Ferréol Soulez
email: ferreol.soulez@epfl.ch

Michael Unser

Superresolution with Optically-Motivated Blind Deconvolution

We show in this paper that an optically motivated parameterization of the PSF prevents classical degeneracies of the blind deconvolution in widefield fluorescence microscopy and provides a resolution close to SIM.

Introduction

Widefield fluorescence microscopy is the simplest setup in biological imaging. It consists of imaging fluorescent cellular structures under uniform illumination. Moving the focal plane through the sample gives a 3D representation of the object. Unfortunately, this representation suffers from coarse resolution, especially along the optical axis. Image formation is modeled by a 3D convolution of the N-pixel object f f f 2 R N by the point-spread function (PSF) h h h 2 R N to yield the direct model of the data g g g 2 R N :

g g g = H f f f + n n n , (1)
where n n n 2 R N accounts for some additive noise and H is a 3D convolution matrix derived from the PSF h 2 L 2 (R 3 )

The resolution of the setup is given by the bandwidth of the 3D PSF. To improve the resolution, one can recover the object f f f from the blurred data g g g using a deconvolution algorithm (see [START_REF] Sarder | Deconvolution methods for 3-d fluorescence microscopy images[END_REF] and references therein). It is important to notice that the PSF h h h must be provided to these deconvolution algorithms. Unfortunately, the PSF is rarely known and most methods rely on theoretical diffraction-limited PSF or experimental PSF measured using calibration beads. By simultaneously estimating the PSF and the object from the data only, blind deconvolution algorithms bypass the problem of PSF calibration. Few blind deconvolution algorithms have been proposed for fluorescence microscopy [START_REF] Markham | Parametric blind deconvolution: a robust method for the simultaneous estimation of image and blur[END_REF][START_REF] Hom | Aida: an adaptive image deconvolution algorithm with application to multi-frame and three-dimensional data[END_REF][START_REF] Mugnier | Mistral: a myopic edge-preserving image restoration method, with application to astronomical adaptive-optics-corrected long-exposure images[END_REF][START_REF] Kenig | Blind image deconvolution using machine learning for three-dimensional microscopy[END_REF][START_REF] Soulez | Blind deconvolution of 3d data in wide field fluorescence microscopy[END_REF][START_REF] Keuper | Blind deconvolution of widefield fluorescence microscopic data by regularization of the optical transfer function (otf)[END_REF] because blind deconvolution is a very challenging problem as it is strongly ill-posed and non linear. We present here a PSF model that prevents the classical degeneracies of blind deconvolution ending in a well-posed but still non linear inverse problem. Our model is derived from Fourier optics theory, where the PSF is modeled as the power spectrum of a complex pupil function. Used in a blind deconvolution algorithm [START_REF] Soulez | Blind deconvolution of 3d data in wide field fluorescence microscopy[END_REF], this model provides, on real data, a resolution close to that of structured-illumination microscopy (SIM).

The PSF model

In optical setups, the 2D image in the detector plane of a monochromatic sub-resolved spot in the focal plane (i.e., the PSF h(x, y, 0)) is fully described by the complex amplitude of the light in the exit pupil plane, namely, the pupil function p(w x , w y ). The defocalization of this spot by z only amounts to adding to the phase of the pupil the defocus term

zd(w x , w y ) = z p (n i /l ) 2 (w x k x ) 2 (w y k y ) 2
, where n i is the refractive index of the immersion medium and l is the wavelength. The term k k k = {k x , k y } accounts for misalignment of the optical axis and the center of the pupil. The 3D PSF is built stacking such 2D PSFs and by varying the amount of defocus. Under a Fresnel approximation, the 2D PSFs are linked to the pupil function by a Fourier transform, as

h(x, y, z) = ZZ p(w x , w y ) exp (2ip zd(w x , w y )) exp (2i p (w x x + w y y)) dw x dw y 2 .
(

) degeneracies effect of PSF parameterization swap f ⇤ h = h ⇤ f object cannot be described as a power-spectrum scale (a f ) ⇤ 1 a h = f ⇤ h, PSF is normalized kh h hk 1 = 1 no blur d ⇤ g = g PSF is bandlimited h 6 = d shift f ⇤ h = (d s ⇤ f ) ⇤ (d s ⇤ h) PSF is centered if a 1 = a 2 = 0 reducibility (g ⇤ f ) ⇤ h = f ⇤ (⇤h) 2
PSF described as the power spectrum of a pupil function is irreducible [START_REF] Fannjiang | Absolute uniqueness of phase retrieval with random illumination[END_REF]

inversion f ⇤ h = (s ⇤ f ) ⇤ s 1 ⇤ h PSF is irreducible Table 1.

Effect of the PSF parameterization on blind deconvolution degeneracies

The pupil is non-zero on the disk defined by q w 2 x + w 2 y  NA/l . Thus, Zernike polynomials Z n provide a suitable basis to express both the modulus r(w x , w y ) and the phase f (w x , w y ) of the pupil function p as p(w x , w y ) = r(w x , w y ) exp(ıf (w x , w y )) ,

(3)

r(w x , w y ) = Â n b n Z n (w x , w y ) , (4)
f (w x , w y ) = Â n a n Z n (w x , w y ) .

(5)

As the phase piston has no effect on the resulting PSF, we set a 0 = 0. Similarly, we cancel the tip-tilt parameters (a 1 = a 2 = 0) to keep the PSF laterally centered. As the PSF is non-negative, PSF normalization (i.e., energy conservation) can be expressed as the `1 norm constraint kh h hk 1 = 1. This constraint can can be written as an `2 constraint on the modulus expressed in the Zernike orthonormal basis: kb b b k 2 = 1.

Blind Deconvolution Algorithm

To solve the blind deconvolution, we have to find the optimal parameters

{ f f f + , a a a + , b b b + , k k k + } that minimize the cost function J ( f f f , h(a a a, b b b , k k k)) = L ( f f f , h(a a a, b b b , k k k)) + R( f f f ) with f f f 0.
This function is a sum of the data term L ( f f f , h(a a a, b b b , k k k)) and the regularization functional R( f f f ). As described in [START_REF] Soulez | Blind deconvolution of 3d data in wide field fluorescence microscopy[END_REF], the data term is given by the negloglikelihood of a Gaussian non-stationary noise. The regularization is the classical 3D total variation.

Due to the non linearity of this cost function and because these parameters have different physical meanings, the simultaneous estimation of both the object x x x and the PSF h(a a a, b b b , k k k) is known to be very badly conditioned. It thus relies on an alternating-minimization scheme [START_REF] You | A regularization approach to joint blur identification and image restoration[END_REF]. Each outer iteration of this alternating minimization consists of estimating the object while keeping the PSF fixed and then using this estimated object to estimate successively PSF parameters: defocus k k k; phase a a a; and modulus b b b .

Blind Deconvolution Degeneracies

The blind deconvolution problem is ill-posed, with twice as many unknowns as measurements. Most notably, there exist infinitely many couples { f , h} such that f ⇤ h = g. We believe that our optically motivated model prevents all these degeneracies as described in Table 1.

Results

We illustrate the effectiveness of our blind deconvolution method by processing experimental data shared by Cazares et al. on the cell image library 1 . It is a micrograph of microtubules in a Drosophila S2 cell labeled by Alexa Fluor 488 and observed with a Zeiss Elyra SIM with a NA = 1.4 objective. It is composed of a 3D widefield image and a superresolution SIM image that can be used as ground truth. Both micrographs have (1024 ⇥ 1024 ⇥ 44) voxels, each voxel being of size 40 ⇥ 40 ⇥ 110 nm 3 .

The data, the blind deconvolution result, and the structured-illumination image are presented in Figure 1. Compared to widefield, the blind deconvolution result shows an increase in resolution, especially along the axial dimension. This is clearly visible on the cuts across a microtubule presented in Figure 5. As microtubule are under-resolved by the microscope, their estimated width provides a good proxy of the resolution. On the presented cuts, the resolution after blind deconvolution is not much coarser than that of the SIM for a much less complicated setup.

