• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.2B
• /
• pp.27-35
• /
• 2005

As the number of Mobile IP users is expected to grow, the signaling overhead associated with mobility management in the wireless Internet is bound to grow. And since the wireless link has far less bandwidth resources and limited scalability compared to the wired network link, the signaling overhead associated with mobility management has a severe effect on the wireless link. In this paper, we propose IP-Grouping algorithm that can greatly reduce the signaling cost in the wireless link as Access Routers(ARs) with a large rate of handoff are grouped into a Group Zone. Based on the numerical analysis and simulation, we show that the wireless signaling cost in the IP-Grouping is much lower than that of the Hierarchical Mobile IPv6 under various condition.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.30 no.3B
• /
• pp.65-71
• /
• 2005

The primary function of the Internet routers is to forward incoming packets toward their final destinations. IP address lookup is one of the most important functions in evaluating router performance since IP address lookup should be performed in wire-speed for the hundred-millions of incoming packets per second. With CIDR, the IP prefixes of routing table have arbitrary lengths, and hence address lookup by exact match is no longer valid. As a result, when packets arrive, routers compare the destination IP addresses of input packets with all prefixes in its routing table and determine the most specific entry among matching entries, and this is called the longest prefix matching. In this paper, based on parallel multiple hashing and prefix grouping, we have proposed a hardware architecture which performs an address lookup with a single memory access.

• Journal of Korea Multimedia Society
• /
• v.8 no.7
• /
• pp.1012-1021
• /
• 2005

This paper describes the design and implementation of an efficient multi-point multimedia conference system using IP grouping. Existing multi-point multimedia conference systems are difficult for multi-user to perform efficient cooperation due to bandwidth limitation for data transmission of video, audio and documentation. In the case that multi-user uses limited bandwidth, smooth cooperation does not accomplish due to transmission delay for the real-time transmission of image and speech data. A hybrid transfer method which is mixed with distributed and centralized methods is used for smooth cooperation, and the network bandwidth is reduced by forming multi-user conference systems of IP grouping in this paper. Also, adaptive image frame variations are used to solve bottleneck effect according to the number of users. An efficient multi-user conference system is designed to support audio quality.

• Journal of the Institute of Electronics Engineers of Korea TC
• /
• v.43 no.5 s.347
• /
• pp.137-146
• /
• 2006

IP address lookup has become a major bottleneck of packet forwarding and a critical issue for high-speed networking techniques in routers. In this paper, we propose an efficient high-speed IP address lookup scheme using adaptive multiple hashing and prefix grouping. According to our analysis results based on routing data distributions, we grouped prefix lengths and selected the number of hash functions in each group adaptively. As a result, we can reduce collisions caused by hashing. Accordingly, a forwarding table of our scheme has good memory efficiency, and thus is organized with the proper number of memory modules. Also, the proposed scheme has the fast building and searching mechanisms to develop the forwarding table only during a single memory access.

• Proceedings of the KSPS conference
• /
• 1996.10a
• /
• pp.246-246
• /
• 1996

Purpose: Some of the properties of the prosodic phrasing and some acoustic and phonological effects of contrastive focus on the tonal pattern of Seoul Korean is explored based on a brief experiment of analyzing the fundamental frequency(=FO) contour of the speech of the author. Data Base and Analysis Procedures: The examples were chosen to contain mostly nasal and liquid consonants, since it is difficult to track down the formants in stops and fricatives during their corresponding consonantal intervals and stops may yield an effect of unwanted increase in the FO value due to their burst into the following vowel. All examples were recorded three times and the spectrum of the most stable repetition was generated, from which the FO contour of each sentence was obtained, the peaks with a value higher than 250Hz being interpreted as a high tone (=H). The result is then discussed within the prosodic hierarchy framework of Selkirk (1986) and compared with the tonal pattern of the Northern Kyungsang dialect of Korean reported in Kenstowicz & Sohn (1996). Prosodic Phrasing: In N.K. Korean, H never appears both on the object and on the verb in a neutral sentence, which indicates the object and the verb form a single Phonological Phrase ($={\phi}$), given that there is only one pitch peak for each $={\phi}$. However, Seoul Korean shows that both the object and the verb have H of their own, indicating that they are not contained in one $={\phi}$. This violates the Optimality constraint of Wrap-XP (=Enclose a lexical head and its arguments in one $={\phi}$), while N.K. Korean obeys the constraint by grouping a VP in a single $={\phi}$. This asymmetry can be resolved through a constraint that favors the separate grouping of each lexical category and is ranked higher than Wrap-XP in Seoul Korean but vice versa in N.K. Korean; $Align-x^{lex}$ (=Align the left edge of a lexical category with that of a $={\phi}$). (1) nuna-ka manll-ll mEk-nIn-ta ('sister-NOM garlic-ACC eat-PRES-DECL') a. (LLH) (LLH) (HLL) ----Seoul Korean b. (LLH) (LLL LHL) ----N.K. Korean Focus and Phrasing: Two major effects of contrastive focus on phonological phrasing are found in Seoul Korean: (a) the peak of an Intonatioanl Phrase (=IP) falls on the focused element; and (b) focus has the effect of deleting all the following prosodic structures. A focused element always attracts the peak of IP, showing an increase of approximately 30Hz compared with the peak of a non-focused IP. When a subject is focused, no H appears either on the object or on the verb and a focused object is never followed by a verb with H. The post-focus deletion of prosodic boundaries is forced through the interaction of StressFocus (=If F is a focus and DF is its semantic domain, the highest prominence in DF will be within F) and Rightmost-IP (=The peak of an IP projects from the rightmost $={\phi}$). First Stress-F requires the peak of IP to fall on the focused element. Then to avoid violating Rightmost-IP, all the boundaries after the focused element should delete, minimizing the number of $={\phi}$'s intervening from the right edge of IP. (2) (omitted) Conclusion: In general, there seems to be no direct alignment constraints between the syntactically focused element and the edge of $={\phi}$ determined in phonology; all the alignment effects come from a single requirement that the peak of IP projects from the rightmost $={\phi}$ as proposed in Truckenbrodt (1995).

