Search

Objective. The article explores a way to improve the security of a corporate network by using the technique of spoofing sender addresses when forwarding packets between computers. Method. Network traffic analysis methods, network protocol level programming and data packet processing algorithms are used. Computers on the network are connected to one server. When sending packets between computers in the network, the sender's address is replaced, and when a packet is received by another computer, the packet is disassembled, and the real sender's address is inside it. Result. The method allows for effective protection of a corporate network from attacks associated with the forgery of addresses of data packet senders. Conclusion. Using the sender address substitution technique when transmitting data in a corporate network is an effective way to increase security and protection from external threats. Further research is aimed at developing complex and reliable methods for protecting networks.

Di era serba digital saat ini, data menjadi sebuah aset yang sangat berharga. Berbagai macam teknik digunakan untuk mencuri data pribadi yang berpotensi disalahgunakan oleh pihak yang tidak bertanggung jawab. Objek yang digunakan pada penelitian ini adalah AQUVAPRN.exe yang memiliki jenis malware RAT (Remote Access Trojan) yang saat malware ini berjalan pembuat malware tersebut dapat mengambil data pribadi pengguna yang sistem operasinya terinfeksi. Cara kerja dari malware AQUVAPRN.exe dengan berjalan pada latar belakang saat aplikasi dijalankan atau dieksekusi lalu membuat beberapa proses seperti mengubah file registry, membuat file, membaca file, dan melakukan koneksi internet dengan IP Address tertentu secara terus menerus tanpa diketahui oleh pengguna dari komputer itu sendiri. Hasil yang diperoleh terhadap malware AQUVAPRN.exe berupa alamat IP Address 109.51.76.80, memiliki domain Kota Lisbon Negara Portugal, memiliki nilai hash MD5 55c2c12970cda52f58bfad7b8c7d37d5. Diketahui pula, malware AQUVAPRN.exe menggunakan teknik anti reverse engineering tepatnya obfuscation yang menghambat atau menghalangi malware untuk dibedah atau di reverse engineering agar mengetahui code penyusun dari malware. Didapatkan pula PID dari proses AQUVAPRN.exe adalah 8332 dengan alat virtual (Virtual Address) 0x8e0f57042080.

The proliferation of reviews evaluating different services on social networks and online platforms and their importance in consumer decision‐making has led some unscrupulous individuals to take advantage of the anonymity offered by the Internet to manipulate these reviews and influence customers' decisions. The main objectives of this study are: (1) to test whether spammers usually perform their misdemeanors from the same IP address; (2) to explore whether there are differences between stated sexes in this regard; (3) to detect the main motivations for posting fraudulent reviews; and (4) to determine the motivations for doing so from the same IP address. These objectives were achieved by means of a quasi‐experiment with a sample of 7,192,487 users, and a qualitative investigation in which 37 users who had falsified information were interviewed. The results show that spammers who tend to fake their identity do so from the same IP address and that they tend to be male. Four types of motivation are presented: revenge, entertainment, opportunity for profit, and self‐esteem; as well as a further three to explain the use of the same IP: convenience, limited resources, and complacency. [ABSTRACT FROM AUTHOR]

Cloud computing is a new technology that provides services to customers anywhere, anytime, under varying conditions and managed by a third-party cloud provider. Even though cloud computing has progressed a lot, some attacks still happen. The recent anomalous and signature attacks use clever strategies such as low-rate attacks and attacking as an authenticated user. In this paper, a novel Attack Detection and Prevention (ADAPT) method is proposed to overcome this issue. The proposed system consists of three stages. An Intrusion Detection System is initially used to check whether there is an attack or not by comparing the IP address in the Blacklist IP Database. If an attack occurs, the IP address will be added to the Blacklist IP database and blocked. The second stage uses Bi-directional LSTM and Bi-directional GRU to check the anomalous and signature attack. In the third stage, classified output is sent to reinforcement learning, if any attack occurs the IP address is added to the blacklist IP database otherwise the packets are forwarded to the user. The proposed ADAPT technique achieves a higher accuracy range than existing techniques. [ABSTRACT FROM AUTHOR]