1Fig. 1 .Fig. 2 .

 12 Fig. 1. Widefield observation and its blind deconvolution compared to the superresolution image given by structured illumination (SIM) on a drosophila S2 cell.

Acknowledgments

This work is supported by the Sinergia project "Euclid" from the Swiss National Science Foundation.


Wouter B De Vries
email: w.b.devries@utwente.nl

Ricardo De O Schmidt
email: r.schmidt@utwente.nl

Aiko Pras
email: a.pras@utwente.nl

Anycast and its potential for DDoS mitigation

IP anycast is widely being used to distribute essential Internet services, such as DNS, across the globe. One of the main reasons for doing so is to increase the redundancy of the service and reduce the impacts of the growing threat of DDoS attacks. IP anycast can be further used to mitigate DDoS attacks by confining the attack traffic to certain areas. This might cause the targeted service to become unavailable only to a fraction of its users. In this PhD research we aim at investigating how IP anycast can be optimized both statically and dynamically to support the mitigation of DDoS attacks.

Introduction

IP anycast is an addressing and routing strategy in which multiple physical servers in the Internet are configured with the same logical IP address. This strategy has been widely used to achieve high-availability and redundancy of services over the Internet, such as DNS and CDNs. IP anycast takes advantage of the robustness of BGP (Border Gateway Protocol) routing that defines the catchment of each anycast instance. BGP helps to define the catchment of each anycast instance by, for example, mapping users to the topologically nearest anycast instance. However, anycast catchment has proven to be more chaotic mainly due to routing policies that are defined within and between Autonomous Systems (ASes) [START_REF] Anwar | Investigating interdomain routing policies in the wild[END_REF][START_REF] Teixeira | Dynamics of hot-potato routing in ip networks[END_REF].

There may be multiple motivations for deploying an anycast service. Nowadays, however, redundancy and resilience of Internet services against cyber attacks has gained importance. Particularly resilience against Distributed Denialof-Service (DDoS) attacks since their occurence and intensity have significantly increased in the recent years [START_REF]Akamai: Q3 2015 state of the internet security report[END_REF], and essential Internet services are among their common targets [START_REF]Root Server Operators: Events of 2015-11-30[END_REF]. This problem is exacerbated by the fact that today anyone can perform DDoS attacks [START_REF] Santanna | Characterizing and mitigating the ddos-as-a-service phenomenon[END_REF].

When a service such as DNS is anycasted, there is no single point of failure. An anycasted service has the advantage that when being subject to a DDoS attack, the service might become unavailable to a fraction of the Internet only. That is, the service might be unreachable to the specific "catchment areas" of the affected anycast instances.

Although there are clear benefits to using IP anycast, and it generally works well [START_REF] Liu | Two days in the life of the dns anycast root servers[END_REF], it alone does not solve the DDoS problem altogether. For example, on November 2015 [START_REF]Root Server Operators: Events of 2015-11-30[END_REF] the DNS root servers received so many requests (caused by a DDoS) that it saturated the network connections to some of them. The impact of this particular attack was limited though, due to the sheer scale of the DNS root servers; 11 out of 13 root nameservers are anycasted. However, for other (non-)anycasted services the impact can be more severe. Examples of severe service degradation were recently reported by RIPE through their DNS-WG mailinglist1 : unusual amount of incoming traffic on the authoritative servers for RIPE DNS services on 14-Dec-2015 and on 14-Jan-2016. Recently, also the ccTLD DNS infrastructure of Turkey was attacked, causing severe service degradation [START_REF] Sozeri | Turkish internet hit with massive ddos attack[END_REF] In this PhD research, we will investigate how IP anycast deployments can be optimally planned and used to support service resilience against DDoS attacks. In the following we describe our main research goal, research questions, and planned approaches ( § 2). We also describe our first steps on building a global IP anycast service for our research ( § 3).

Goal, Research Questions, and Approach

The goal of this PhD research is to investigate methods to optimize anycast deployments in order to improve service resilience against DDoS attacks. To meet our goal we define four research questions.

First, to gain a more complete understanding of how operators currently mitigate DDoS attacks we define (RQ1) as what are the current DDoS mitigation strategies in use by operators of critical Internet infrastructure. Our approach will be focused on talking with operators, mainly those involved in the research, to understand their procedures and to be able to tailor improvements to them. To gain insight into the routing changes that will affect the catchment of anycast network when instances are added or removed, we define our second research question as (RQ2): what impact does the deployment of an anycast node in a given anycast network have on the overall catchment?. To answer this question we will perform active and passive measurements on a real anycast deployment. We are deploying our own experimental anycast testbed, comparable to PEERING [START_REF] Schlinker | Peering: An as for us[END_REF]. This testbed will allow us to announce and withdraw IP prefixes (both IPv4 and IPv6) from each anycast location. We will use the RIPE Atlas [START_REF] Ncc | Ripe atlas[END_REF] framework to perform the active measurements This framework will allow us to closely monitor the effects of anycast node deployment from the perspective of thousands of vantage points worldwide. In addition, we will analyze the deployment from the BGP perspective using passive measurement data, provided by services such as BGPmon, and RIPE's Routing Information Service (RIS).

The knowledge obtained from RQ1 and RQ2 will be used to support anycast planning and instances placement targeting resilience against DDoS attacks. This leads us to our third question (RQ3): in what ways can the catchment of an anycast network be influenced to increase resilience against DDoS attacks?. By analyzing the data obtained from RQ2 we attempt to find ways of optimizing the placement of nodes, aiming at increasing resilient against DDoS attacks. The key challenge is the fact that BGP routing is influenced by many, both technical and non-technical, factors. Potential methods will be verified in practice by implementing them using the anycast testbed and performing attacks on our own infrastructure. In addition, we will analyze the source of major DDoS attacks to determine if these are mostly located in certain areas. This will further assist in optimizing the anycast catchment for mitigation.

Finally, we determine if it is possible, and to what extent, the anycast catchment can be changed dynamically to further strengthen the DDoS mitigating property of an anycast network. For example by actively adding and/or removing instances during a DDoS attack near the source of attack traffic. Therefore, we define our fourth and final research question (RQ4) as: how can service resilience be positively influenced by dynamically changing the composition of the anycast network?. The results from RQ1, RQ2 and RQ3 as well as the operational experience gained using the anycast testbed will all contribute to answering RQ4. A potential solution is the deployment of inactive (ie, sleeping) instances that are activated on demand in the case of an attack. This setup can potentially lead to reduced operational costs as compared to the static approach of RQ3. The challenge lies in the fact that setting up anycast instances is not trivial because it might depend on routing policies and peering agreements involved in the anycast IP prefix announcement.

Preliminary Steps

As described above, one of the key components of this research plan is the anycast testbed. There is an existing testbed called PEERING [START_REF] Schlinker | Peering: An as for us[END_REF], which provides the sort of functionality that is required for the research that we intend to carry out. However, access is limited in duration and in functionality, in the sense that experiments are very bandwidth limited. Therefore, we have started the development of a new anycast testbed in collaboration with SURFnet (the Dutch NREN). Having access to this testbed will allow us to perform experiments without having to rely on models that may or may not be an accurate representation of reality. During the past months we have obtained a /24 IPv4 prefix and a /48 IPv6 prefix, which are of a sufficient size to be announcable through BGP. Furthermore, we have started development of an anycast management webinterface (TANGLER) that will allow for easy control of the IP prefixes announcement from our anycast instances. The intention is that it will also allow advanced experiments to be performed by scheduling route announcements and withdrawals.

