstructed in a per-flow level to deliver a consistent content analysis. Since the flow-centric operations are naturally antiparallel and often require large memory space for buffering out-of-sequence packets, they can be problematic for GPUs, whose memory is normally limited to several gigabytes. In this work, we present a highly efficient GPU-based deep packet/flow analysis framework. The proposed design includes a purely GPU-implemented flow tracking and TCP stream reassembly. Instead of buffering and waiting for TCP packets to become in sequence, our framework process the packets in batch and uses a deterministic finite automaton (DFA) with prefix-/suffix- tree method to detect patterns across out-of-sequence packets that happen to be located in different batches. In conclusion, evaluation shows that our code can reassemble and forward tens of millions of packets per second and conduct a stateful signature-based deep packet inspection at 55 Gbit/s using an NVIDIA K40 GPU.

97 MATHEMATICS AND COMPUTING↗
DOE OSTI2017

Deep Packet/Flow Analysis using GPUs

aDeep packet inspection (DPI) faces severe performance challenges in high-speed networks (40/100 GE) as it requires a large amount of raw computing power and high I/O throughputs. Recently, researchers have tentatively used GPUs to address the above issues and boost the performance of DPI. Typically, DPI applications involve highly complex operations in both per-packet and per-flow data level, often in real-time. The parallel architecture of GPUs fits exceptionally well for per-packet network traffic processing. However, for stateful network protocols such as TCP, their data stream need to be reconstructed in a per-flow level to deliver a consistent content analysis. Since the flow-centric operations are naturally anti-parallel and often require large memory space for buffering out-of-sequence packets, they can be problematic for GPUs, whose memory is normally limited to several gigabytes. In this work, we present a highly efficient GPU-based deep packet/flow analysi s framework. The proposed design includes a purely GPU-implemented flow tracking and TCP stream reassembly. Instead of buffering and waiting for TCP packets to become in sequence, our framework process the packets in batch and uses a deterministic finite automaton (DFA) with prefix-/suffix- tree method to detect patterns across out-of-sequence packets that happen to be located in different batches. Evaluation shows that our code can reassemble and forward tens of millions of packets per second and conduct a stateful signature-based deep packet inspection at 55 Gbit/s using an NVIDIA K40 GPU.

Gong, Qian↗
NASA NTRS1986

US long distance fiber optic networks: Technology, evolution and advanced concepts. Volume 2: Fiber optic technology and long distance networks

The study projects until 2000 the evolution of long distance fiber optic networks in the U.S. Volume 1 is the Executive Summary. Volume 2 focuses on fiber optic components and systems that are directly related to the operation of long-haul networks. Optimistic, pessimistic and most likely scenarios of technology development are presented. The activities of national and regional companies implementing fiber long haul networks are also highlighted, along with an analysis of the market and regulatory forces affecting network evolution. Volume 3 presents advanced fiber optic network concept definitions. Inter-LATA traffic is quantified and forms the basis for the construction of 11-, 15-, 17-, and 23-node networks. Using the technology projections from Volume 2, a financial model identifies cost drivers and determines circuit mile costs between any two LATAs. A comparison of fiber optics with alternative transmission concludes the report.

Source record↗