Open Access
A survey on detection techniques for cryptographic ransomware
(IEEE, 2019) Berrueta Irigoyen, Eduardo; Morató Osés, Daniel; Magaña Lizarrondo, Eduardo; Izal Azcárate, Mikel; Ingeniaritza Elektrikoa, Elektronikoaren eta Telekomunikazio Ingeniaritzaren; Institute of Smart Cities - ISC; Ingeniería Eléctrica, Electrónica y de Comunicación
Crypto-ransomware is a type of malware that encrypts user files, deletes the original data, and asks for a ransom to recover the hijacked documents. It is a cyber threat that targets both companies and residential users, and has spread in recent years because of its lucrative results. Several articles have presented classifications of ransomware families and their typical behaviour. These insights have stimulated the creation of detection techniques for antivirus and firewall software. However, because the ransomware scene evolves quickly and aggressively, these studies quickly become outdated. In this study, we surveyed the detection techniques that the research community has developed in recent years. We compared the different approaches and classified the algorithms based on the input data they obtain from ransomware actions, and the decision procedures they use to reach a classification decision between benign or malign applications. This is a detailed survey that focuses on detection algorithms, compared to most previous studies that offer a survey of ransomware families or isolated proposals of detection algorithms. We also compared the results of these proposals.
Open Access
Internet traffic shaping for IP over WDM links with source output buffering or multiple parallel wavelengths
(Kluwer Academic Publishers, 2001) Aracil Rico, Javier; Izal Azcárate, Mikel; Morató Osés, Daniel; Automática y Computación; Automatika eta Konputazioa
Since the number of wavelengths per fiber is growing in an exponential fashion the over- flow traffic can be routed through overflow lightpaths, thus providing an ideal network with near-infinite capacity and almost no-buffering. Such unprecedented bandwidth growth in the network backbone is only limited by the processing speed of the electronic elements. Even though multiple parallel high-speed channels (lightpaths) are provided between IP routers the switching speed of the latter is an order of magnitude below the lightpath transmission speed. As a result, minimizing transfer delay is not only a matter of forwarding traffic as fast as possible but to shape traffic so that the input queues of the destination routers do not over-flow. Even though it is desirable to exploit the WDM capabilities to forward traffic in parallel channels in order to nearly eliminate the router output buffering, it turns out that the extreme burstiness of Internet traffic is even increased by routing part of the traffic through a backup channel. Instead, the use of source output buffering for traffic shaping purposes proves more beneficial. In this paper, we examine the typical scenario of a static WDM network with several wavelengths between IP routers. In a simple configuration of a primary and over flow lightpath the results show that if 3% of the traffic is routed through the over flow lightpath then the packet forwarding speed in the destination router should be increased in 20% in order to obtain the same transfer delay as with the single lightpath configuration with source output buffering.
Open Access
A proposal of burst cloning for video quality improvement in optical burst switching networks
(2013) Espina Antolín, Félix; Morató Osés, Daniel; Izal Azcárate, Mikel; Magaña Lizarrondo, Eduardo; Automática y Computación; Automatika eta Konputazioa
Open Access
Delay-throughput curves for timer-based OBS burstifiers with light load
(IEEE, 2006) Izal Azcárate, Mikel; Aracil Rico, Javier; Morató Osés, Daniel; Magaña Lizarrondo, Eduardo; Automática y Computación; Automatika eta Konputazioa
The OBS burstifier delay-throughput curves are analyzed in this paper. The burstifier incorporates a timer-based scheme with minimum burst size, i. e., bursts are subject to padding in light-load scenarios. Precisely, due to this padding effect, the burstifier normalized throughput may not be equal to unity. Conversely, in a high-load scenario, padding will seldom occur. For the interesting light-load scenario, the throughput delay curves are derived and the obtained results are assessed against those obtained by trace-driven simulation. The influence of long-range dependence and instantaneous variability is analyzed to conclude that there is a threshold timeout value that makes the throughput curves flatten out to unity. This result motivates the introduction of adaptive burstification algorithms, that provide a timeout value that minimizes delay, yet keeping the throughput very close to unity. The dependence of such optimum timeout value with traffic long-range dependence and instantaneous burstiness is discussed. Finally, three different adaptive timeout algorithms are proposed, that tradeoff complexity versus accuracy.
Open Access
Blocking time analysis of OBS routers with arbitrary burst size distribution
(IEEE, 2003) Morató Osés, Daniel; Izal Azcárate, Mikel; Aracil Rico, Javier; Magaña Lizarrondo, Eduardo; Miqueleiz Alamos, J.; Automática y Computación; Automatika eta Konputazioa
The blocking time distribution for an OBS router is obtained, under the assumption of Poisson-arriving bursts with Pareto, Gaussian and Exponential burst size distributions. Analytical expressions are provided as a function of number of wavelengths per port. Such expressions can be used to dimension Fiber Delay Lines (FDLs) and to perform end-to-end delay estimation. On the other hand, we show that the blocking time distribution becomes exponential as the number of wavelengths increases, regardless of the burst size distribution. Since the burst size distribution is determined by the burst assembly algorithm at the network edges, we conclude that the burst assembly algorithm will have no influence on both burst blocking probability and burst blocking time in future DWDM networks.