Figure 1 shows the locations of the (planned) anycast instaces of our testbed. Nodes are configured using an orchestration tool (Ansible), which makes it trivial to add new instances. Management occurs through a single management node to which each of the anycast instances maintains a VPN-connection. The BGP announcements for each of the anycast instances can currently be controlled through a webinterface running on the management node. In the future we will also focus on creating a more local anycast network in Europe, constisting solely of European nodes. This will allow for studies on local impacts of DDoS mitigation and routing policies. Once our anycast testbed is fully operational, we plan to open the access (restricted by request and nature of research) to other researchers.

Operational

In progress Planned Management VPN Connection Fig. 1. Map of (planned) anycast nodes

Final Considerations

The PhD research outlined in this paper is planned to be carried out in a period of four years, which has started in late 2015 and will end in 2019. The preliminary steps ( § 3) have been carried out in the first six months.

https://www.ripe.net/mailman/listinfo/dns-wg/

Acknowledgements. This research is partially funded by SIDN and NLnet Labs through the projects DAS (http://www.das-project.nl) and SAND (http://www.sand-project.nl), by the EU FP7 FLAMINGO NoE (318488), and the SURFnet Research on Networks project.


Jana Medková
email: jana.medkova@mail.muni.cz

Pavel Čeleda
email: celeda@ics.muni.cz

Network Defence Using Attacker-Defender Interaction Modelling

Keywords: network defence, defence strategy, attacker-defender interaction modelling

Network security is still lacking an efficient system which selects a response action based on observed security events and which is capable of running autonomously. The main reason for this is the lack of an effective defence strategy. In this Ph.D., we endeavour to create such a defence strategy. We propose to model the interaction between an attacker and a defender to comprehend how the attacker's goals affect his actions and use the model as a basis for a more refined network defence strategy. We formulate the research questions that need to be answered and we discuss, how the answers to these questions relate to the proposed solution. This research is at the initial phase and will contribute to a Ph.D. thesis in four years.

Introduction

In network security, we can consider the reaction to an attack to follow a recurring cycle of detecting and understanding security events, making decisions and taking response actions [START_REF] Kott | Cyber Defense and Situational Awareness[END_REF]. However, if the defence is carried out by a human and the attack is automated, the response action might occur too late. In order to react quickly to an attack, the network defence has to be able to operate autonomously. In order to create an autonomous defence system, each part of the cycle has to be fully automated.

This has already been partly accomplished: the gathering of information from various sources is automated by Intrusion Detection Systems (IDS), which generate security alerts when malicious or suspicious activity is observed [START_REF] Bhuyan | Network Anomaly Detection: Methods, Systems and Tools[END_REF][START_REF] Shameli-Sendi | Intrusion response systems: survey and taxonomy[END_REF]. The received information is automatically processed to form situation awareness by Security Information and Event Management systems (SIEM), which provide a real-time analysis of security alerts [START_REF] Miller | Security information and event management (SIEM) implementation[END_REF]. The selected response actions can be carried out automatically using Software Defined Networking (SDN) [START_REF] Kreutz | Software-defined networking: A comprehensive survey[END_REF][START_REF] Hu | A survey on software-defined network and openflow: From concept to implementation[END_REF].

However, the selection of response actions is still performed by a security expert or unsophisticated decision algorithms, which take actions only where certain thresholds are exceeded. These thresholds are usually very high to avoid blocking legitimate users. Such systems are not capable of handling more complicated situations. If we want to be able to create a system capable of selecting response actions autonomously or work as a decision support for a security expert, we need a more efficient, refined defence strategy. In the proposed Ph.D. thesis, we would like to address this issue.

We propose to create a mathematical model of the interaction between an attacker and a defender and use it as a basis for a network defence strategy. Through modelling, we gain insight. Through insight, we gain understanding. Through understanding, we can form a strategy. However, to form a strategy based on the model several challenges have to be overcome.

1. The interaction between an attacker and a defender on the network is very complex. The network can be large, change over time and the number of attack vectors is ever growing. Moreover, each action has to be considered not individually but in the context of its future implications. 2. We are always uncertain about the state of the network, the attacker's objectives and previous actions (and whether he is an attacker at all). The best we can do is to operate on our beliefs -a probability distribution over the possible states updated whenever we receive new information.

Attempts have been made towards an autonomous network defence strategy. The Response and Recovery Engine [START_REF] Zonouz | RRE: A game-theoretic intrusion response and recovery engine[END_REF] selects a response action using game theory. The system showed promising results in simulated scenarios, however, it has limited usability since it assumes that an agent system is installed on each host. In [START_REF] Beaudoin | Autonomic computer network defence using risk state and reinforcement learning[END_REF] the authors propose a network defence system using reinforcement learning and dynamic risk assessment. However they admit that the overall performance was not optimal and further improvement is needed. A general overview of the model's requirements applicable for modelling the interaction between an attacker and a defender was given in [START_REF] Liu | Incentive-based modeling and inference of attacker intent, objectives, and strategies[END_REF].

Research Questions

The main goal of the proposed research is to model the interaction between an attacker and a defender and use the model as a basis for a network defence strategy. We have defined following research questions, which need to be answered to achieve this goal:

How can we model the interaction between an attacker and a defender?

The model of the interaction between an attacker and a defender provides a formal description of the workings of the interaction. It is necessary that the description is accurate, so that it captures the underlying principles of the interaction. At the same time, the model has to simplify the situation since we want to use the model to optimise the defender's actions. Balancing the accuracy and simplicity is crucial. We have to define the model that can be solved with reasonable computational complexity even for large networks and still be capable of capturing the essence of the interaction.

How can we use the model to form a network defence strategy?

The model of the interaction between an attacker and a defender only describes the interaction in a simplified manner. However, it enables us to better comprehend the dynamics of the interaction between an attacker and a defender, which in turn enables us to find the best response actions for the defender. We will use these actions to form a defence strategy. 3. Can human instinct and experience be included in the defence strategy? While the model can capture principles applicable in real life, it has its limitations. It is not unusual that the security expert observed similar attacks in the past or has better intuition. It would be therefore very desirable to use this information to improve the decision based on the model. Such a concept exists in economics, namely the Black-Litterman model [START_REF] Black | Global Portfolio Optimization[END_REF].

Proposed Approach

Our approach to creating a defence strategy consists of modelling the interaction between an attacker and a defender. We consider the interaction only on the defended network. Without the loss of accuracy, we also assume that the attacker's malicious intent is targeted on the network and he tries to maximise his utility by employing a series of attacks. On the other hand, the defender makes his best effort to defend the network based on his observations and available response actions. We assume both the observation and the response actions are made at the network level since it allows us to cover all connected hosts. Moreover, in reality, the defender usually does not have administration rights on the hosts in the network. In a fully autonomous defence, the role of the defender is taken on by a system capable of network monitoring and reconfiguration.

In this Section, we outline the steps that need to be taken in order to answer the research questions. We describe each step and a proposed approach.

Modelling the interaction between an attacker and a defender -We believe that game theory is a suitable mathematical tool for modelling the interaction between an attacker and a defender since it can model situations in which multiple parties with conflicting interests compete with each other [START_REF] Hamilton | The role of game theory in information warfare[END_REF]. We can use a game-theory toolset to compute the optimal strategies (in a game-theoretic meaning) for the defender and base the defence strategy (in a network defence meaning) on them. When defining the model, we have to keep in mind, that at some point in future we will need to compute the optimal actions of the defender and the attacker. Therefore, the model should be designed so that this task is computationally feasible.

Translating network information into model parameters -We have to estimate the input parameters of the model from information about the network in an automated fashion. The information should be passed in the form of a formal network description: the topology of the network, the hosts and services present in the network, the required levels of confidentiality, availability and integrity of these services and their interdependence. Based on this information, we can compare how desirable different outcomes are for the defender.

Network defence strategy -When formulating the strategy, we have to take into account uncertainty about the state of the network and the attacker's previous actions and goals. A possible approach would be to use the alerts generated by an intrusion detection system to maintain beliefs about the current state of the network, the attacker's past actions and his goals. Based on these beliefs we can use the model and select the best response action in a given situation. Since the computational complexity of optimising the response action is most likely going to be very high, we do not suppose that this selection would be computed at runtime, more likely it would be computed for the network in advance and only the precomputed results will be used.