• KSII Transactions on Internet and Information Systems (TIIS)
• /
• v.6 no.5
• /
• pp.1445-1462
• /
• 2012

While botnets are used for various malicious activities, it is well known that they are widely used for email spam. Though the spam filtering systems currently in use block IPs that send email spam, simply blocking the IPs of zombie PCs participating in a botnet is not enough to prevent the spamming activities of the botnet because these IPs can easily be changed or manipulated. This IP blocking is also insufficient to prevent crimes other than spamming, as the botnet can be simultaneously used for multiple purposes. For this reason, we propose a system that detects botnets and zombie PCs based on email spam analysis. This study introduces the concept of "group pollution level" - the degree to which a certain spam group is suspected of being a botnet - and "IP pollution level" - the degree to which a certain IP in the spam group is suspected of being a zombie PC. Such concepts are applied in our system that detects botnets and zombie PCs by grouping spam mails based on the URL links or attachments contained, and by assessing the pollution level of each group and each IP address. For empirical testing, we used email spam data collected in an "email spam trap system" - Korea's national spam collection system. Our proposed system detected 203 botnets and 18,283 zombie PCs in a day and these zombie PCs sent about 70% of all the spam messages in our analysis. This shows the effectiveness of detecting zombie PCs by email spam analysis, and the possibility of a dramatic reduction in email spam by taking countermeasure against these botnets and zombie PCs.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.5B
• /
• pp.378-389
• /
• 2006

An IP address lookup scheme has become a critical issue increasingly for high-speed networking techniques due to the advent of IPv6 based on 128bit. In this paper, a novel global IPv6 unicast address lookup scheme is proposed for next generation internet routers. The proposed scheme perform a variable multiple hashing based on prefix grouping. Accordingly, it should not only minimize overflows with the proper number of memory modules, but also reduce a memory size required to organize forwarding tables. It has the fast building and searching mechanisms for forwarding tables during only a single memory access. Besides, it is easy to update forwarding tables incrementally. In the simulation using CERNET routing data as a 6bone test phase, we compared the proposed scheme with a similar scheme using a uniform multiple hashing. As a result, we verified that the number of overflows is reduced by 50% and the size of memory for forwarding tables is shrunken by 15% with 8 tables.

• ETRI Journal
• /
• v.27 no.1
• /
• pp.22-42
• /
• 2005

Traditional traffic identification methods based on wellknown port numbers are not appropriate for the identification of new types of Internet applications. This paper proposes a new method to identify current Internet traffic, which is a preliminary but essential step toward traffic characterization. We categorized most current network-based applications into several classes according to their traffic patterns. Then, using this categorization, we developed a flow grouping method that determines the application name of traffic flows. We have incorporated our method into NG-MON, a traffic analysis system, to analyze Internet traffic between our enterprise network and the Internet, and characterized all the traffic according to their application types.

• The Journal of Korean Institute of Communications and Information Sciences
• /
• v.31 no.8B
• /
• pp.691-700
• /
• 2006

Based on the destination IP address of incoming packets, the Internet routers determine next hops and forward packets toward final destinations through If address lookup. The bandwidth of communication links increases exponentially fast as well as the routing table size grows significant as the number of single host networks attached to the Internet increases. Since packets should be processed at wire-speed, the increased link speed reduces the processing time of a packet in routers, and hence more efficient and fast IP address lookup algorithms and architectures are required in the next generation routers. Most of the previous IP lookup schemes compare routing prefixes of shorter length first with a given input IP address. Since IP address lookup needs to find the most specific route of the given input, search continues until the longest matched prefix is found while it keeps remembering the current test matching prefix. In this paper, based on binary search on prefix length, we proposed a new IP address lookup algorithm which compares longer prefixes first. The proposed scheme is consisted of multiple tries with prefixes on leaves only. The trie composed of the longest prefixes is primarily searched whether there is a match with the given input. This processing is repeated for the trio of the next longer prefixes until there finds a match. Hence the proposed algorithm provides the fast search speed. The proposed algorithm also provides the incremental update of prefixes while the previous binary search on length scheme does not provide the incremental update because of pre-processing requirement. In this paper, we performed extensive simulations and showed the performance comparisons with related works.

• Journal of the Korea Institute of Information Security & Cryptology
• /
• v.33 no.4
• /
• pp.687-697
• /
• 2023

Botnets, whose attack patterns are becoming more sophisticated and diverse, are recognized as one of the most serious cybersecurity threats today. This paper revisits the experimental results of botnet detection using autoencoder, a semi-supervised deep learning model, for UGR and CTU-13 data sets. To prepare the input vectors of autoencoder, we create data points by grouping the NetFlow records into sliding windows based on source IP address and aggregating them to form features. In particular, we discover a simple power-law; that is the number of data points that have some flow-degree is proportional to the number of NetFlow records aggregated in them. Moreover, we show that our power-law fits the real data very well resulting in correlation coefficients of 97% or higher. We also show that this power-law has an impact on the learning of autoencoder and, as a result, influences the performance of botnet detection. Furthermore, we evaluate the performance of autoencoder using the area under the Receiver Operating Characteristic (ROC) curve.