بهاء قاسم محمد الموسوي

The Border Gateway Protocol (BGP) is an Internet routing protocol responsible for exchanging network reachability information between Autonomous Systems (ASes). Monitoring and mining BGP traffic are important aspects to understand and improve the stability of the Internet. However, identifying the characteristics of BGP traffic is much harder than it seems at a first glance where BGP traffic has been identified as complex, voluminous, and noisy. In this paper, we show that BGP traffic can be understood as an aggregation of oscillations of different frequencies from different ASes. Using linear and nonlinear statistical analysis, we show that BGP traffic shows recurrent behaviour. The source of this behaviour is unsynchronised periodic behaviour from a set of ASes.

The Border Gateway Protocol (BGP) is the Internet’s default inter-domain routing protocol that manages connectivity among Autonomous Systems (ASes). Over the past two decades many anomalies of BGP have been identified that threaten its stability and reliability. This paper discusses and classifies these anomalies and discusses the 20 most significant techniques used to identify them. Our classification is based on the broad category of approach, BGP features used to identify the anomaly, effectiveness in identifying the anomaly and effectiveness in identifying which AS was the location of the event that caused the anomaly. We also discuss a number of key requirements for the next generation of BGP anomaly detection techniques.

This technical report describes the operation of BGP replay tool v0.1 (BRT v0.1), a tool to replay past BGP updates with time stamp. Comparing with other BGP replay and inject tools, BGP replay tool does not require kernel modification at host’s OS and support different BGP attributes. The evaluation of this tool has been done using Virtual Internet Routing Lab (VIRL) as a controlled testbed.

The Border Gateway Protocol (BGP) is the default Internet routing protocol that manages connectivity among Autonomous Systems (ASes). Although BGP disruptions are rare, when they occur the consequences can be very damaging. Consequently there has been considerable effort aimed at understanding what is normal and abnormal BGP traffic and, in so doing, enable potentially disruptive anomalous traffic to be identified quickly. In this paper, we make two contributions. We show that over time BGP messages from BGP speakers have deterministic, recurrence and non-linear properties, then build on this insight to introduce the idea of using Recurrence Quantification Analysis (RQA) to detect BGP instability. RQA can be used to provide rapid identification of traffic anomalies that can lead to BGP instability. Furthermore, RQA is able to detect abnormal behaviours that may pass without observation.

Denial-of-Service (DoS) is a network security problem that constitutes a serious challenge to reliability of services deployed on the servers. The aim of DoS attacks is to exhaust a resource in the target system, reducing or completely subverting the availability of the service provided. Threat of DoS attacks has become even more severe with DDoS (Distributed Denial-of-Service) attack. It is an attempt by malicious users to carry out DoS attack indirectly with the help of many compromised computers on the Internet. Service providers are under mounting pressure to prevent, monitor and mitigate DoS/DDoS attacks directed toward their customers and their infrastructure. Defending against those types of attacks is not a trivial job, mainly due to the use of IP spoofing and the destination-based routing of the Internet, though there are many proposed methods which aim to alleviate the problem like Firewalls, Intrusion Detection Systems, Ingress filtering, IP Traceback, SYN Proxy etc. This paper discusses the efficient packet filtering technique using firewall to defend against DoS/DDoS attacks. Firewall scripts are written using command-line tool iptables in Linux to deny the suspicious traffic. Packet analyzer tool used to showcase the effectiveness of the scripts in mitigating the various kinds of DoS/DDoS attacks.

Secure Shell (SSH) is a secure remote login program which can be used in place of regular telnet. It has become the default remote access method for administration of UNIX systems. It is very common for public Internet facing servers to experience attacks that attempt to brute force username and password combinations via SSH to gain access. This paper examines these attacks depending on SSH log file to find unsuccessful logins then blocks IP addresses of unsuccessful logins for a period of time that is decided by administrator and then send an e-mail to administrator to consider whether the addresses blocked belong to users failed to access or by an attacker, finally the administrator will block attacker's IP address forever. Some attackers highly skilled and just used trusted IP address as a user name then the software will block the IP address of attacker as well as the victim IP address that is used by attacker. In this paper, an adaptive mechanism was built-in to distinguish between attacker IP address and victim IP address which may be used by an attacker, and then the program will block just attacker IP address.