Strategy verification -The efficiency of the decision algorithm has to be verified. First, we plan to test the proposed strategy in a simulated environment using a cloud-based testbed for simulating cyber attacks [START_REF] Kouřil | Cloud-based testbed for simulation of cyber attacks[END_REF]. Then, we plan to compare the strategy with decisions made by teams in the Computer Security Incident Response Team (CSIRT) training exercise [START_REF] Čeleda | KYPO -a platform for cyber defence exercises[END_REF]. In this exercise, teams of CSIRT employees defend their network and are scored based on the success of the attacks. The strategy would represent the fifth team and its score will be compared to the "real" teams score.

Adding human intuition to decision output -The strategy will base the defence on beliefs about the state of the network, the attacker's past and future actions and his goals. Any refinement of these beliefs will lead to better results. Humans have expertise and intuition which cannot be emulated by any model, no matter how sophisticated. They could have seen similar situations before, guess what will the attacker do next or have additional information which is not included in the strategy. We can include human opinion on the situation into the decision by updating the current beliefs.

Conclusion

The role of a defender in network security is difficult. If the defender cannot protect his network, he fails. If he impairs a legitimate user by his actions, he fails. Moreover, the defender is never certain about the state of the defended network since the observations of the network might be incorrect. Currently, automated network defence systems select response actions based only on the observed security events. They react only in unambiguous situations and the rest of the events must be investigated by security experts. We want to refine the decision making process by including also the motivation of the attacker. By comprehending how his goals affect his actions, we gain more information and we can select the response action more accurately.

Acknowledgement

This research was supported by the Security Research Programme of the Czech Republic 2015 -2020 (BV III / 1 VS) granted by the Ministry of the Interior of the Czech Republic under No. VI20162019014 Simulation, detection, and mitigation of cyber threats endangering critical infrastructure.


Václav Bartoš
email: bartos@cesnet.cz

Jan Kořenek
email: korenek@fit.vutbr.cz

Evaluating Reputation of Internet Entities

des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Introduction

Network operators today often recognize the need to monitor their networks. This includes security monitoring, i. e. deployment of various detectors of malicious or unwanted traffic, such as honeypots, IDS, behavioral analysis or anomaly detection. These systems can generate large amounts of security events or alerts. In large networks with many such detectors, or when alerts are exchanged among several organizations via some alert sharing system (such as Warden, Abuse-Helper, n6, etc. [START_REF]ENISA: Standards and tools for exchange and processing of actionable information[END_REF]), the number of such alerts may be very large (millions per day [START_REF] Bartoš | Analysis of alerts reported to Warden[END_REF]). We believe that analysis of such amount of data can reveal interesting characteristics of sources of malicious traffic. In particular, we want to label them by estimated measure of threat they pose, which we call reputation score.

It is known that network attacks are generated mostly by hosts infected with malware allowing attackers to control them remotely. Once a host is compromised, it often stays compromised for some time and therefore many security events can be caused by this single host. This fact is often used for spam mitigation, where lists of known malicious IP addresses (blacklists) are used to block known sources of spam. The same principle can be used to deal with other kinds of malicious traffic as well. For many attack1 types, it is common to see the same IP address reported as malicious repeatedly for a long time [START_REF] Bartoš | Analysis of alerts reported to Warden[END_REF][START_REF] Bartoš | An Analysis of Correlations of Intrusion Alerts in an NREN[END_REF][START_REF] Moreira Moura | Internet bad neighborhoods temporal behavior[END_REF]. However, while blacklists are easy to use, the information they provide is very limited. It is a binary information only -an address is either listed or not, surely bad or surely good, nothing in between. Moreover, there is no information about why it was listed or when. it has been shown that malicious IP addresses are distributed non-uniformly both geographically and in IP space [START_REF] Bartoš | Analysis of alerts reported to Warden[END_REF][START_REF] Shue | Abnormally Malicious Autonomous Systems and Their Internet Connectivity[END_REF][START_REF] Moreira Moura | Internet bad neighborhoods[END_REF]. Some networks, autonomous systems or countries (called bad neighborhoods in [START_REF] Moreira Moura | Internet bad neighborhoods[END_REF]) host significantly more malicious hosts than others. Therefore, in some cases, the sole fact that an IP address belongs to such a bad neighborhood may be enough for it to be suspicious, although the address itself has never been reported as malicious. This phenomenon cannot be covered by classic blacklists.

We envision a much richer source of information about misbehaving entities, which we call a reputation database. It will gather alerts from large number of detectors (via some of the existing alert sharing systems) and keep information about all network entities (not only IP addresses, but also network prefixes, domains, etc.) reported as sources of malicious behavior, including information on reasons why the entity was listed, when and by whom. It will further enhance this information by data from external sources, such as geolocation, information from DNS (e. g. hostnames assigned to IP addresses), other databases or blacklists. In general, it will gather as much security related information about the reported entities as possible. All this information will be provided to security teams to help them to protect their networks and investigate incidents.

An important part of the system should be an algorithm summarizing all the information known about an entity, i. e. its reputation, into a single number representing a measure of threat the entity poses -its reputation score. For example, it should allow to easily differentiate between an address which sent a single spam email a week ago and an address which tries to break into password protected services by dictionary attacks every day for last two months. It thus allows to quickly decide on which problems to focus first, or to easily create blocklists by getting a top-n list of IP addresses with the worst reputation score, for example. The goal of our research is to find a method to evaluate the reputation of an entity numerically by computing its reputation score.

Proposed approach

The first thing that has to be done is to formally define the meaning of reputation score. In common language, the word "reputation" expresses the common opinion people have about someone or something (an entity) [4,8]. It is based on shared experience with past behavior of the entity. But although it is based on the past, it is intended to describe the most likely state in the near future and thus to help with current decisions. Similarly, reputation score of a network entity should be based on the history of security incidents caused by the entity, but it should represent the level of threat the entity poses now and in the near future. Therefore, we formally define it as follows:

Reputation score of a network entity (e. g. an IP address) represents the probability that the entity will perform a malicious activity in the near future (e. g. next 24h), based on its past behavior and other information. 2definition means that evaluation of the reputation score must be based on prediction of future attacks. Our approach to build such a predictor is as follows.

The input of the prediction algorithm will be mainly a summary of all malicious events reported in some past time window. They can be supplemented by various other inputs related to the entity and the threat it potentially poses. For an IP address, it may be the country and the autonomous system it belongs to, whether it is listed on some of the public blacklists, whether its hostname can be resolved using a reverse DNS query, or whether the address is dynamically assigned or there is NAT (which can be sometimes guessed from the hostname).

All this information form the input of an algorithm, whose output should be the probability that the given entity will behave maliciously in a specified future time window. However, due to the number of inputs, their diversity and potential interdependencies, it is unfeasible to design such algorithm by hand. Our approach is to use some of the supervised machine learning methods to infer the algorithm from the data.

Indeed, this task is suitable for supervised learning, since it is easy to get a training set. For example, consider we have a week long sample of alerts. For each malicious IP address in the sample, we can get information about it from the first six days as an input and information whether it behaved maliciously in the last day as the expected output. By repeating this with data from several weeks it is possible to get very large labeled dataset. Moreover, the algorithm can constantly improve itself during operation by comparing its prediction with actually detected attacks.

Challenges

Besides issues connected to the machine learning itself, we foresee several other non-trivial problems that have to be solved. Some of them are briefly discussed here.

Reputation in a context. The definition of reputation score above implies that there may not be a single score for a given entity. It depends on parameters, such as length of time window for prediction, and context, i. e. which kind of malicious activity we are interested in. It should be possible to compute an overall reputation score using some appropriate set of parameters and by combining probabilities of various kinds of predicted attacks. But in many cases a more specific score will be needed, e. g. focusing on a specific kind of attack. For example, an IP address may be known as a frequent source of SYN flood attacks, so it would have a bad reputation score in the context of (D)DoS attacks, but its score in other contexts, e. g. port scanning or sending spam, might be good.