Security identification solutions against WLAN network attacks according to straightforward digital detectors, such as SSID, IP addresses, and MAC addresses, are not efficient in identifying such hacking or router impersonation. These detectors can be simply mocked. Therefore, a further protected key uses new information by combining these simple digital identifiers with an RF signature of the radio link. In this work, a design of a convolutional neural network (CNN) based on fingerprinting radio frequency (RF) is developed with computer-generated data. The developed CNN is trained with beacon frames of a wireless local area network (WLAN) that is simulated as a result of identified and unidentified router nodes of fingerprinting RF. The proposed CNN is able to detect router impersonators by comparing the data pair of the MAC address and RF signature of the received signal from the known and unknown routers. ADAM optimizer, which is the extended version of stochastic gradient descent, has been used with a developed deep learning convolutional neural network containing three fully connected and two convolutional layers. According to the training progress graphic, the network converges to around 100% accuracy within the first epoch, which indicates that the developed architecture was efficient in detecting router impersonations. [ABSTRACT FROM AUTHOR]

The REC CONNECT Android app simplifies file sharing among devices by allowing users to exchange files via QR codes or IP addresses. The application was created in Android Studio, which is integrated with Firebase database for performing optimal storage and transfers. Its easy-to-use interface allows users to generate QR codes or enter recipient IP addresses. This adaptability accommodates to a wide range of user preferences and configurations. Receivers initiate quick file transfers by scanning the sender's QR code or utilizing IP addresses, ensuring cross-platform interoperability. The app's functionality is supported by Firebase integration to ensure secure file storage and transfer. The real-time database handles metadata, while Firebase storage safeguards the actual file data. REC CONNECT holds the potential for expansion, with prospects like robust file management, varied format compatibility, and cloud integration. The app's reliability and privacy-concerned design address the data security concerns. The developed REC CONNECT application reshapes file sharing and increases the efficiency, and security. [ABSTRACT FROM AUTHOR]

The Chongqing early warning project includes hundreds of early warning monitoring stations. The observation data will be more and more abundant, the calculation and determination of the epicenter and magnitude will be more accurate, and the early warning effect will be significantly improved. Hundreds of stations transmitting data in the early warning system will greatly consume the data transmission capacity of the core router. In order to improve the efficiency of network equipment routing protocol algorithm and network data transmission performance, scientific and reasonable IP address planning is a very important technical link. In this paper, some basic principles and methods of IP address planning of Chongqing earthquake early warning project are described in detail. It has achieved good results in practice, and can provide some reference for the design and planning of other network projects.

Knowledge of the previous location of an Internet device is valuable information in forensics. The previous device location can be obtained via the IP address that the device used to access Internet services, such as email, banking, and online shopping. However, the problem with the device location using its IP address is the unknown evidential value, which is used to admit the evidence in the case. This work introduces a method to process free and constantly updated data to assess the evidential value of the IP country location. The evidential value is assessed for several countries by analyzing historical data over 8 years. Tampering with the location evidence is discussed, as well as its detection. The source code to replicate the results and to apply the updated data to future evidence is available.

Cybercriminals use a variation of techniques to fleece their digital footprints, that creates a barrier for law enforcement agencies to impossibly catch and prosecute them. With the known universal truth that whenever a machine tries to connect in adversely to target system. The victim's machine can see only requests coming from the "proxy" or the VPN server. Now as VPN hides IP addresses it leads the network to be redirected through some special configured remote server which are run by a VPN host. As its consequences, the user's digital footprint is hidden. the footprint of a VPN server is received by the receiver. This challenges the entire organization or one's personal system to be in risk. One such solution to the problem is to design "Honeypot system" that will trace an IP address running behind VPN/proxy servers. The machine learning algorithm will able to trace the actual IP address with ISP details. The paper discusses a detection mechanism that will dupe the attackers. Showing inability in locating and identifying real honeypot file. The methods were tested on various platforms and technique outperform in detecting attacker's system smartly using machine learning. [ABSTRACT FROM AUTHOR]