Governments and their agencies are often challenged by high cost and flexible telephonic, Web based data services. Emerging technologies, such as those of Voice over Internet Protocol (VoIP) that allow convergent systems where voice and Web technologies can utilize the same network to provide both services, can be used to improve such services. This paper describe VoIP system for the enterprise network (e.g. company, university) that have been developed based on Asterisk which is a kind of open source software to implement IP-PBX system. Through the development and evaluation, we have confirmed that VoIP system based on Asterisk is very powerful as a whole and most PBX functions to be required for the enterprise network can be realized. Interesting findings include that the University of Kufa has a potential to implement the project. By connecting multiple Asterisk servers located in different sites based on IAX2, large scale enterprise network can be developed. Since the software recommended for installation is open source, the project could be used as a source of valuable information by students who specialize in real-time multi-media systems.

In this paper a secret-key Steganographic system will be illustrated which embeds four gray-scale secret images of size (128 128 ×) pixels into a cover image of size (512 512 ×) pixels. The techniques used in this project to analyze the cover into its frequency components are a Wavelet transform and a new transform that is called Hybrid transform. Hybrid transform overcomes the weakness of Wavelet in higher dimensions; with this transform we own Orthonormality. The Hybrid transform is itself invert-the inverse transform use the same algorithm as the forward transform. Combinations of Steganography and cryptography have been made in this work to increase the level of security and to make the system more complex to be defeated by attackers. By both objective and subjective observations, the resultant stego-image that will be transmitted did not draw any suspicion, so the main goal of Steganography is performed. The proposed system can easily be applied by any end user who can provide the system with his key and both the embedded and the cover images, and to get the stego-image. The results obtained from Hybrid transform are better than obtained in Wavelet transform. The proposed system was built by using (Matlab version 6.5) and run on Pentium-4 computer.

In recent years, we witnessed the ensuing surge in massive numbers and types of attacks. The future years will continue these trends but at a faster pace as a result of increasing the number of devices and the development of IoT devices. Thus, it becomes really important to detect different types of threats and hence secure these resources. To that end, previous works examined different feature selection techniques and machine learning algorithms. However, they are either suffer from a low detection accuracy or are not able to detect various types of attacks particularly the low-frequency attacks like worms. In this paper, we use multiple feature selection algorithms to find the subset of the more relevant features regarding each type of attack. Forward Selection Ranking and Backward Elimination Ranking algorithms are used along with decision tree classifier and random forest classifier. The system is evaluated in terms of accuracy, precision, sensitivity, and F-score and shows very high performance in detecting all types of attacks. It can detect all types of attacks with an accuracy rate of 99.9% and 99.96% for binary classification.

Presenting my project "Rapid Detection of BGP Anomalies"II </br> For more information, see https://conference.apnic.net/44/program/speakers/#/bahaa-al-musawi

I have awarded Student Travel Grant (STG) for 5th PhD School on Traffic Monitoring and Analysis 2015 (TMA2015) in Barcelona, Spain during April 21-22, 2015. The grant includes the registration, accommodation cost, and flight costs.

CAIA has been awarded one of three APNIC Internet Operations Research Grants under the ISIF Asia grants 2016 scheme, for a project titled "Rapid detection of BGP anomalies" see http://discover.isif.asia/2016/08/isif-asia-2016-grant-recipients-announced/. This project will be run by Bahaa Al-Musawi, Philip Branch and Grenville Armitage. The project link is available on http://caia.swin.edu.au/tools/bgp/brt/