Open Access
On linear prediction of Internet traffic for packet and burst switching networks
(IEEE, 2001) Morató Osés, Daniel; Aracil Rico, Javier; Díez Marca, L. A.; Izal Azcárate, Mikel; Magaña Lizarrondo, Eduardo; Automática y Computación; Automatika eta Konputazioa
In this paper, we show that prediction algorithms in the least mean square error sense prove better in a burst rather than in a packet switching network. For the latter, further information about the packet arrival distribution within the prediction interval is required. Regarding burst switching, we compare Optical Burst Switching networks with and without linear prediction to conclude that linear prediction provides a significant improvement in end-to-end latency with low bandwidth waste.
Open Access
Improving efﬁciency of IP alias resolution based on offsets between IP addresses
(IEEE, 2009) García-Jiménez, Santiago; Magaña Lizarrondo, Eduardo; Morató Osés, Daniel; Izal Azcárate, Mikel; Automática y Computación; Automatika eta Konputazioa
In order to get a router-level topology in Internet, IP address alias resolution techniques allow to identify IP addresses that belong to the same router. There are several proposals to make this identification, some based on active measurements and others based on inference studies. The former provides more accuracy and completeness, however efficiency is very low because of the high number of probes needed. These methods probe IP addresses in pairs. With thousands or even more IP addresses to check for aliases, the number of tests gets too high. In order to reduce the number of probes, we propose to select the pairs of IP addresses to test for aliasing using information available a priori. This selection will be based on the offset (numerical distance) between the IP addresses to test. We will show that we can improve efficiency of active alias identification with almost no loss on completeness and without generating probing traffic. The technique is also adaptable to a distributed measurement scenario.
Open Access
TBDClust: time-based density clustering to enable free browsing of sites in pay-per-use mobile Internet providers
(Elsevier, 2017) Torres García, Luis Miguel; Magaña Lizarrondo, Eduardo; Morató Osés, Daniel; García-Jiménez, Santiago; Izal Azcárate, Mikel; Automatika eta Konputazioa; Institute of Smart Cities - ISC; Automática y Computación
The World Wide Web has evolved rapidly, incorporating new content types and becoming more dynamic. The contents from a website can be distributed between several servers, and as a consequence, web traffic has become increasingly complex. From a network traffic perspective, it can be difficult to ascertain which websites are being visited by a user, let alone which part of the user's traffic each website is responsible for. In this paper we present a method for identifying the TCP connections involved in the same full webpage download without the need of deep packet inspection. This identification is needed for example to enable free browsing of specific websites in a pay per use mobile Internet access. It could be not only for third party promoted websites but also portals to gubernamental or medical emergency websites. The proposal is based on a modification of the DBSCAN clustering algorithm to work online and over one-dimensional sorted data. In order to validate our results we use both real traffic and packet captures from a controlled environment. The proposal achieves excellent results in consistency (99%) and completeness (92%), meaning that its error margin identifying the webpage downloads is minimal.
Open Access
Computation of traffic time series for large populations of IoT devices
(MDPI, 2018) Izal Azcárate, Mikel; Morató Osés, Daniel; Magaña Lizarrondo, Eduardo; García-Jiménez, Santiago; Ingeniaritza Elektrikoa, Elektronikoaren eta Telekomunikazio Ingeniaritzaren; Institute of Smart Cities - ISC; Ingeniería Eléctrica, Electrónica y de Comunicación
En este artículo se estudian las tecnicas para clasificar paquetes de tráfico de red en múltiples clases orientadas a la realización de series temporales de tráfico en escenarios de un elevado numero de clases como pueden ser los proveedores de red para dispositivos IoT. Se muestra que usando técnicas basadas en DStries se pueden monitorizar en tiempo real redes con decenas de miles de dispositivos.
Open Access
Ingress traffic classification versus aggregation in video over OBS networks
(2010) Izal Azcárate, Mikel; Espina Antolín, Félix; Morató Osés, Daniel; Magaña Lizarrondo, Eduardo; Automática y Computación; Automatika eta Konputazioa
Optical Burst Switched (OBS) networks may become a backbone technology for video-on-demand providers. This work addresses the problem of dimensioning the access link of an ingress node to the optical core network in a video over OBS scenario. A video-ondemand provider using an OBS transport network will have to deliver traffic to a set of egress destinations. A large part of this traffic would be composed of video streaming traffic. However, in a real network there would be also a fraction of non video traffic related to non video services. This work studies the decision whether it is better to gather all traffic to the same destination in a joint burst assembler or separate video and general data traffic on different burs assemblers. The later may increase burst blocking probability but also allow for better tuning of OBS parameters that help improve video reception quality. Result show that this tuning of parameters is not enough to compensate the drop probability increase and thus it is better to aggregate video and general data traffic.