3 research outputs found
Network attacks detection based on traffic flows analysis using hybrid machine learning algorithms
Razvoj savremenih mrežnih okruženja se zasniva na primeni različitih tehnologija,
povezivanju sa drugim tehnološki drugačijim konceptima i obezbeđivanju njihove interoperabilnosti.
Tako složeno mrežno okruženje je neprekidno izloženo različitim izazovima, pri čemu je
obezbeđivanje sigurnosti servisa i podataka jedan od najvažnijih zadataka. Novi zahtevi za sisteme
zaštite se zasnivaju na potrebi za efikasnim praćenjem i razumevanju karakteristika mrežnog
saobraćaja, a uslovljeni su stalnim porastom broja korisnika i razvojem novih aplikacija.
Razvoj rešenja u oblasti detekcije anomalija i napada je postao svojevrsni imperativ, imajući
u vidu da se paralelno odvija intenzivni razvoj u oblasti sajber napada. Osim toga, promene mrežnog
saobraćaja su postale sve dinamičnije, a kao poseban problem se izdvaja velika heterogenost
primenjenih tehnologija i korisničkih uređaja. Iako dostupna literatura prepoznaje veliki broj radova
koji se bave analizom tokova mrežnog saobraćaja za potrebe praćenja performansi i sigurnosnih
aspekata mreža, mali je broj istraživanja koja se zasnivaju na procedurama generisanja i analize
profila ponašanja mrežnog saobraćaja, odnosno specifičnih komunikacionih obrazaca. U tom smislu,
analiza ponašanja mreže se u sve većoj meri oslanja na razumevanje normalnih ili prihvatljivih
obrazaca ponašanja na osnovu kojih je moguće efikasno otkrivanje obrazaca anomalija. Za razliku od
sistema za otkrivanje napada koji se zasnivaju na analizi sadržaja svakog pojedinačnog paketa
(signature-based), ovaj pristup je izuzetno koristan za identifikaciju nepoznatih pretnji, napada nultog
dana, sumnjivog ponašanja i za sveopšte poboljšavanje performansi mrežnih okruženja...The development of the modern network environments, their application, and the dynamics of
their interoperability with other technologically different concepts, is based on the application and
compatibility of different heterogeneous technologies. Such a complex network environment is
constantly exposed to various operational challenges, where ensuring the security and safety of
services and data represents one of the most important tasks. The constant increase in the number of
users and the intensive development of new applications that require high bandwidth has defined new
requirements for security systems, which are based on monitoring and effectively understanding
network traffic characteristics. In the light of the increasingly intensive development in the field of
cyberattacks, persistent dynamic changes in network traffic, as well as the increased heterogeneity of
the used technologies and devices, the development of solutions in the field of anomaly and attack
detection has become a kind of imperative. Although the available literature recognizes a large
number of papers dealing with the analysis of network traffic flows for the needs of the monitoring
of the performance and security aspects of networks, just a few studies are based on the procedures
for generating network traffic behavior profiles, or specific communication patterns. In this sense,
network behavior analysis relies on an understanding of normal or acceptable behavior patterns,
which would allow for the effective detection of unusual, anomalous behavior patterns. Unlike the
intrusion detection systems that are based on the packet payload or signature (signature-based), this
approach is extremely useful not only for the identification of unknown threats, zero-day attacks, and
suspicious behavior, but also for the improvement of the overall network performance..