Information aging. If an IP address is reported to perform some kind of attack, it means it was probably part of a botnet or otherwise controlled by an attacker at the moment of the attack. It is likely that it holds true a minute, an hour or even several days later. However, with increasing time from the last report the probability the address is still malicious is getting lower and we can hardly infer anything from data older than a month. The host behind the address might get fixed or the might be assigned to another host in the meantime. This adds a degree of uncertainty to all the data which changes over time. Moreover, it is hard to specify how exactly does it change, since it may depend on various aspects, e. g. whether the address is statically or dynamically assigned (more on this later).

Information uncertainty. Many of the pieces of information entering the reputation scoring process may be imprecise, unreliable or otherwise uncertain. They may be, for example, deduced using some heuristic or approximate algorithm, or they may be obtained from an external data source we do not fully trust. Since most of that uncertainty can be described using probability, its incorporation into the reputation scoring process should not a problem in principle, but it will further increase its complexity.

IP to host mapping. The main purpose of having a reputation database is to gain knowledge about malicious hosts, but we work with IP addresses instead. And mapping of hosts to IP addresses is far from one-to-one due to dynamic address assignment and extensive use of NAT. However, tracking of individual hosts is practically impossible, especially with alert data only (and even if it would be possible, it would be probably considered very privacy intrusive). Therefore, we will at least try to recognize dynamic address ranges and NATs and adjust the scoring method for them. For example, information about dynamically assigned addresses should expire faster than that about static ones. We will draw from many existing works on this topic, e. g. [START_REF] Gokcen | Can We Identify NAT Behavior by Analyzing Traffic Flows?[END_REF][START_REF] Moreira Moura | How Dynamic is the ISPs Address Space? Towards Internet-Wide DHCP Churn Estimation[END_REF][START_REF] Vu | Impact of DHCP Churn on Network Characterization[END_REF].

Preliminary results

We started with analysis of alert data from CESNET's alert sharing system Warden [START_REF]CESNET: Warden -alert sharing system[END_REF]. It currently receives data from 16 detectors, mostly in CESNET2 network. We took two month-long datasets gathered in 2015, containing over 70 million alerts in total, and analyzed them from various points of view.

For example, we confirmed that sources of malicious traffic are geographically distributed non-uniformly, but we found that this distribution is very different for different types of malicious traffic. Also, although most IP addresses were reported only once, there were some addresses that were reported repeatedly for a long time. And for example, while only 8.5% of scanning addresses were reported in 5 or more days of a month, they were responsible for 65% of all port scanning events reported in that month. Thus, even knowing only the most active attackers might be very useful. For more information we refer the reader to our technical report [START_REF] Bartoš | Analysis of alerts reported to Warden[END_REF] which presents more results of the analysis.

Currently we are experimenting with various machine learning methods trying to create the best predictor of network attacks. Also, we continue to gather data from more and more sources, since to successfully capture the global threat landscape by the reputation database, we need to know about a significant portion of all attackers on the Internet. In order to achieve this, we are involved in one national and two international projects about alert sharing.

For simplicity, all kinds of malicious or unwanted traffic, including spam or port scanning, are called attacks in this paper.

Ideally, the probability should be combined with anticipated severity of the malicious activity. Such variant is much more complex and is not covered by this short paper.

This research was supported by Security Research grant no. VI20162019029 in project Shaing and analysis of security events in Czech republic granted by Ministry of the Interior of the Czech republic. It was also partially supported from IT4Innovations excellence in science project (IT4I XS -LQ1602) and by Brno University of Technology grant no. FIT-S-14-2297.


Milan Čermák

Pavel Čeleda

Detecting Advanced Network Threats Using a Similarity Search

Keywords: similarity search, network data, classification, network threats

In this paper, we propose a novel approach for the detection of advanced network threats. We combine knowledge-based detections with similarity search techniques commonly utilized for automated image annotation. This unique combination could provide effective detection of common network anomalies together with their unknown variants. In addition, it offers a similar approach to network data analysis as a security analyst does. Our research is focused on understanding the similarity of anomalies in network traffic and their representation within complex behaviour patterns. This will lead to a proposal of a system for the realtime analysis of network data based on similarity. This goal should be achieved within a period of three years as a part of a PhD thesis.

Introduction

A large number of attacks threaten computer networks. Although the basis of these attacks is similar, a lot of variants exist differing in the protocol used, behaviour, or methods used to avoid their detection. Every day a lot of new attack variants emerge, which represents a challenge for current Intrusion Detection Systems (IDS) [13]. Almost all of these variants require a fast reaction by the authors of these systems to suppress it in time to defend their systems.

Currently, several approaches exists for network anomaly detection [START_REF] Bhuyan | Network Anomaly Detection: Methods, Systems and Tools[END_REF]. These approaches utilize various techniques for network data analysis from statistical to machine learning methods. Each of these has its own advantages and disadvantages that affect its success in detecting network attacks. Nevertheless, most of the currently used detection tools are based on only statistical analysis and the exact matching of pre-known behavioural patterns, due to their simplicity and lower false positives rate. This approach, however, has a drawback in the inability to detect advanced network threats such as hidden or obfuscated attacks which try to hide their specific characteristics within normal network traffic.

Our research aims to overcome the constraints of these network data analysis approaches through similarity search techniques [START_REF] Zezula | Similarity Search: The Metric Space Approach[END_REF]. This will allow us to combine the advantages of both knowledge-based detection (capable of easily identifying network anomalies without high false positive rates) and clusterbased detection (which allows us to recognize unknown attack variants). We will focus on network traffic classification based on the same principle as automated images annotation using a similarity search [START_REF] Budikova | Search-Based Image Annotation: Extracting Semantics from Similar Images[END_REF]. We plan to classify the analysed network traffic by comparing its similarity with a collection of annotated patterns, reflecting pre-known characteristics of common network attacks. The network traffic will be classified as well as patterns that are closest to it. This approach allows us to take advantage of our knowledge of network anomalies' characteristics, while also revealing their unknown variants.

Research Questions

The aim of our research is to use similarity search techniques for detecting advanced network threats based on similarity of traffic behaviour patterns. Our intention is to analyse these behaviour patterns in a similar way as a security analyst would usually do, which is an investigation of known attack patterns and searching for their variants. We have identified the following three research questions that reflect the main topics of our research:

1. How can we characterize similarity in network traffic?

The majority of current methods for measuring network traffic collect only specific traffic information, which is not comprehensive enough to describe complex behaviour [START_REF] Bhuyan | Network Anomaly Detection: Methods, Systems and Tools[END_REF]. Thus, we need to explore methods of transforming these simple data into more complex data, and so providing a reasonable amount of information for comparing their similarity. This research question covers the research of a suitable representation of complex behaviour patterns and the selection of appropriate distance functions to measure their similarity.

How can similarity search techniques be utilized for detecting network anomalies?

Our second research question is focused on research into the transformation possibilities of fundamental methods for detecting network anomalies into the similarity search concept. We plan to utilize network traffic classification based on a similarity search of defined behaviour patterns and propose a proof-ofconcept system for detecting anomalies. This research question, besides other factors, also includes the creation of a collection of anomalous behaviour patterns. Based on their similarity, analysed network traffic should also be classified.

What possibilities do the similarity search techniques have for detecting advanced network threats?

The main goal of the third research question is to explore the benefits of the proposed method for network anomaly detection in detecting advanced network threats, such as hidden or obfuscated network attacks. We will pay attention to the verification of different characteristics of similarity searches and to the various representations of network behaviour patterns. Specifically, we will focus on different functions to measure the patterns' distances and the identification of combinations of smaller behaviour patterns based on general models of network attacks.