Security identification solutions against WLAN network attacks according to straightforward digital detectors, such as SSID, IP addresses, and MAC addresses, are not efficient in identifying such hacking or router impersonation. These detectors can be simply mocked. Therefore, a further protected key uses new information by combining these simple digital identifiers with an RF signature of the radio link. In this work, a design of a convolutional neural network (CNN) based on fingerprinting radio frequency (RF) is developed with computer-generated data. The developed CNN is trained with beacon frames of a wireless local area network (WLAN) that is simulated as a result of identified and unidentified router nodes of fingerprinting RF. The proposed CNN is able to detect router impersonators by comparing the data pair of the MAC address and RF signature of the received signal from the known and unknown routers. ADAM optimizer, which is the extended version of stochastic gradient descent, has been used with a developed deep learning convolutional neural network containing three fully connected and two convolutional layers. According to the training progress graphic, the network converges to around 100% accuracy within the first epoch, which indicates that the developed architecture was efficient in detecting router impersonations.

Network-based monitoring and intrusion detection systems generate a high number of alerts reporting the suspicious activity of IP addresses. The majority of alerts are dropped due to their low relevance, low priority, or due to high number of alerts themselves. We assume that these alerts still contain valuable information, namely, about the coordination of IP addresses. Knowledge of the coordinated IP addresses improves situational awareness and reflects the requirement of security analysts as well as automated reasoning tools to have as much contextual information as possible to make an informed decision. To validate our assumption, we introduce a novel method to discover the groups of coordinated IP addresses that exhibit a temporal correlation of their alerts. We evaluate our method on data from a real sharing platform reporting approximately 1.5 million alerts per day. The results show that our method can indeed discover groups of truly coordinated IP addresses.

Research has been carried out on a mobile-based presence system authentication method using MAC addresses, BSSID and IP addresses for (Wi-Fi) networks. This study aims to develop an authentication method on the attendance system that meets two authentication requirements, namely the suitability of employee identity and location suitability, so that the attendance process becomes easy, effective, fast, and can reduce fraud. The employee's identity can be obtained from the MAC address of the smartphone that has been previously registered, while the employee's location during the attendance process can be confirmed to be in the company environment by checking the BSSID data and IP of the Wi-Fi network connected to the smartphone. The data is then compared with MAC address data from all Wi-Fi networks installed in the company area. RAD is used as a development model because it is simple and fast. Overall, employee identification and site checking as authentication of the developed system went well. Other than that, every function on the system works well. Furthermore, the results of the user experience evaluation using the UEQ questionnaire received an average score above 0.8 on 6 scales. This shows that the system has attractiveness, perspicuity, efficiency, dependability, stimulation and novelty.

Latency is one of the key parameters of Internet services. However, it is difficult to correctly assess a service by its latency. Many latency measurements are blocked en route by routers and firewalls. For this reason, the service latency is not fully known. This work proposes a method to assess Internet services including the blocked latency measurements. Survival theory is applied to process latency values. The results show that the omission of blocked latencies from statistical processing severely underestimates the service latency. Two Internet service providers were compared as an example. Their latency difference was 9 ms using the traditional approach. The survival latency resulted in a difference of 17 ms. The method of survival latency can be used to increase revenues in e-commerce and to improve the experience of online gaming.

IP addresses of end hosts change when they are re-assigned. We apply survival analysis, which is commonly used in healthcare, on IP addresses to predict their assignment duration (their lifetime). We propose a survival parametric model based on a history of 6 years of address assignments on a worldwide scale. Our model outperforms alternative models both from short-term and long-term views. The custom modelling is also discussed as address assignment varies across Internet service providers (ISPs) and autonomous systems (ASs). A predictable address assignment duration has many applications, including source reputation, topology mapping, and geolocation. We describe a use-case in fraud prevention, where the proposed model is used as a trigger for two-factor authentication. The created dataset of addresses assignment durations is made publicly available.

