To prevent automation system database of the distribution network from falsifying and decrease the quantity of the error message records for understanding and evaluating the behaviors of the ...distribution automation system objectively, a big-data analysis application deployed on Spark for distribution network based on data interception is designed. Firstly, Libpcap is used to intercept data from the switch of the information collecting end for capturing the messages from the original for avoiding multi-stage message transmission. Secondly, an improved Apriori algorithm is designed and deployed as an application running on Spark platform for mining strong association and correlation rules from the massive data for objective analyzing. In the end, a pilot project of the distribution system of Tianjin Electric Power Company is taken to demonstrate the effectiveness and value of the implementation of the application for the power distribution engineering.
Chaperonage network technique of continuously development, make ether net safety problem research more and more importance, involve a network safety the realm have many safety technique, like fire ...wall, invade examination, safety scan, agreement analysis etc., but these technique of realization all demand depend on a network data pack to succeed in catching. This text to under the system of the data pack succeed in catching a technique to carry on a research, and put forward a few data pack of succeeds in catching a method.
this paper analyzes and studies nature of BPF filter based on Libpcap, first of all, it analyzes location and structure of BPF filter in the Linux system kernel; secondly, it gives a detailed ...analysis of how BPF deals with filter described by a high-level language; finally, a filter described by a high-level language is presented, and a application program uses this filter to capture required network data packet.
This paper comprehensively explores network traffic analysis using various technologies, focusing on dynamic analysis for malware study with Sandnet as an analysis environment. It investigates DNS ...and HTTP usage by malware, considers ethics and risk mitigation, and delves into machine learning-based IoT device identification. The study introduces a multi-stage meta classifier methodology to enhance IoT device classification, discusses network traffic predictability, and highlights intrusion detection using packet sniffers for security. By addressing these topics, the paper significantly contributes to network traffic analysis understanding, its application, and implications for network security and control.
The Comparison and Verification of Some Efficient Packet Capture and Processing Technologies Li, Jiaqian; Wu, Chengrong; Ye, Jiawei ...
2019 IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech)
Conference Proceeding
Packet capture technology is the basis for network data analysis and processing. The rapid development of network applications, the speed of network transmission, and the speedy increase in the ...number of network users put forward higher requirements for packet capture technology. Some high-performance network packet capture technologies come into being. This paper first analyzes the inherent defects of the traditional Linux data capture method, and then introduces and analyzes the advantages and disadvantages of the current high-performance packet capture technologies and framework from the technical principle, application flow, packet capture rate and resource occupancy.
In terms of the theories and techniques of network security, packet capture and protocol analysis are a branch of network security protocols, which depend on widely used insecure protocols at the ...present day. The paper mainly discusses the capture and analysis of network packets, and subsequently designs a capture program for network packets. Meanwhile, the working principle and the internal structure of function libraries captured by BPF based-on packets, namely Libpcap and Winpcap was analyzed carefully after the detailed analysis of some elementary implement principles, methods and approaches in the current capture and analysis system of network packets. By describing the hiberarchy of the capture and analysis system of network packets, a specific design and implement methods of the packet capturing and analyzing system by Winpcap were proposed1. In the end, the paper states and predicts the directions for implement methods of network data monitoring and analyzing.
The primary goal of Network Function Virtualization (NFV) is the migration of physical network functions to software versions running on virtual machines (VM) in cloud computing environments. Rapid ...developments in virtualization technologies have made high-speed network connections and line rate packet processing viable in virtualized infrastructure environments. Deep Packet Inspection (DPI) of network traffic in the form of a computational intensive virtualized network function (VNF) was selected as a representative use-case. The DPI use case was used, to demonstrate the benefits of using SR-IOV enabled devices with DPDK to support performant Virtual Network Function (VNF) deployments. Performance evaluation of VNF versions using LibPCAP, SR-IOV and DPDK have been carried out. The results demonstrate that significantly higher packet throughput performance can be achieved when using SR-IOV and DPDK in unison in comparison to packet processing with the native Linux kernel network stack.
Computer software that can intercept and log traffic passing over a digital network or part of a network is better known as packet sniffer. The sniffer captures these packets by setting the NIC card ...in the promiscuous mode and eventually decodes them. The decoded information can be used in any way depending upon the intention of the person concerned who decodes the data (i.e. malicious or beneficial purpose). Depending on the network structure one can sniff all or just parts of the traffic from a single machine within the network. However, there are some methods to avoid traffic narrowing by switches to gain access to traffic from other systems on the network. This paper focuses on the basics of packet sniffer and its working, development of the tool on Linux platform and its use for Intrusion Detection. It also discusses ways to detect the presence of such software on the network and to handle them in an efficient way. Focus has also been laid to analyze the bottleneck scenario arising in the network, using this self developed packet sniffer. Before the development of this indigenous software, minute observation has been made on the working behavior of already existing sniffer software such as wireshark (formerly known as ethereal), tcpdump, and snort, which serve as the base for the development of our sniffer software. For the capture of the packets, a library known as libpcap has been used. The development of such software gives a chance to the developer to incorporate the additional features that are not in the existing one.
The monitoring of parallel and distributed applications is a common approach for gathering information concerning program execution, for behavioral analysis of the application or of the supporting ...platform. The collected information can be used for the detection of errors, for performance evaluation and in its improvement. Several monitoring techniques have been explored by many different tools, depending on their goals and platforms used. In particular, the analysis made at the network level, also allows the study of the network and application protocols used by supporting middlewares and frameworks. In this paper, we report an experimental distributed monitoring tool that takes advantage of network traffic capture offered by the OS, in particular, using libPcap. Our objective was, first, to verify the possibility of capturing the traffic relating to a particular process and, based on this information, identify the other application processes and trigger the remote monitoring for those processes. This tool allows the transparent capture of the distributed application's interactions between its several processes. It is enough for the user to identify a single process and the remaining processes are discovered and monitored from the information gathered. More deep analysis can then be carried by any other tool supporting the pcap/tcpdump format, as for example, Wireshark.
Classification of network traffic in LAN Langthasa, Biswajit; Acharya, Bikash; Sarmah, Satyajit
2015 International Conference on Electronic Design, Computer Networks & Automated Verification (EDCAV),
01/2015
Conference Proceeding
Classification of Network Traffic is one of most important issue in network management and detection of Intrusion attacks play a vital role in it. To have a holistic picture of the network intrusion ...detection, selection of appropriate feature is very important; it reduces analysis effort and time too. Data mining can be very fruitful for feature selection and intrusion detection. In this paper, Tcpdump is used to capture network traffic and visualize different set of features using k-mean clustering. KDD'99 corrected intrusion detection dataset is evaluated to find out most important and relevant features and an algorithm based on the features is proposed to detect different types of dos, probing, u2r and r2l attacks with an accuracy of more than 80%.
PDF