We will focus on the interconnection of similarity search techniques and methods for detecting anomalies in network traffic. To achieve this aim, we will progressively work through the research questions.

Characterization of a Similarity in Network Traffic

To achieve the aim of our research, it is necessary to understand network traffic characteristics and their similarities, which should be used within anomaly detection. Weller-Fahy et al. [START_REF] Weller-Fahy | A Survey of Distance and Similarity Measures Used Within Network Intrusion Anomaly Detection[END_REF] demonstrate that almost every method for detecting network anomalies utilizes some kind of a similarity measure. Thus, we plan to study publications focused on this area and extract all the presented network traffic characteristics and their similarity properties. These findings will be evaluated on publicly available datasets [START_REF] Barbosa | Simpleweb/University of Twente Traffic Traces Data Repository[END_REF][START_REF] Ferro | The CAIDA UCSD Anonymized Internet Traces[END_REF] and on live network traffic to verify their suitability for specifying network behaviour patterns.

Based on the identified traffic characteristics and their similarities, we will specify behaviour patterns which reflect all important events in network traffic. For their specification, we plan to utilize the Bro Network Security Monitor [START_REF] Paxson | Bro: a System for Detecting Network Intruders in Real-Time[END_REF] and IP flow monitoring systems [START_REF] Hofstede | Flow Monitoring Explained: From Packet Capture to Data Analysis with NetFlow and IPFIX[END_REF], which are suitable for collecting data quickly and analysing in large networks. We will consider two forms of network behaviour patterns: aggregated, represented by the aggregation of specific traffic features per unit of time and sequential, consisting of sequences of traffic features ordered in time. Each of these forms has its advantages and disadvantages, which we want to understand. Our goal is to associate the appropriate form of specific anomalies to correctly represents their characteristics and avoid behavioural aliasing [START_REF] Kompella | On Scalable Attack Detection in the Network[END_REF], which occurs when anomaly behaviour looks like normal traffic.

During the definition of network traffic behaviour patterns, it is important to consider their characteristics' similarity. The selection of suitable distance functions and methods for their utilization plays a crucial role in our research since it directly affects the success of detecting network anomalies. For this purpose, we plan to analyse publications focused on the similarity measure, discuss our observations with specialists in the similarity search topic and verify our findings using simulated and live network traffic. For this verification, we plan to utilize the Metric Similarity Search Implementation Framework (MESSIF) [START_REF] Batko | MESSIF: Metric Similarity Search Implementation Framework[END_REF], which provides a suitable environment for verifying the selected similarity measure techniques.

Utilizing Similarity Search Techniques for Detecting Network Traffic Anomalies

As we are focused on knowledge-based anomaly detection, the next necessary part of our research is the preparation of annotated behaviour patterns corresponding to network anomalies. To define these patterns we plan to analyse current network attacks and anomalies observed within live network traffic. These patterns will form the basis of a proof-of-concept framework. This framework will be based on the 𝑘𝑁 𝑁 -classification [START_REF] Zezula | Similarity Search: The Metric Space Approach[END_REF] of ongoing traffic using a similarity comparison of analysed traffic, with the annotated collection of anomaly behaviour patterns.

The anomaly detection capabilities of the proof-of-concept framework will be verified within real and simulated network traffic using simulated network attacks. To validate within simulated traffic, we plan to utilize the KYPO platform [START_REF] Kouřil | Cloud-based testbed for simulation of cyber attacks[END_REF] that enables network attacks to be securely testing and provides extensive options for monitoring them. Thanks to this environment we will be able to properly compare our anomaly detection approach with other approaches specified in specialized publications or used within common anomaly detection tools, such as Snort [START_REF] Roesch | Snort -Lightweight Intrusion Detection for Networks[END_REF], Bro [START_REF] Paxson | Bro: a System for Detecting Network Intruders in Real-Time[END_REF] or Flowmon ADS [START_REF] Invea-Tech A.S | Flowmon ads[END_REF].

Detection of Advanced Network Threats Based on a Similarity Search

After verifying our approach, we will focus on the optimization of similarity search attributes and test different distance functions. The aim of this effort is a complex study of impacts, the possibilities of similarity search techniques and advanced network threat detection. These attacks are characterized by their effort to bypass known detection techniques and by hiding their specific characteristics within normal network traffic, which makes them difficult to detect by current anomaly detection methods.

Apart from the complex behaviour patterns of network traffic anomalies, we will also focus on recognising their individual phases. We plan to extend Drašar's [START_REF] Drašar | Behavioral Detection of Distributed Dictionary Attacks[END_REF] research into network attack models and utilize these models as a basis for defining our anomaly behaviour patterns. The updated form of patterns will correspond to the attack phases instead of the whole attack. We believe that such behaviour patterns will make it possible to identify multiple forms of attacks, even those that are as yet unknown.

Conclusion

Since this is the first work of its kind, it is necessary to deal with several complications that come with the application of similarity search into the field of network data analysis. The most important part of such an application is the proper understanding of the similarity of network traffic and the specification of complex behaviour patterns reflecting this similarity. The correct specification of these patterns is crucial for achieving adequate results in the detection of common network threats and their unknown variants.

Acknowledgement

This research was supported by the Security Research Programme of the Czech Republic 2015 -2020 (BV III / 1 VS) granted by the Ministry of the Interior of the Czech Republic under No. VI20162019029 The Sharing and analysis of security events in the Czech Republic.


Tomas Cejka
email: cejkat@cesnet.cz

Marek Svepes
email: svepemar@fit.cvut.cz

Analysis of Vertical Scans Discovered by Naive Detection

Network scans are very common and frequent events that appear in almost every network. Generally, the scans are quite harmless. Scanning can be useful for network operators, who need to know state of their infrastructures. Contrary, scans can be used also for gathering sensitive information by attackers. This paper describes a simple detection method that was used to detect vertical scans. Our aim is to show results of long-term measurement on backbone network and to show that it is possible to detect scans efficiently even with a simple method. The paper presents several interesting statistics that characterize network behavior and scanning frequency in a large high-speed national academic network.

Introduction

Network scanning is a common and frequent activity that can be observed in almost every network infrastructure. It is a normal benign mechanism used by network operators or automatic tools for monitoring and management. A network scan is based on probing targets to recognize the active ones. That is a scan referred as horizontal. Scans can also probe ports of one target. Such scans are called vertical. A block scan is a combination of horizontal and vertical scans.

Scans are easily performed even by attackers. Attackers can use scanning to search for publicly available services and vulnerable devices in the internet. Even though network scanning is basically harmless, current researches show, that it can be dangerous in some ways. Bartos et al. in [START_REF] Bartos | An analysis of correlations of intrusion alerts in an nren[END_REF] show correlation between network scans and attacks (e.g. bruteforce guessing of passwords or DoS attacks) that follow scans. Similarly in [START_REF] Raftopoulos | How dangerous is internet scanning? In: Traffic Monitoring and Analysis[END_REF], Raftopoulos et al. discuss their observation about high probability of malware infection of devices that had been scanned previously. Therefore, it is important not to underestimate a danger of scans.

Unfortunately, there is no universal detection method, that would be suitable for all sizes of networks. According to [START_REF] Sridharan | Connectionless port scan detection on the backbone[END_REF], large transit networks or National Research and Education Network (NREN) infrastructures require a special detection approach. The main issues related to such networks are: high speed, wider diversity of IP addresses, lack of knowledge about end-hosts' configuration, asymmetric routing, coexistence with other monitoring and detection tasks without interference. This paper presents observations from the perimeter of CESNET2. It is Czech NREN, a backbone and a transit network. Based on observations, we created a straightforward detection method.

Related Work

Bhuyan et al. presents a taxonomy of network scanning and a survey of some existing detection approaches in [START_REF] Bhuyan | Surveying port scans and their detection methodologies[END_REF]. Using the taxonomy, we can classify the detection method presented in our paper as a threshold-based method.