Regional discrimination is a significant social issue that leads to divided societies. In China, people from Henan Province, who are verbally abused by non-Henan users on the Internet, are often victims of regional discrimination. This article presents a case study of Chinese Internet users' discriminatory practice against Henan people in the commentary sections of two major Chinese news portals – Tencent and NetEase. By advancing an affective critical discourse analysis approach with the assistance of content analysis, I analysed user comments on news reports that covered a news event relating to regional discrimination against Henan people. The analysis showed that Internet users' discriminatory practice was notably amplified by the locative IP-address function in NetEase's commentary section. The research findings shed light on the interplay between Internet users' discursive practice and the technological architecture of interactive digital platforms in the context of regional discrimination. [ABSTRACT FROM AUTHOR]

COVID-19 has disrupted every field of life and education is not immune to it. Student learning and examinations moved on-line on a few weeks notice, which has created a large workload for academics to grade the assessments and manually detect students’ dishonesty. In this paper, we propose a method to automatically indicate cheating in unproctored on-line exams, when somebody else other than the legitimate student takes the exam. The method is based on the analysis of the student’s on-line traces, which are logged by distance education systems. We work with customized IP geolocation and other data to derive the student’s cheating risk score. We apply the method to approx. 3600 students in 22 courses, where the partial or final on-line exams were unproctored. The found cheating risk scores are presented along with examples of indicated cheatings. The method can be used to select students for knowledge re-validation, or to compare student cheating across courses, age groups, countries, and universities. We compared student cheating risk scores between four academic terms, including two terms of university closure due to COVID-19.

Internet users may be asked to manually provide their contact details, including city or full postal address. Examples include use of trial/free applications and services, filling out on-line surveys and petitions, and membership registration to loyalty programs. Many users may provide their correct location, whereas others may submit inaccurate data. The provided locations are used for geo-analytical purposes, including the interpretation of survey results, online content personalization, and targeted marketing. In this paper, we analyze differences in user behavior when they provide their location. We work with two data sets of user-submitted locations. These data sets differ in how the locations were submitted: voluntary by purpose-aware users without being asked to or by requesting it from common Internet users. The locations from the purpose-aware users were about 2.5× more accurate than from the other users. We also present data for selected countries. The best result was found for the users in the USA with a median error of 44 km (the difference between the correct and user-submitted location). The results also show different user behavior that depends on the place from which they provide their location. The locations submitted from home were 1.5× more accurate than from the office.

Firstly, the IP address of the Web log were visualized, and an integral system was presented by using proper visualization methods. Secondly, the whole system was related to the IP address, containing source IP address, target IP address and their relationship respectively. It provided users with different views of data, which could show more details and undetected relations among massive data. Besides, some interactions were added into the system, which made it more effective and useful. Finally, it ended up with the comparison of the systems when loading data with the DDoS attack and without it. It made much sense in the application field.

This paper introduces a new spatial data resource for Internet geography. The idea is based on merging two up-to-now unrelated fields-the real estate market and Internet networking. The huge real estate market is present almost everywhere, and therefore, it is a valuable resource for trusted spatial data when connected to cyber space. We describe a method that gains spatial data from the real estate market and links this data to cyber space. We support the method by a real implementation. Based on the collected data, we identified the geographical scope of a set of Web servers. The new data in cyber geography may help in the Internet Web-related market competition.

In this paper, the neural network (NN) is used to control the remote IP address that related to user device. When the IP address assigned carefully and controlled by a novel tool, the work performance and service quality will be better. The input for the NN determined depending on the repeated problem in recent networks and the available parameters which are in the main server node. The training process done by determining the required training function and activation function for all neurons in the NN. The performance of the proposed method was (1*10-20) or less in more cases and the error of the learning process is nearly (1*10-6). In addition to IP address control, the proposed method is a good manner to optimize the security issue by specializing an IP address for a given user that can't be used by other device. Finally, the NN subject the produced IP address for the given users for test and validation which reached to the goal at smallest time (~0.0001s) and little number of iteration (9 - 20) epoch.