Recently, enterprises have paid attention to permissioned blockchain (BC), where business transactions among inter-authorized organizations (forming a consortium) can automatically be executed on the basis of a distributed consensus protocol, and applications of BC have expanded as permissioned BC has adopted the features of the smart contract (SC), which is programmable user-defined business logic deployed in BC and executed with the consensus protocol. A single BC-based system will be built across multiple management domains (e.g., the data centers of each organization) having different operational policies (e.g., operational procedures, timing, dynamic parameters); although establishing system management and operations over BCbased systems (e.g., SC installation for updates) will be important for production uses, such multi-domain formation will trigger a problem in that executing system operations over BC-based systems will become time-consuming and costly due to the difficulty in unifying and/or adjusting operational policies, which is important in maintaining operational quality. Toward solving the problem, we propose an operations execution method for BCbased systems; the primary idea is to define operations as a smart contract so that unified and synchronized cross-organizational operations can be executed effectively by using BC-native features (e.g., consensus protocols). To be adaptable to the recent BC architecture in which participating nodes have different types of roles, we designed the proposed method as a hybrid architecture characterized with in-BC consensus establishment and execution status management and out-BC operations execution for all types of nodes operated by agents that listen to triggered events including operational instructions defined in SCs. A performance evaluation using a prototype with Hyperledger Fabric v1.2.0 shows that the proposed method can start executing operations within 3 seconds. Also, a functional evaluation indicates that the proposed method is more effective than alternatives from the aspect of cross-organizational BC-based system operations. Furthermore, a cost evaluation based on an estimation model and actual measurement shows that the total yearly cost of SC installation operations for updates at a quarterly pace for a 7organization BC-based system could be reduced by 74 percent compared with a conventional manual method. Keywords-permissioned blockchain; Smart contract; System operations and management; Hyperledger FabricI.

SUMMARYA novel host behavior classification approach is proposed as a preliminary step toward traffic classification and anomaly detection in network communication. Although many attempts described in the literature were devoted to flow or application classifications, these approaches are not always adaptable to the operational constraints of traffic monitoring (expected to work even without packet payload, without bidirectionality, on high-speed networks or from flow reports only, etc.). Instead, the classification proposed here relies on the leading idea that traffic is relevantly analyzed in terms of host typical behaviors: typical connection patterns of both legitimate applications (data sharing, downloading, etc.) and anomalous (eventually aggressive) behaviors are obtained by profiling traffic at the host level using unsupervised statistical classification. Classification at the host level is not reducible to flow or application classification, and neither is the contrary: they are different operations which might have complementary roles in network management. The proposed host classification is based on a ninedimensional feature space evaluating host Internet connectivity, dispersion and exchanged traffic content. A minimum spanning tree (MST) clustering technique is developed that does not require any supervised learning step to produce a set of statistically established typical host behaviors. Not relying on a priori defined classes of known behaviors enables the procedure to discover new host behaviors, that potentially were never observed before. This procedure is applied to traffic collected over the entire year of 2008 on a transpacific (Japan/USA) link. A cross-validation of this unsupervised classification against a classical port-based inspection and a state-of-the-art method provides assessment of the meaningfulness and the relevance of the obtained classes for host behaviors.

No abstract

The number of threats on the Internet is rapidly increasing, and anomaly detection has become of increasing importance. High-speed backbone traffic is particularly degraded, but their analysis is a complicated task due to the amount of data, the lack of payload data, the asymmetric routing and the use of sampling techniques. Most anomaly detection schemes focus on the statistical properties of network traffic and highlight anomalous traffic through their singularities. In this paper, we concentrate on unusual traffic distributions, which are easily identifiable in temporalspatial space (e.g., time/address or port). We present an anomaly detection method that uses a pattern recognition technique to identify anomalies in pictures representing traffic. The main advantage of this method is its ability to detect attacks involving mice flows. We evaluate the parameter set and the effectiveness of this approach by analyzing six years of Internet traffic collected from a trans-Pacific link. We show several examples of detected anomalies and compare our results with those of two other methods. The comparison indicates that the only anomalies detected by the patternrecognition-based method are mainly malicious traffic with a few packets.

No abstract