One of the well-known methods is a Threshold Random Walk (TRW) proposed for scan detection by Jung et al. in [START_REF] Jung | Fast portscan detection using sequential hypothesis testing[END_REF]. The detection method was implemented as a part of Bro [START_REF] Paxson | Bro: a system for detecting network intruders in real-time[END_REF]. Sridharan et al. in [START_REF] Sridharan | Connectionless port scan detection on the backbone[END_REF] points out disadvantage of TRW that needs knowledge about the configuration of end-hosts. In backbone networks there are several issues that complicate scan detection. However, it is still useful to perform detection even on backbone level. The paper investigates effectiveness of existing methods and proposes a new method Time-based Access Pattern Sequential hypothesis testing (TAPS). Lee et al. is one of the most closely related works to this paper. Their paper presents a report about observed port scans. The authors analyzed two weeks of traffic at University of California, San Diego (UCSD) using Snort [START_REF] Roesch | Snort: Lightweight intrusion detection for networks[END_REF]. The paper was written in 2003 and the authors discovered 9,927 vertical scans. Whereas, we have been monitoring network traffic from CESNET2 more recently (2015) for longer time (two months) and average number of discovered vertical scans in two weeks was 203,000.

As it was shown, there are various approaches of scan detection. However, we used a simple flow-based method with thresholds and filtering flow records.

Detection Algorithm

The detection algorithm uses information from basic flow records (source and destination IP addresses and ports, protocol, #packets, #bytes). The principle of algorithm was inspired by characteristics of scans generated by nmap [START_REF] Lyon | Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning[END_REF]. Analysis showed that scans are composed of plenty flow records with small number of packets (≤ 4) transferred between the source IP (potential attacker) and a destination IP (victim).

We have focused on a default scanning technique supported by nmap. It uses Transmission Control Protocol (TCP) packets with set SYN flag. This simulates establishment of a new TCP session and the target should reply with SYN+ACK if the probed port is opened. The detection results of SYN scans are verifiable manually even in unknown network traffic of backbone since TCP normal traffic from a host always contain not only SYN flag and should not imply plenty RST responses. Detection of other scan types is more complicated due to verification of false positives and missing ground truth in the real backbone traffic.

The detection algorithm is based on analysis of the number of destination ports per source IP and uses threshold for number of ports. It is important to remember all unique destination ports for each pair of addresses separately. The source IP is a potential source of scan, meanwhile, the destination IP is a victim.

The algorithm was implemented as a module of the NEMEA system [START_REF] Bartoš | Nemea: Framework for stream-wise analysis of network traffic[END_REF][START_REF] Cesnet | NEMEA: Network Measurements Analysis Framework[END_REF] and is described in more detail in [START_REF] Cejka | Vertical Scan Detector README[END_REF].

Evaluation and Measurements

Our measurement started on 31. 10. 2015 and stopped on 31. 12. 2015. In total, we observed over 388 billion flow records from all monitoring probes. That is on average 76,283 flows per second with over 144,506 flows per second in peak.

In order to find a reasonable threshold for the number of destination ports, we measured average number of destination ports used by a source IP. Moreover, we were interested in maximal number of destination ports per source. These observations were based only on TCP protocol without any consideration of TCP flags. Values were computed in hour intervals. The results are shown in Fig. 1. It is clear that intensive port scans probe a lot of destination ports. Therefore, the maximal number of ports is over fifty thousand. Most of source addresses use only a few destination ports and therefore total average number of destination ports per source IP lies around ten. From this point of view, with respect to memory consumption, the threshold was experimentally set to 50. Distribution function in Fig. 2 shows, that over 99 % addresses use less then 50 destination ports. Therefore, source IP address which has used 50 or more destination ports is considered as a potential attacker.

On average, network scans take about 1.2 % of observed flows. Alerts are aggregated in 10 minute time windows. Using the aggregation, the number of alerts decreases by 94 %. Average length of the aggregated alerts is about 2 minutes 45 seconds and over 2,600 destination ports are being probed. On average, there are over 580 aggregated alerts per hour.

During the analysis of scans targeted to a single target, we found distributed scans as well. Scanning hosts were active for about 10 minutes and each scanner probed about 2,000 ports. Altogether, scanners probed disjoint sets of ports. According to the results, most of scans occur at 8:00 and 13:00 UTC. The rest of scans are spread over all hours. We expect that the distribution is caused by peaks of traffic that we normally see in these hours.

The deployed detector has discovered non-uniform intensity of some scans that was changing in time. For example, 47,156 addresses of Czech university of economics were scanned during 19 minutes by one block scan. The highest intensity (over 10,000 alerts per minute) was in the middle of the scan. Over 50 ports were probed for each target.

Memory consumption of the module was analyzed by valgrind [START_REF] Nethercote | Valgrind: a framework for heavyweight dynamic binary instrumentation[END_REF]. The measurement was performed for almost two days and the module consumed 576 MiB during the peak. The amount of required memory is decreased due to autoregulation based on removing inactive addresses. It is set by module's threshold.

The used detection algorithm, from its nature, suffers from some limitation. The algorithm skips repeating SYN flows with the same destination port. Such traffic is assumed to be benign traffic. However, this fact can be easily exploited by scanners to avoid the detection. Distributed scans are generally difficult to detect. Large botnets can scan the whole internet using just a few packets generated by each bot [START_REF] Dainotti | Analysis of a /0 stealth scan from a botnet[END_REF]. A distributed scan can be detected by our algorithm if and only if at least some of the scanners fulfill conditions to be detected (e.g. number of destination ports threshold).

Conclusion

Vertical scans are frequent events that occur in almost every computer network. In this paper, we have proven this fact by observation of the vertical scans in the backbone network. The measurement showed that it is possible to detect scans with a simple straightforward detection algorithm using commodity hardware.

The proposed algorithm is limited to detection of TCP scans, however, it can be deployed in large network infrastructures and analyze huge volume of data. On average, there are about 580 aggregated alerts per hour that are detected by the implemented detection module. Some randomly selected alerts from the two-month measurement were verified manually. This paper presented statistical characteristics and results of scans detected at the perimeter of CESNET2.

Modern network attacks are mostly performed by botnets. Therefore, the importance of detection of distributed attacks (scans in our case) increases. According to our observations, intensive distributed scans became usual. However, the larger botnets are, the harder the detection is because each bot can probe just a few ports and so it is difficult to recognize bot's traffic from benign clients.

Fig. 1 :

 1 Fig. 1: Average and maximal number of destination ports per source IP.

Fig. 2 :

 2 Fig. 2: Distribution function of number of destination ports per source IP.

Acknowledgments This work was partially supported by the "CESNET E-Infrastructure" (LM2015042) and CTU grant No. SGS16/124/OHK3/1T/18 both funded by the Ministry of Education, Youth and Sports of the Czech Republic.


G Tangari

M Charalambides

D Tuncer

G Pavlou

Decentralized Solutions for Monitoring Large-Scale Software-Defined Networks

Software-Defined Networking (SDN) technologies offer the possibility to automatically and frequently reconfigure the network resources by enabling simple and flexible network programmability. One of the key challenges to address when developing a new SDN-based solution is the design of a monitoring framework that can provide frequent and consistent updates to heterogeneous management applications. To cope with the requirements of large-scale networks (i.e. large number of geographically dispersed devices), a distributed monitoring approach is required. This PhD aims at investigating decentralized solutions for resource monitoring in SDN. The research will focus on the design of monitoring entities for the collection and processing of information at different network locations and will investigate how these can efficiently share their knowledge in a distributed management environment.

Introduction

Effective resource monitoring is a fundamental requirement for the management of large-scale networks. Monitoring systems are designed to collect measurements from the network resources, process the acquired data and expose the resulting knowledge, in order to provide a reliable representation of the network state. Today, network monitoring mainly operates on long timescales producing periodic reports, which are mostly used for manual and infrequent network reconfigurations. However, with the advent of Software-Defined Networking (SDN) technologies, the monitoring requirements are changing since network operators will be able to reconfigure their resources at a faster pace to automatically react to emerging conditions.

