Search

The depletion of the unallocated address space in combination with the slow pace of IPv6 deployment have given rise to the IPv4 transfer market, namely the trading of allocated IPv4 prefixes between ASes. While RIRs have established detailed policies in an effort to regulate the IPv4 transfer market for malicious networks such as spammers and bulletproof ASes, IPv4 transfers pose an opportunity to bypass reputational penalties of abusive behaviour since they can obtain "clean" address space or offload blacklisted address space. Additionally, IP transfers create a window of uncertainty about legitimate ownership of prefixes, which adversaries to hijack parts of the transferred address space. In this paper, we provide the first detailed study of how transferred IPv4 prefixes are misused in the wild by synthesizing an array of longitudinal IP blacklists and lists of prefix hijacking incidents. Our findings yield evidence that the transferred network blocks are used by malicious networks to address botnets and fraudulent sites in much higher rates compared to non-transferred addresses, while the timing of the attacks indicates efforts to evade filtering mechanisms.

Software Defined Networking (SDN) is revolutionizing the architecture and operation of computer networks and promises a more agile and cost-efficient network management. SDN centralizes the network control logic and separates the control plane from the data plane, thus enabling flexible management of networks. A network based on SDN consists of a data plane and a control plane. To assist management of devices and data flows, a network also has an independent monitoring plane. These coexisting network planes have various types of resources, such as bandwidth utilized to transmit monitoring data, energy spent to power data forwarding devices and computational resources to control a network. Unwise management, even abusive utilization of these resources lead to the degradation of the network performance and increase the Operating Expenditure (Opex) of the network owner. Conserving and protecting limited network resources is thus among the key requirements for efficient networking. However, the heterogeneity of the network hardware and network traffic workloads expands the configuration space of SDN, making it a challenging task to operate a network efficiently. Furthermore, the existing approaches usually lack the capability to automatically adapt network configurations to handle network dynamics and diverse optimization requirements. Addtionally, a centralized SDN controller has to run in a protected environment against certain attacks. This thesis builds upon the centralized management capability of SDN, and uses cross-layer network optimizations to perform joint traffic engineering, e.g., routing, hardware and software configurations. The overall goal is to overcome the management complexities in conserving and protecting resources in multiple functional planes in SDN when facing network heterogeneities and system dynamics. This thesis presents four contributions: (1) resource-efficient network monitoring, (2) resource-efficient data forwarding, (3) using self-adapt

Businesses were moving during the past decades to-ward full digital models, which made companies face new threatsand cyberattacks affecting their services and, consequently, theirprofits. To avoid negative impacts, companies’ investments incybersecurity are increasing considerably. However, Small andMedium-sized Enterprises (SMEs) operate on small budgets,minimal technical expertise, and few personnel to address cy-bersecurity threats. In order to address such challenges, it isessential to promote novel approaches that can intuitively presentcybersecurity-related technical information.This paper introduces SecBot, a cybersecurity-driven conver-sational agent (i.e., chatbot) for the support of cybersecurityplanning and management. SecBot applies concepts of neuralnetworks and Natural Language Processing (NLP), to interactand extract information from a conversation. SecBot can(a)identify cyberattacks based on related symptoms,(b)indicatesolutions and configurations according to business demands,and(c)provide insightful information for the decision on cy-bersecurity investments and risks. A formal description hadbeen developed to describe states, transitions, a language, anda Proof-of-Concept (PoC) implementation. A case study and aperformance evaluation were conducted to provide evidence ofthe proposed solution’s feasibility and accuracy

In the last years, cryptocurrencies have becomeincreasingly popular along with their underlying distributedledger technology, referred to as a Blockchain (BC). Nowadays,a wide variety of BC implementations are available. However,the selection of a suitable implementation for a particularapplication or use case is complex because it requires technicalunderstanding of the underlying BC implementation aspects.Therefore, this paper proposes a Controlled Natural Language(CNL) to extends existing BC selection solutions to abstractunderlying implementation details. The approach allows thespecification abstract high-level policies, referred to as intents, inan English-based language. The approach is inspired by previousapproaches from the network management field. Moreover, astate machine-based refinement technique is proposed to refinethese intents into low-level BC selection policies. The resultsof the performance evaluation of the prototype implementationshow that the refinement process presents a minimal overhead.In addition, the perceived intuitiveness of the CNL by userswas assessed in a survey. The results of the survey suggest thattechnical and non-technical individuals benefit from an intent-based approach equally