Influence of different factors on the RAID 0 paired magnetic disk arrays
The rapid technological progress has led to a growing need for more data storage space. The appearance of big data requires larger storage space, faster access and exchange of data as well as data security. RAID (Redundant Array of Independent Disks) technology is one of the most cost-effective ways to satisfy needs for larger storage space, data access and protection. However, the connection of multiple secondary memory devices in RAID 0 aims to improve the secondary memory system in a way to provide greater storage capacity, increase both read data speed and write data speed but it is not fault-tolerant or error-free. This paper provides an analysis of the system for storing the data on the paired arrays of magnetic disks in a RAID 0 formation, with different number of queue entries for overlapped I/O, where queue depth parameter has the value of 1 and 4. The paper presents a range of test results and analysis for RAID 0 series for defined workload characteristics. The tests were carried on in Microsoft Windows Server 2008 R2 Standard operating system, using 2, 3, 4 and 6 paired magnetic disks and controlled by Dell PERC 6/i hardware RAID controller. For the needs of obtaining the measurement results, ATTO Disk Benchmark has been used. The obtained results have been analyzed and compared to the expected behavior
Network attacks detection based on traffic flows analysis using hybrid machine learning algorithms
Razvoj savremenih mrežnih okruženja se zasniva na primeni različitih tehnologija,
povezivanju sa drugim tehnološki drugačijim konceptima i obezbeđivanju njihove interoperabilnosti.
Tako složeno mrežno okruženje je neprekidno izloženo različitim izazovima, pri čemu je
obezbeđivanje sigurnosti servisa i podataka jedan od najvažnijih zadataka. Novi zahtevi za sisteme
zaštite se zasnivaju na potrebi za efikasnim praćenjem i razumevanju karakteristika mrežnog
saobraćaja, a uslovljeni su stalnim porastom broja korisnika i razvojem novih aplikacija.
Razvoj rešenja u oblasti detekcije anomalija i napada je postao svojevrsni imperativ, imajući
u vidu da se paralelno odvija intenzivni razvoj u oblasti sajber napada. Osim toga, promene mrežnog
saobraćaja su postale sve dinamičnije, a kao poseban problem se izdvaja velika heterogenost
primenjenih tehnologija i korisničkih uređaja. Iako dostupna literatura prepoznaje veliki broj radova
koji se bave analizom tokova mrežnog saobraćaja za potrebe praćenja performansi i sigurnosnih
aspekata mreža, mali je broj istraživanja koja se zasnivaju na procedurama generisanja i analize
profila ponašanja mrežnog saobraćaja, odnosno specifičnih komunikacionih obrazaca. U tom smislu,
analiza ponašanja mreže se u sve većoj meri oslanja na razumevanje normalnih ili prihvatljivih
obrazaca ponašanja na osnovu kojih je moguće efikasno otkrivanje obrazaca anomalija. Za razliku od
sistema za otkrivanje napada koji se zasnivaju na analizi sadržaja svakog pojedinačnog paketa
(signature-based), ovaj pristup je izuzetno koristan za identifikaciju nepoznatih pretnji, napada nultog
dana, sumnjivog ponašanja i za sveopšte poboljšavanje performansi mrežnih okruženja...The development of the modern network environments, their application, and the dynamics of
their interoperability with other technologically different concepts, is based on the application and
compatibility of different heterogeneous technologies. Such a complex network environment is
constantly exposed to various operational challenges, where ensuring the security and safety of
services and data represents one of the most important tasks. The constant increase in the number of
users and the intensive development of new applications that require high bandwidth has defined new
requirements for security systems, which are based on monitoring and effectively understanding
network traffic characteristics. In the light of the increasingly intensive development in the field of
cyberattacks, persistent dynamic changes in network traffic, as well as the increased heterogeneity of
the used technologies and devices, the development of solutions in the field of anomaly and attack
detection has become a kind of imperative. Although the available literature recognizes a large
number of papers dealing with the analysis of network traffic flows for the needs of the monitoring
of the performance and security aspects of networks, just a few studies are based on the procedures
for generating network traffic behavior profiles, or specific communication patterns. In this sense,
network behavior analysis relies on an understanding of normal or acceptable behavior patterns,
which would allow for the effective detection of unusual, anomalous behavior patterns. Unlike the
intrusion detection systems that are based on the packet payload or signature (signature-based), this
approach is extremely useful not only for the identification of unknown threats, zero-day attacks, and
suspicious behavior, but also for the improvement of the overall network performance..