By decoupling the control logic from the forwarding hardware, SDN enables easy and flexible network programmability. This key feature allows the implementation of complex high-level network policies [START_REF] Kim | Improving Network Management with Software Defined Networking[END_REF][2] [START_REF] Shin | FRESCO: Modular Composable Security Services for Software-Defined Networks[END_REF] and the design of applications that reconfigure the network automatically and frequently [START_REF] Al-Fares | Hedera: dynamic flow scheduling for data center networks[END_REF][5] [START_REF] Agarwal | Traffic engineering in software defined networks[END_REF]. These novel capabilities pose new monitoring requirements, which cannot be met by currently deployed approaches. As such, the overarching objective of this PhD is to design a monitoring framework that can provide frequent and consistent network state updates to complex and heterogeneous applications, thus enabling fast and effective reconfigurations.

To address these requirements, the monitoring system has to be scalable, flexible toward heterogeneous applications and adaptive with respect to the network conditions. Our research starts from these considerations and focuses on a distributed monitoring system for large-scale software defined networks. The choice of a decentralized approach has its roots in recent research [START_REF] Tootoonchian | HyperFlow: A distributed control plane for Open-Flow[END_REF][8] which has demonstrated the weakness of centralized SDN proposals. First, using a central controller poses scalability limitations in terms of the number of switches and traffic flows. Second, as the network diameter grows, the associated latencies can become considerable, penalizing the responsiveness of the management operations. In contrast, decentralized solutions can cope with a large number of devices, distributed over wide geographic areas, and facilitate fast reconfigurations since monitoring information is acquired closer to the source.

Requirements and Research Challenges

This PhD aims to investigate decentralized solutions for resource monitoring in software-defined networks. The research will be based on the SDN framework proposed in [START_REF] Tuncer | Adaptive resource management and control in software defined networks[END_REF] which introduces a clear separation between management and control functionality. A set of managers, distributed over the network, hosts various management applications that implement the necessary logic to decide on network (re)configurations, while corresponding controllers are in charge of enforcing those decisions. To communicate with the forwarding hardware, the controllers rely on OpenFlow [START_REF] Mckeown | OpenFlow: Enabling Innovation in Campus Networks[END_REF], the de facto standard for the southbound communication in SDN. As described in [START_REF] Tuncer | Adaptive resource management and control in software defined networks[END_REF], monitoring is part of the distributed management functionality with the objective to gather information from network devices and subsequently support applications for their decisions. Although of paramount importance, the authors did not elaborate on the technical challenges associated with collecting and disseminating information in a distributed environment. The objective of this PhD is to address this gap by investigating the challenges described below.

Design considerations. Effective design of distributed monitoring functionality has to take into account a few key issues. The monitoring operations, if very intrusive, could adversely affect the network performance. At the same time, monitoring operations need to be frequent and fast to enable management applications to operate on short timescales. In addition, they should provide precise and high-granularity information to support accurate decisions. When the management system operates inside a large-scale SDN, the impact of these issues is amplified since the decisions might be taken far away from the locations where monitoring is performed. We identify below the two main features that need to be provided by monitoring entities.

1. Programmability: the frequency and the granularity level of the measurements have to be highly configurable based on the requirements of heterogeneous management applications. 2. Adaptability: the measurement rate should be frequently reconfigured, in such a way to follow the rate of change of the measured values. Adaptability, as argued in [11][12], enables a reduction of the monitoring overhead, while ensuring acceptable levels of accuracy.

We have identified the main operations composing the monitoring entity function in a distributed management framework. The first one is the analysis of the application requirements. By exposing a high-level API to the management applications, the monitoring entity receives a large variety of requirements. It interprets such requirements and translates them into sets of monitoring specifications, indicating the type of measurements to be performed and the targets of such measurements. Then, it efficiently schedules the individual monitoring operations, in such a way to limit the overhead and avoid the creation of bottlenecks [START_REF] Mogul | Devoflow: Cost-Effective Flow Management for High Performance Enterprise Networks[END_REF]. For example, to gather statistics from an OpenFlow-enabled switch, the monitoring entity instructs the corresponding controller to query, through the OpenFlow interface, the target switches, or to configure them in order to push statistics upon flow expirations. Acquired statistics are finally processed and subsequently exposed to the management applications.

Distributing the monitoring function. In a distributed SDN environment, management applications operating at different locations may need statistics gathered from outside their local scope. In such a setting, the monitoring entities will need to share their local knowledge. Ensuring the right tradeoff in state distribution is an open issue, as argued in [START_REF] Levin | Logically centralized?: state distribution trade-offs in software defined networks[END_REF]. In our case, the distribution of the monitoring functionality poses a significant challenge: how can the monitoring entities frequently access reliable and detailed knowledge concerning remote resources at an acceptable cost? A solution where every local manager shares all the acquired statistics with every other manager is unlikely to scale due to the explosion of overhead and synchronization times. This would prevent decision-making entities to quickly react to emerging conditions and could therefore adversely affect the usage of resources. Part of our work will investigate the possible techniques to achieve the right balance between accuracy and overhead for a wide range of applications. Striking the right tradeoff in statistics aggregation, before the knowledge is exchanged, is a possible way to address the issue since this influences the overhead associated with state distribution. Another research challenge concerns the intelligent selection of managers between which knowledge should be shared according to the application requirements. Based on this, a suitable paradigm will be chosen for selective knowledge exchange.

Use Case: ISP-Managed Content Distribution

To experiment with the capabilities of the proposed approach, we will consider a distributed SDN network environment, where an ISP operates a content distribution service. In this scenario, a set of content items is cached within the ISP. The management system of the network periodically updates (e.g. in order of hours) the bandwidth allocation and the content placement, but also reconfigures in real-time the request routing (i.e. the routing of users' requests) by programming the underlying forwarding hardware. Figure 1 depicts a simplified representation of this use case. Here, the network is divided in two partitions, each under the control of a local manager (i.e., Mgr1/2). In addition, a controller is assigned to each partition (i.e., Ctrl1/2) to interact with the network devices in the corresponding area. Each manager implements an instance of a distributed Request Routing (RR) reconfiguration application which interacts with the monitoring modules to check the link utilization and the server load in the relevant partition. To collect network statistics, each monitoring module schedules periodic switch polls to acquire the values of the switch-port counters, together with periodic checks of the servers' CPUs and outbound traffic. The acquired data is then processed (filtered and aggregated) to form knowledge which is disseminated both locally (i.e. to the local applications) and to remote monitoring modules. We consider a simple example for this use case. Let us assume that, by default, all the requests received at a given user location are served by Cache1 and that congestion occurs on a link located in partition 2. In this case the knowledge obtained by Mgr2, notifying the congestion, is exchanged with the monitoring module on Mgr1. This enables the RR application on Mgr1 to modify the request-routing configurations by assigning part of the new requests to Cache2, thus reducing the utilization of the congested link. The performance of the reconfiguration performed by Mgr1 depends on the timeliness, accuracy and level of granularity of the information shared between the two monitoring modules.

Summary and Future Work

We have presented the main research challenges associated with the design of a scalable monitoring framework that can provide heterogeneous management applications, distributed over a large-scale SDN, with reliable and accurate knowledge. In next steps of this research, we plan to demonstrate the capabilities of our approach by investigating 1) the type of information which can be extracted from the network infrastructure (not only the forwarding hardware), 2) how information can be efficiently exchanged, and 3) the possible implications in terms of delay and cost for the network. We will use the use-case described in the previous section as a baseline for the evaluation of the proposed approach in terms of generated overhead and synchronization time.

Fig. 1 .

 1 Fig. 1. Example representation of the use case.

Acknowledgement

This research was funded by the UK EPSRC KCN project (EP/L026120/1) and by the Flamingo Network of Excellence project (318488) of the EU Seventh Framework Programme.