Due to the growing interest in the blockchain (BC),several applications are being developed, taking advantage ofthe benefits that such technology promises to deliver, such asremoval of Trust Third Parties (TTP) to verify transactions anddata immutability. However, these applications require certainaspects, such as high transaction throughput or data privacy,that early BC implementations (e.g.,Bitcoin) did not provide.Thus, a myriad of novel BC implementations was developed,which introduced the issue of choosing the right implementationfor a specific use-case. This paper presents a framework, calledPleBeuS, to address this selection issue by allowing users tospecify policies that rule the automatic selection of the BC thatdata will be stored. The selection process relies on a cost-awareapproach and considers both public and private implementationsand their technical characteristics. Moreover,PleBeuScom-municates with a BC-agnostic interoperability API to enforcetransactions. The evaluation of thePleBeuSprototype showedthat it is possible to automatically select a BC-based on userpolicies, considering cost thresholds and technical details (e.g.,BC throughput, deployment), and reduce manual interaction.

Distributed Denial-of-Service (DDoS) attacks are one of the major causes of concerns for communication service providers. When an attack is highly sophisticated and no countermeasures are available directly, sharing hardware and defense capabilities become a compelling alternative. Future network and service management can base its operations on equally distributed systems to neutralize highly distributed DDoS attacks. A cooperative defense allows for the combination of detection and mitigation capabilities, the reduction of overhead at a single point, and the blockage of malicious traffic near its source. Main challenges impairing the widespread deployment of existing cooperative defense are: (a) high complexity of operation and coordination, (b) need for trusted and secure communications, (c) lack of incentives for service providers to cooperate, and (d) determination on how operations of these systems are affected by different legislation, regions, and countries. The cooperative Blockchain Signaling System (BloSS) defines an effective and alternative solution for security management, especially cooperative defenses, by exploiting Blockchains (BC) and Software-Defined Networks (SDN) for sharing attack information, an exchange of incentives, and tracking of reputation in a fully distributed and automated fashion. Therefore, BloSS was prototyped and evaluated through a global experiment, without the burden to maintain, design, and develop special registries and gossip protocols.

This work develops an integration of Blockchains (BC) with the Internet-of-Things (IoT) using a highly constrained TelosB IoT platform based on the MSP430 processor family and CC2420 IEEE 802.15.4-compliant radio interfaces. The system is evaluated in an indoor office environment focusing on overhead and energy efficiency of BC transaction (TX) transmissions.

Long Range (LoRa) defines a popular modulation scheme based on the chirp spread spectrum technique. It is used in Low Power Wide Area Networks (LP-WANs) for the Internet-of-Things (IoT). Thus, this work here designs, specifies, implements, and evaluates a Cloud Radio Access Network (C-RAN) architecture for LoRa networks, while using (a) Software Defined Radios (SDR) to receive/send radio signals and (b) Docker to virtualize the setup. (c) A software modulator is developed to emit signals on the downlink targeting regular LoRa end-device receivers, such as Semtech SX1276 chips. Finally, the network, processing, and cost requirements of the C-RAN implemented are evaluated.

Digitization of electoral processes depends on confident systems that produce verifiable evidence. The design and implementation of voting systems has been widely studied in prior research, bringing together expertise in many fields. Switzerland is organized in a federal, decentralized structure of independent governmental entities. Thus, its decentralized structure is a real-world example for implementing an electronic voting system, where trust is distributed among multiple authorities. This work outlines the design and implementation of a blockchain-based electronic voting system providing cast-as-intended verifiability. The generation of non-interactive zero-knowledge proofs of knowledge enables every voter to verify the encrypted vote, while maintaining the secrecy of the ballot. The Public Bulletin Board (PBB) is a crucial component of every electronic voting system, serving as a publicly verifiable log of communication and ballots - here a blockchain is used as the PBB. Also, the required cryptographic operations are in linear relation to the number of voters, making the outlined system fit for large-scale elections.

Blockchains (BCs) are back-linked chain of records termed as blocks. To establish decentralized trusted systems, BCs employ consensus mechanisms. During the past ten years, there have been various proposals of BC design and implementations. However, most of the developed sate of the art BCs suffer from scalability issues. In order to enhance the scalability of the BCs, this paper proposes a transaction aggregation mechanism on a Proof-of-Stake (PoS)-based BC. Having developed the transaction aggregation and double linked blocks, efficient prevention and control of the BC's size growth is observed in the evaluated scenarios.